arstechnica.com Open in urlscan Pro
3.20.147.38 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://arstechnica.com/information-technology/2020/03/never-before-seen-at=
Effective URL:
https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-orga...
Submission: On March 25 via api (March 25th 2020, 4:55:35 pm UTC) from US

Summary HTTP 249 Redirects Links 46 Behaviour Indicators

Summary

This website contacted 56 IPs in 7 countries across 39 domains to perform 249 HTTP transactions. The main IP is 3.20.147.38, located in Seattle, United States and belongs to AMAZON-02, US. The main domain is arstechnica.com.
TLS certificate: Issued by Amazon on January 26th 2020. Valid for: a year.

This is the only time arstechnica.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 3	3.20.147.38 3.20.147.38	16509 (AMAZON-02) (AMAZON-02)
17	205.234.175.175 205.234.175.175	30081 (CACHENETW...) (CACHENETWORKS)
25	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE)
3	99.86.0.120 99.86.0.120	16509 (AMAZON-02) (AMAZON-02)
6	95.101.185.51 95.101.185.51	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
18	95.101.185.246 95.101.185.246	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	143.204.202.115 143.204.202.115	16509 (AMAZON-02) (AMAZON-02)
3	13.32.2.59 13.32.2.59	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700::68... 2606:4700::6813:da83	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	151.139.128.10 151.139.128.10	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:800::2008	15169 (GOOGLE) (GOOGLE)
17	172.217.22.98 172.217.22.98	15169 (GOOGLE) (GOOGLE)
3	95.101.185.159 95.101.185.159	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	18.211.127.174 18.211.127.174	14618 (AMAZON-AES) (AMAZON-AES)
2	143.204.208.228 143.204.208.228	16509 (AMAZON-02) (AMAZON-02)
1	52.19.1.241 52.19.1.241	16509 (AMAZON-02) (AMAZON-02)
2	151.101.12.239 151.101.12.239	54113 (FASTLY) (FASTLY)
5	2a00:1450:400... 2a00:1450:4001:817::200e	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6811:4032	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	35.190.59.101 35.190.59.101	15169 (GOOGLE) (GOOGLE)
2	35.201.67.47 35.201.67.47	15169 (GOOGLE) (GOOGLE)
9	152.195.132.202 152.195.132.202	15133 (EDGECAST) (EDGECAST)
1	52.213.78.12 52.213.78.12	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:81d::200e	15169 (GOOGLE) (GOOGLE)
14	52.202.152.193 52.202.152.193	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:4001:81b::200e	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:81b::2001	15169 (GOOGLE) (GOOGLE)
1	52.0.203.166 52.0.203.166	14618 (AMAZON-AES) (AMAZON-AES)
1 1	2a00:1450:400... 2a00:1450:400c:c00::9b	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:806::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81e::2003	15169 (GOOGLE) (GOOGLE)
1	35.190.40.172 35.190.40.172	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:da5d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	34.231.184.25 34.231.184.25	14618 (AMAZON-AES) (AMAZON-AES)
2	52.73.54.41 52.73.54.41	14618 (AMAZON-AES) (AMAZON-AES)
1	2606:4700:10:... 2606:4700:10::6814:b844	13335 (CLOUDFLAR...) (CLOUDFLARENET)
25	13.227.157.224 13.227.157.224	16509 (AMAZON-02) (AMAZON-02)
1	2a02:2638::3 2a02:2638::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	143.204.202.100 143.204.202.100	16509 (AMAZON-02) (AMAZON-02)
1	54.77.139.233 54.77.139.233	16509 (AMAZON-02) (AMAZON-02)
7	95.101.186.38 95.101.186.38	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
4	13.227.157.149 13.227.157.149	16509 (AMAZON-02) (AMAZON-02)
1	52.3.43.18 52.3.43.18	14618 (AMAZON-AES) (AMAZON-AES)
2	64.202.112.127 64.202.112.127	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1	2a00:1450:400... 2a00:1450:4001:809::2006	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
5	99.84.89.112 99.84.89.112	16509 (AMAZON-02) (AMAZON-02)
1	151.101.14.2 151.101.14.2	54113 (FASTLY) (FASTLY)
4	52.0.16.6 52.0.16.6	14618 (AMAZON-AES) (AMAZON-AES)
1	70.42.32.127 70.42.32.127	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
4	23.37.55.184 23.37.55.184	16625 (AKAMAI-AS) (AKAMAI-AS)
4	69.173.144.143 69.173.144.143	26667 (RUBICONPR...) (RUBICONPROJECT)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
8 20	152.199.21.89 152.199.21.89	15133 (EDGECAST) (EDGECAST)
2	178.250.0.165 178.250.0.165	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2a03:2880:f01... 2a03:2880:f01c:800e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
249	56

3 3.20.147.38 (Seattle, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-20-147-38.us-east-2.compute.amazonaws.com

arstechnica.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 205.234.175.175 (United States)

ASN30081 (CACHENETWORKS, US)
PTR: vip1.G-anycast1.cachefly.net

cdn.arstechnica.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 99.86.0.120 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-0-120.fra6.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 95.101.185.51 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a95-101-185-51.deploy.static.akamaitechnologies.com

js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 95.101.185.246 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a95-101-185-246.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
px.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.202.115 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-202-115.fra53.r.cloudfront.net

embed.actionbutton.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.32.2.59 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-2-59.muc51.r.cloudfront.net

player.cnevids.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6813:da83 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.mediavoice.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
plugin.mediavoice.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.139.128.10 (Dallas, United States)

ASN20446 (HIGHWINDS3, US)

s.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 172.217.22.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s18-in-f98.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 95.101.185.159 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a95-101-185-159.deploy.static.akamaitechnologies.com

widgets.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.211.127.174 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-211-127-174.compute-1.amazonaws.com

api.cnevids.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.208.228 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-208-228.fra53.r.cloudfront.net

d1z2jf7jlzjs58.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.19.1.241 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-19-1-241.eu-west-1.compute.amazonaws.com

segment-data.zqtk.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.12.239 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

pixel.condenastdigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:817::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:4032 (United States)

ASN13335 (CLOUDFLARENET, US)

polarcdn-terrax.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.190.59.101 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 101.59.190.35.bc.googleusercontent.com

r.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.201.67.47 (Ascension Island)

ASN15169 (GOOGLE, US)
PTR: 47.67.201.35.bc.googleusercontent.com

t.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 152.195.132.202 (United States)

ASN15133 (EDGECAST, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.213.78.12 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-213-78-12.eu-west-1.compute.amazonaws.com

mb.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ampcid.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 52.202.152.193 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-202-152-193.compute-1.amazonaws.com

capture.condenastdigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ampcid.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:81b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.0.203.166 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-0-203-166.compute-1.amazonaws.com

srv-2020-03-25-16.config.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9b (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.40.172 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 172.40.190.35.bc.googleusercontent.com

api.skimlinks.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:da5d (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.1trust.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.231.184.25 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-231-184-25.compute-1.amazonaws.com

infinityid.condenastdigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.73.54.41 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-73-54-41.compute-1.amazonaws.com

4d.condenastdigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:b844 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 13.227.157.224 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-227-157-224.muc51.r.cloudfront.net

dwgyu36up6iuz.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.202.100 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-202-100.fra53.r.cloudfront.net

mid.rkdms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.77.139.233 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-77-139-233.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 95.101.186.38 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a95-101-186-38.deploy.static.akamaitechnologies.com

tcheck.outbrainimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images.outbrainimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.227.157.149 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-227-157-149.muc51.r.cloudfront.net

d2c8v52ll5s99u.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.3.43.18 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-3-43-18.compute-1.amazonaws.com

srv-2020-03-25-16.pixel.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.202.112.127 (United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com

log.outbrainimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 99.84.89.112 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-89-112.muc50.r.cloudfront.net

dp8hsntg6do36.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.14.2 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

odb.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.0.16.6 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-0-16-6.compute-1.amazonaws.com

wren.condenastdigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 70.42.32.127 (United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com

mcdp-nydc1.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.37.55.184 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-55-184.deploy.static.akamaitechnologies.com

ads.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
secure-assets.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 69.173.144.143 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

optimized-by.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

api.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 152.199.21.89 (United States) 8 redirects

ASN15133 (EDGECAST, US)

adserver-us.adtech.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.0.165 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

bidder.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f01c:800e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK, US)

an.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
36	cloudfront.net d1z2jf7jlzjs58.cloudfront.net dwgyu36up6iuz.cloudfront.net d2c8v52ll5s99u.cloudfront.net dp8hsntg6do36.cloudfront.net	1 MB
24	condenastdigital.com pixel.condenastdigital.com capture.condenastdigital.com infinityid.condenastdigital.com 4d.condenastdigital.com wren.condenastdigital.com	23 KB
20	advertising.com 8 redirects adserver-us.adtech.advertising.com	11 KB
19	googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	33 KB
19	moatads.com z.moatads.com mb.moatads.com px.moatads.com	562 KB
18	doubleclick.net 1 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net pubads.g.doubleclick.net	269 KB
17	arstechnica.net cdn.arstechnica.net	1005 KB
10	googletagservices.com www.googletagservices.com	236 KB
9	outbrainimg.com tcheck.outbrainimg.com log.outbrainimg.com images.outbrainimg.com	54 KB
9	cookielaw.org cdn.cookielaw.org	165 KB
8	rubiconproject.com ads.rubiconproject.com optimized-by.rubiconproject.com secure-assets.rubiconproject.com fastlane.rubiconproject.com	21 KB
8	skimresources.com 1 redirects s.skimresources.com r.skimresources.com t.skimresources.com p.skimresources.com	18 KB
5	google-analytics.com www.google-analytics.com	20 KB
5	outbrain.com widgets.outbrain.com odb.outbrain.com mcdp-nydc1.outbrain.com	53 KB
5	google.de adservice.google.de ampcid.google.de www.google.de	2 KB
5	cnevids.com player.cnevids.com api.cnevids.com	63 KB
4	casalemedia.com as-sec.casalemedia.com	2 KB
4	google.com 1 redirects adservice.google.com ampcid.google.com www.google.com	2 KB
3	googleapis.com imasdk.googleapis.com	114 KB
3	amazon-adsystem.com c.amazon-adsystem.com	29 KB
3	arstechnica.com 1 redirects arstechnica.com	16 KB
2	criteo.com bidder.criteo.com	522 B
2	facebook.net connect.facebook.net	143 KB
2	parsely.com srv-2020-03-25-16.config.parsely.com srv-2020-03-25-16.pixel.parsely.com	886 B
2	polarcdn-terrax.com polarcdn-terrax.com	594 B
2	mediavoice.com cdn.mediavoice.com plugin.mediavoice.com	129 KB
2	indexww.com js-sec.indexww.com	37 KB
1	facebook.com an.facebook.com	1 KB
1	rlcdn.com api.rlcdn.com	203 B
1	2mdn.net s0.2mdn.net	11 KB
1	adsrvr.org match.adsrvr.org	541 B
1	rkdms.com mid.rkdms.com
1	criteo.net static.criteo.net	30 KB
1	onetrust.com geolocation.onetrust.com	466 B
1	1trust.app geolocation.1trust.app	486 B
1	consensu.org api.skimlinks.mgr.consensu.org	636 B
1	zqtk.net segment-data.zqtk.net	568 B
1	googletagmanager.com www.googletagmanager.com	73 KB
1	actionbutton.co embed.actionbutton.co	18 KB
249	39

	Domain	Requested by
25	dwgyu36up6iuz.cloudfront.net	arstechnica.com d2c8v52ll5s99u.cloudfront.net
20	adserver-us.adtech.advertising.com	8 redirects
17	cdn.arstechnica.net	arstechnica.com
16	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net arstechnica.com
14	capture.condenastdigital.com	arstechnica.com
12	px.moatads.com	arstechnica.com
10	pagead2.googlesyndication.com	securepubads.g.doubleclick.net arstechnica.com
10	www.googletagservices.com	arstechnica.com securepubads.g.doubleclick.net
9	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
9	cdn.cookielaw.org	www.googletagmanager.com cdn.cookielaw.org arstechnica.com
6	images.outbrainimg.com	arstechnica.com
6	z.moatads.com	arstechnica.com securepubads.g.doubleclick.net d2c8v52ll5s99u.cloudfront.net
5	dp8hsntg6do36.cloudfront.net	arstechnica.com d2c8v52ll5s99u.cloudfront.net
5	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com arstechnica.com
4	as-sec.casalemedia.com	js-sec.indexww.com
4	wren.condenastdigital.com	cdn.arstechnica.net
4	d2c8v52ll5s99u.cloudfront.net	player.cnevids.com imasdk.googleapis.com d2c8v52ll5s99u.cloudfront.net
3	imasdk.googleapis.com	player.cnevids.com imasdk.googleapis.com
3	r.skimresources.com	1 redirects arstechnica.com
3	widgets.outbrain.com	cdn.arstechnica.net widgets.outbrain.com
3	adservice.google.de	www.googletagservices.com
3	player.cnevids.com	arstechnica.com cdn.arstechnica.net player.cnevids.com
3	c.amazon-adsystem.com	arstechnica.com c.amazon-adsystem.com
3	arstechnica.com	1 redirects cdn.arstechnica.net
2	bidder.criteo.com	static.criteo.net
2	fastlane.rubiconproject.com	js-sec.indexww.com
2	secure-assets.rubiconproject.com	arstechnica.com optimized-by.rubiconproject.com
2	optimized-by.rubiconproject.com	ads.rubiconproject.com
2	ads.rubiconproject.com	securepubads.g.doubleclick.net
2	connect.facebook.net	d2c8v52ll5s99u.cloudfront.net connect.facebook.net
2	log.outbrainimg.com	widgets.outbrain.com
2	4d.condenastdigital.com	pixel.condenastdigital.com
2	infinityid.condenastdigital.com	pixel.condenastdigital.com d2c8v52ll5s99u.cloudfront.net
2	p.skimresources.com	arstechnica.com
2	t.skimresources.com	arstechnica.com s.skimresources.com
2	polarcdn-terrax.com	cdn.mediavoice.com plugin.mediavoice.com
2	pixel.condenastdigital.com	arstechnica.com
2	d1z2jf7jlzjs58.cloudfront.net	arstechnica.com d1z2jf7jlzjs58.cloudfront.net
2	api.cnevids.com	cdn.arstechnica.net
2	adservice.google.com	www.googletagservices.com imasdk.googleapis.com
2	js-sec.indexww.com	arstechnica.com
1	an.facebook.com	js-sec.indexww.com
1	api.rlcdn.com	js-sec.indexww.com
1	pubads.g.doubleclick.net	d2c8v52ll5s99u.cloudfront.net
1	mcdp-nydc1.outbrain.com	widgets.outbrain.com
1	odb.outbrain.com	widgets.outbrain.com
1	s0.2mdn.net	imasdk.googleapis.com
1	srv-2020-03-25-16.pixel.parsely.com	arstechnica.com
1	tcheck.outbrainimg.com	widgets.outbrain.com
1	match.adsrvr.org	js-sec.indexww.com
1	mid.rkdms.com	js-sec.indexww.com
1	static.criteo.net	js-sec.indexww.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	geolocation.1trust.app	cdn.cookielaw.org
1	api.skimlinks.mgr.consensu.org	s.skimresources.com
1	www.google.de	arstechnica.com
1	www.google.com	1 redirects
1	stats.g.doubleclick.net	1 redirects
1	srv-2020-03-25-16.config.parsely.com	d1z2jf7jlzjs58.cloudfront.net
1	ampcid.google.de	www.google-analytics.com
1	ampcid.google.com	www.google-analytics.com
1	mb.moatads.com	z.moatads.com
1	plugin.mediavoice.com	cdn.mediavoice.com
1	segment-data.zqtk.net	arstechnica.com
1	www.googletagmanager.com	arstechnica.com
1	s.skimresources.com	arstechnica.com
1	cdn.mediavoice.com	arstechnica.com
1	embed.actionbutton.co	arstechnica.com
249	68

This site contains links to these domains. Also see Links.

Domain
video.arstechnica.com
www.saudiaramco.com
www.facebook.com
twitter.com
www.reddit.com
securelist.com
cdn.arstechnica.net
www.twitter.com
www.arstechnica.com
www.outbrain.com
www.clicktraceclick.com
mackeeper.com
www.vouchercodes.co.uk
45fa3a.nmptrkgqczwgnrb.com
uk.search.yahoo.com
www.moneypop.com
condenast.com
www.condenast.com
onetrust.com

Subject Issuer	Validity	Valid
*.arstechnica.com Amazon	`2020-01-26` - `2021-02-26`	a year	crt.sh
*.cachefly.net GlobalSign RSA OV SSL CA 2018	`2020-02-06` - `2021-10-29`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2019-10-07` - `2020-09-29`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
*.actionbutton.co Go Daddy Secure Certificate Authority - G2	`2019-06-25` - `2020-06-27`	a year	crt.sh
*.cnevids.com Amazon	`2020-01-22` - `2020-11-16`	10 months	crt.sh
ssl962336.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-11-12` - `2020-05-20`	6 months	crt.sh
*.skimresources.com DigiCert SHA2 Secure Server CA	`2018-09-13` - `2020-10-07`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.outbrain.com DigiCert SHA2 Secure Server CA	`2020-03-09` - `2021-06-08`	a year	crt.sh
cnevideos.com Amazon	`2020-01-13` - `2021-02-13`	a year	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2019-07-17` - `2020-07-05`	a year	crt.sh
*.zqtk.net COMODO RSA Domain Validation Secure Server CA	`2018-08-09` - `2020-08-24`	2 years	crt.sh
condenast.com GlobalSign CloudSSL CA - SHA256 - G3	`2019-10-31` - `2020-08-07`	9 months	crt.sh
ssl446800.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2020-02-21` - `2020-08-29`	6 months	crt.sh
sa437gl.wpc.edgecastcdn.net DigiCert SHA2 Secure Server CA	`2018-05-17` - `2020-08-19`	2 years	crt.sh
*.moatads.com DigiCert SHA2 Secure Server CA	`2019-03-12` - `2021-06-10`	2 years	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.config.parsely.com Amazon	`2020-01-28` - `2021-02-28`	a year	crt.sh
www.google.de GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
api.skimlinks.mgr.consensu.org DigiCert SHA2 Secure Server CA	`2019-10-04` - `2021-10-07`	2 years	crt.sh
1trust.app CloudFlare Inc ECC CA-2	`2020-01-06` - `2020-10-09`	9 months	crt.sh
*.conde.io Amazon	`2019-06-03` - `2020-07-03`	a year	crt.sh
*.onetrust.com DigiCert SHA2 Secure Server CA	`2018-03-12` - `2020-06-14`	2 years	crt.sh
*.criteo.net DigiCert ECC Secure Server CA	`2019-12-03` - `2021-04-06`	a year	crt.sh
*.rkdms.com Entrust Certification Authority - L1K	`2017-10-09` - `2020-10-30`	3 years	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
*.outbrainimg.com DigiCert SHA2 Secure Server CA	`2019-02-24` - `2020-05-25`	a year	crt.sh
*.storage.googleapis.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.pixel.parsely.com Let's Encrypt Authority X3	`2020-01-31` - `2020-04-30`	3 months	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-03-01` - `2020-05-30`	3 months	crt.sh
f2.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-03-03` - `2020-07-25`	5 months	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-02-13` - `2021-02-17`	2 years	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-04-24` - `2020-04-23`	a year	crt.sh
*.adtech.advertising.com DigiCert SHA2 High Assurance Server CA	`2018-05-22` - `2020-05-26`	2 years	crt.sh
*.criteo.com DigiCert ECC Secure Server CA	`2019-12-05` - `2021-04-08`	a year	crt.sh

This page contains 15 frames:

Primary Page: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Frame ID: FE644A75F32360D67B2B5ACABE3D025A
Requests: 185 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: C9155C8BF44212B6976033082B7F92B8
Requests: 1 HTTP requests in this frame

Frame: https://t.skimresources.com/api/v2/robots.txt?__skimjs_preflight__please_ignore__=true&rnd=0.3041695240511262
Frame ID: FD81FADE58D60F373062922BFCEFA12B
Requests: 1 HTTP requests in this frame

Frame: https://polarcdn-terrax.com/privacy/v1.0.0/html/optout/readwrite/
Frame ID: 3F14A5565648D739B4DEC369A848D088
Requests: 1 HTTP requests in this frame

Frame: https://widgets.outbrain.com/nanoWidget/externals/cookie/put.html
Frame ID: A6D3CF8C5F03E4785F6AD0342BAD5B13
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Frame ID: A8BCA64716D010844DDE77DCC47EDF36
Requests: 27 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.376.3_en.html
Frame ID: 643EC797AD8FF73E11553735B9F938CA
Requests: 1 HTTP requests in this frame

Frame: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Frame ID: ED2F677320CEA69DED8A952670DB7ECC
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsth8_MZvK8NCHLCLqUR4S4ZqpMSO5Ohd34SiYeumR-uJ4aU24JOlOqtQvLsrPFBt33tA2uUK22sWMLRl8XAK_vZsMbqIk6pRea7QeGDbLZtukUsXON6TxgwXHQ56jpSVCye32h3AoH1zRCQdIZByzcMNcbM09zGRpSUVudix-eCwbwsaib7Vg9K8iRTTnpnSCXjNPs1VGPz8PfJbZnydBBVUVg2xsqr1lxXKAYPGhDSqJPoH7VhuWWqIA3RyNCbM-e3p9SHru2mI7CwOiiGcOp01f72T_vATApLTLpUDmZUS0-33g&sai=AMfl-YS6URutPAwG9xrRreK7ngtwRZiEaM_cQXOwgJ4od6t8Jrz64L57GDVyHiD_KDvoHgekg8vHX3bLUh1sJh6U1Gn-Gj4FDAwxnB6h-qbI&sig=Cg0ArKJSzBxAv0ht2BWUEAE&urlfix=1&adurl=
Frame ID: 4F33437EBF6C96042DE926B21055720E
Requests: 15 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuS593dwvgo24QZ2YPiSd3dT-idlz-UCYfNyBhLPV6A3y8pfpCgn14ifSTlgmTZE-l3ZRNBJVFnbrCWS-J-7pEPtoUw2x9CXnIa5j01LbVDlOZGMkoWo2kU3TxZRNZCOAjM6a-OE7z2rBuGfA58cRmxJPfaFnAKZxLiudathplrw2tN7gfuyzLaS-L3xLTbodDTXuwAWqSj9AnBcv9xhp5Cupe3C7PrPSd7J92YkSbii3711S22K9fJidlQMnOJ0RB8ST8UN0bQT_s1pZHaupC1SpBqVWrFKWpV5H9mIP03Wi6MvQ&sai=AMfl-YS4Hjka2lLh7aB5Dm9D-vLfQfKTPZopRkG2AGL8uCbi9MLHCYHuuZTzGLXRzgzdbOwApT-i5He2fh1Fmxf5-lKXls20a-lSHZ5iZ399Gw&sig=Cg0ArKJSzI3pNjHTdGtuEAE&urlfix=1&adurl=
Frame ID: 1C978C014DB23F9B0D8592EC05237755
Requests: 15 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvaPGVXPOfahTRCNuKAoB3UaM9o8_9U4wNiPqRbNvzKNlqQnnU6s3EorN5Kq5qidsLYZrf4wJBP6iQrihiiEowvAYOq1zr0w2goLpGK4xX3aJHYv-CaTXpUKHWeF0gTf0dpyCH_XlKqKGCo8xnyEg8D_xF5j1Z4bRZPaxJBaiVrNYb-44jWjzIz47_vqWGrIpZGaUfovwIjR_i09S4bxAISLkwT62N6G48JW3sxotUQq5rbjm2lzzP74GG9cpeQ1Rsq828WPBvmidVGSSIG9l4MKhEKS5g3-QyCmEU6olY&sig=Cg0ArKJSzObN6-IFfZO1EAE&urlfix=1&adurl=
Frame ID: 093467D526A64166182312C8B21906BC
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 7FE0C59C79AEA8CCCF1269005B1CA5EB
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvh_MI_6-eo19s9o8gRqRLex1GEAQvRO-H_xUO_FnR7IyTaSOHjO4-IQJvVuaImaUhYfmn5mLIdtobA1Ay_2KQqHGXz4OTwyAnDLGOx9o7MAws4xutXOYAalxuWOupzKiWf87j9g4BSjQJ_nMwLOz-Pdtt82B6EtpACzmVXUf2eWbGi2rdJnSby2vdh7ozH-GSZtmJFGY5GD2f6Fary_8G2P32nNxzIS1GVdIfkHWjK778Pqbzv3R9OZM92wlZYr9TBkji3lxeVwxK6qx0ubNpebpP_TVhzb6CH5_Vp7TM&sig=Cg0ArKJSzAU_ZRdrgOUhEAE&urlfix=1&adurl=
Frame ID: A3544074CFC57E8B5316D186F5A5E713
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: D78CC2776888EA071B89C66A82A50D5E
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 155946EC85066FEB4C0D00DD0937F744
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://arstechnica.com/information-technology/2020/03/never-before-seen-at= HTTP 301
https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mid... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

html //i

Page Statistics

249
Requests

99 %
HTTPS

32 %
IPv6

39
Domains

68
Subdomains

56
IPs

7
Countries

4249 kB
Transfer

10492 kB
Size

14
Cookies

46 Outgoing links

These are links going to different origins than the main page.

URL: http://video.arstechnica.com/
Title: Videos

Search URL Search Domain Scan URL

URL: https://www.saudiaramco.com/
Title: Saudi Aramco

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https%3A%2F%2Farstechnica.com%2F%3Fpost_type%3Dpost%26p%3D1663038
Title: Share on Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=Never-before-seen+attackers+are+targeting+Mideast+industrial+organizations&url=https%3A%2F%2Farstechnica.com%2F%3Fpost_type%3Dpost%26p%3D1663038
Title: Share on Twitter

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https%3A%2F%2Farstechnica.com%2F%3Fpost_type%3Dpost%26p%3D1663038&title=Never-before-seen+attackers+are+targeting+Mideast+industrial+organizations
Title: Share on Reddit

Search URL Search Domain Scan URL

URL: https://securelist.com/wildpressure-targets-industrial-in-the-middle-east/96360/
Title: post published on Tuesday

Search URL Search Domain Scan URL

URL: https://cdn.arstechnica.net/wp-content/uploads/2020/03/milum-targets.png

Search URL Search Domain Scan URL

URL: https://www.twitter.com/dangoodin001
Title: @dangoodin001

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-how-prince-of-persia-defeated-apple-ii-s-memory-limitations
Title: How Prince of Persia Defeated Apple II's Memory Limitations

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-how-crash-bandicoot-hacked-the-playstation-to-run
Title: How Crash Bandicoot Hacked The Original Playstation

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-myst
Title: Myst: The challenges of CD-ROM | War Stories

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/markiplier-reacts-to-his-top-1000-youtube-comments
Title: Markiplier Reacts To His Top 1000 YouTube Comments

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/customizing-mini-4wd-racers-for-high-speeds-on-a-small-scale
Title: Customizing Mini 4WD Racers For High Speeds On A Small Scale

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-the-evolution-of-oddworld-and-what-comes-next
Title: How Mind Control Saved Oddworld: Abe's Oddysee

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/unsolved-mysteries-bioware-answers-unsolved-mysteries-of-the-mass-effect-universe
Title: Bioware answers unsolved mysteries of the Mass Effect universe

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-civilization
Title: Civilization: It's good to take turns | War Stories

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/sitrep-dod-resets-ballistic-missile-interceptor-program
Title: SITREP: DOD Resets Ballistic Missile Interceptor program

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/warframe-s-rebecca-ford-reviews-your-characters
Title: Warframe's Rebecca Ford reviews your characters

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-subnautica
Title: Subnautica: A world without guns | War Stories

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/army-s-new-pistol-has-had-some-misfires
Title: Army's New Pistol Has Had Some Misfires

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-slay-the-spire-war-stories
Title: How Slay the Spire’s Original Interface Almost Killed the Game | War Stories

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-amnesia-the-dark-descent-the-horror-facade
Title: Amnesia: The Dark Descent - The horror facade | War Stories

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-c-and-c-tiberian-sun
Title: Command & Conquer: Tiberian Sun | War Stories

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-blade-runner-skinjobs-voxels-and-future-noir
Title: Blade Runner: Skinjobs, voxels, and future noir | War Stories

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-dead-space-the-drag-tentacle
Title: Dead Space: The Drag Tentacle | War Stories

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/teach-the-controversy-flat-earthers
Title: Teach the Controversy: Flat Earthers

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/delta-v-the-burgeoning-world-of-small-rockets-paul-allen-s-huge-plane-and-spacex-gets-a-crucial-green-light
Title: Delta V: The Burgeoning World of Small Rockets, Paul Allen's Huge Plane, and SpaceX Gets a Crucial Green-light

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/chris-hadfield-explains-his-space-oddity-video
Title: Chris Hadfield explains his 'Space Oddity' video

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/apollo-the-greatest-leap-episode-1-risk
Title: The Greatest Leap, Episode 1: Risk

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-ultima-online-the-virtual-ecology
Title: Ultima Online: The Virtual Ecology | War Stories

Search URL Search Domain Scan URL

URL: https://video.arstechnica.com/
Title: More videos

Search URL Search Domain Scan URL

URL: http://www.outbrain.com/what-is/default/en
Title: Powered by

Search URL Search Domain Scan URL

URL: https://www.clicktraceclick.com/384fba9c-30c4-4340-b643-28cce2fb4493?sectionid=$section_id$&sectionname=$section_name$&publisherid=$publisher_id$&publishername=$publisher_name$&adtitle=Mac+Antivirus+%282019%29+-+Top+10+Most+Trusted+Antivirus+For+Mac+Users&OutbrainClickId=$ob_click_id$
Title: Mac Antivirus (2019) - Top 10 Most Trusted Antivirus For Mac UsersMy Antivirus Review

Search URL Search Domain Scan URL

URL: https://mackeeper.com/link/8c9605bc-3b80-11ea-9c86-127369ec21d1?tid_ext=Try+This+Trick+to+Get+a+Really+Clean+Mac;$section_name$;$publisher_name$;$ob_click_id$
Title: Try This Trick to Get a Really Clean Macmackeeper.com

Search URL Search Domain Scan URL

URL: https://www.vouchercodes.co.uk/dealfinder/articles/general?utm_source=outbrain&utm_medium=display&utm_campaign=outbrain_general_0320vcdfend
Title: This Chrome Extension Can Save You Money on Your Next Online PurchaseVoucherCodes

Search URL Search Domain Scan URL

URL: https://45fa3a.nmptrkgqczwgnrb.com/?network=outbrain&site=$publisher_name$_$section_name$&subid1=$time_stamp$&subid2=009ff025398fa2b3ff3df16fedd0f6cf8a&subid3=$publisher_id$_$section_id$&subid4=Meet+senior+singles+in+%24%7Bcity%7D%24
Title: Meet senior singles in LondonDating | Sponsored Listings

Search URL Search Domain Scan URL

URL: https://uk.search.yahoo.com/yhs/search?hspart=yahoo&hsimp=yhs-g93a&p=dental+implants&type=dentalimplants-mt-$section_id$_$publisher_name$
Title: Brighten That Smile With Affordable Dental ImplantsYahoo! Search

Search URL Search Domain Scan URL

URL: https://www.moneypop.com/business/the-worst-planes-and-helicopters-ever-made/?utm_campaign=hjm-d-uk-c-0-0-190914-mp-ob-ac-a1&utm_term=5_hjm.jpg&utm_source=ob&utm_medium=$section_id$-ob&utm_content=00e95cbe80e35656914fdfd3cea3ee1ffc
Title: 40 Of The Most Useless Planes Ever MadeMoney Pop

Search URL Search Domain Scan URL

URL: http://condenast.com/

Search URL Search Domain Scan URL

URL: https://www.condenast.com/user-agreement/
Title: User Agreement

Search URL Search Domain Scan URL

URL: https://www.condenast.com/privacy-policy/
Title: Privacy Policy and Cookie Statement

Search URL Search Domain Scan URL

URL: https://www.condenast.com/privacy-policy/#california
Title: Your California Privacy Rights

Search URL Search Domain Scan URL

URL: https://www.condenast.com/online-behavioral-advertising-oba-and-how-to-opt-out-of-oba/#clickheretoreadmoreaboutonlinebehavioraladvertising(oba)
Title: Ad Choices

Search URL Search Domain Scan URL

URL: https://www.condenast.com/cookie-policy
Title: Cookie Policy

Search URL Search Domain Scan URL

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

URL: https://www.condenast.com/privacy-policy#privacypolicy
Title: Privacy Policy and Cookie Statement

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://arstechnica.com/information-technology/2020/03/never-before-seen-at= HTTP 301
https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 49

https://r.skimresources.com/api/ HTTP 307
https://r.skimresources.com/api/?xguid=01E499X4R5ZBGYRSSYS20HAV2V&persistence=1&checksum=be84f6f33491e8b82555da6ac292cd828ed0777e5f657bc985c3b03e1068a7f6

Request Chain 71

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j81&tid=UA-31997-1&cid=505617916.1585155315&jid=1500212355&gjid=1306996031&_gid=265694875.1585155315&_u=aChAgUAjAAQC~&z=220461619 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=505617916.1585155315&jid=1500212355&_v=j81&z=220461619 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=505617916.1585155315&jid=1500212355&_v=j81&z=220461619&slf_rd=1&random=2064984353

Request Chain 246

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1585155323006;callback=window.headertag.AolHtb.adResponseCallbacks._JHF7sFtL;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cfp=1;rndc=1585155324;cmd=bid;cors=yes;v=2;misc=1585155323006;callback=window.headertag.AolHtb.adResponseCallbacks._JHF7sFtL;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA

Request Chain 247

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1585155323007;callback=window.headertag.AolHtb.adResponseCallbacks._qiLU08sE;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323007;callback=window.headertag.AolHtb.adResponseCallbacks._qiLU08sE;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA

Request Chain 253

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._rgbWB57p;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._rgbWB57p;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA

Request Chain 254

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._8jUsosbk;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cfp=1;rndc=1585155324;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._8jUsosbk;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA

Request Chain 257

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cfp=1;rndc=1585155324;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._8jUsosbk;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;apid=1A6bcde0c2-6eb9-11ea-9ac9-128a639db496;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._8jUsosbk;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA

Request Chain 258

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323007;callback=window.headertag.AolHtb.adResponseCallbacks._qiLU08sE;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;apid=1A6bcdf684-6eb9-11ea-82c9-1201d05c7be8;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323007;callback=window.headertag.AolHtb.adResponseCallbacks._qiLU08sE;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA

Request Chain 259

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cfp=1;rndc=1585155324;cmd=bid;cors=yes;v=2;misc=1585155323006;callback=window.headertag.AolHtb.adResponseCallbacks._JHF7sFtL;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;apid=1A6bcff542-6eb9-11ea-87e1-126145921f52;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323006;callback=window.headertag.AolHtb.adResponseCallbacks._JHF7sFtL;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA

Request Chain 260

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._rgbWB57p;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;apid=1A6bcf308a-6eb9-11ea-bba4-12c791b7f306;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._rgbWB57p;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA

249 HTTP transactions
20 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Redirect Chain

https://arstechnica.com/information-technology/2020/03/never-before-seen-at=
https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

44 KB
15 KB

114ms
113ms

Document
text/html

3.20.147.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.20.147.38 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-20-147-38.us-east-2.compute.amazonaws.com

Software

nginx/1.17.9 / PHP/7.3.16

Resource Hash

dfefbe3a90043a7d341cbcc2156afc74c658f9eb70e693c79da7ec66bb1e5d76

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: arstechnica.com
:scheme: https
:path: /information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

status: 200
date: Wed, 25 Mar 2020 16:55:13 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.17.9
x-powered-by: PHP/7.3.16
link: <https://arstechnica.com/wp-json/>; rel="https://api.w.org/"
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
content-encoding: gzip

Redirect headers

status: 301
date: Wed, 25 Mar 2020 16:55:13 GMT
content-type: text/html; charset=UTF-8
location: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
server: nginx/1.17.9
x-powered-by: PHP/7.3.16
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests

GET
H2 200 main-532e43a155.css
cdn.arstechnica.net/wp-content/themes/ars/assets/css/ 334 KB
69 KB 68ms
22ms Stylesheet
text/css 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 5ad2dd79dd70a3e9c03fcb2644b3dec3852424e0c5010a9054012304efe35b82

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
x-cf3: M
cf4ttl: 43200.000
x-cf1: 14961:fC.lon1:co:1525808045:cacheN.lon1-01:H
status: 200
content-length: 70509
x-cf-tsc: 1583790230
x-cf2: H
last-modified: Mon, 09 Mar 2020 21:20:33 GMT
server: CFS 0215
x-cff: B
etag: W/"5e66b321-53851"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 0
accept-ranges: bytes
x-cf-rand: 26.510
expires: Wed, 20 May 2020 16:55:14 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 44 KB
15 KB 57ms
45ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8fd89c4e7593e7e15a1ecdf7141192ba9751023d1fbfa77ba998df510306b4b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "466 / 312 of 1000 / last-modified: 1585081375"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 14788
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:14 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 87 KB
25 KB 163ms
83ms Script
application/javascript 99.86.0.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.0.120 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-0-120.fra6.r.cloudfront.net
Software: Server /
Resource Hash: ac2a58f9d55c4642121cfb6f7e213cbc882bbdd75ef171ca8a07ed982ef693ce

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Tue, 24 Mar 2020 22:00:54 GMT
content-encoding: gzip
server: Server
age: 68059
etag: 1dcfbf3986ee8b9c3abbc67eb808ab43
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
x-amz-cf-id: Qs5wkGUm0vWIacigB3DB5KMzW2y0THDx_HcJKe3EmEBVIzTtmYiwDQ==
via: 1.1 94faae20b0f122c4555025f52a2fd745.cloudfront.net (CloudFront)

GET
H/1.1 200
OK 183973-1558632223658.js Show response
js-sec.indexww.com/ht/p/ 131 KB
37 KB 793ms
698ms Script
text/javascript 95.101.185.51
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 00bd8c0d8620137ed2914b1958e62e894392f208c2f989e158565d9bb508e2fb

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 16:55:14 GMT
Content-Encoding: gzip
Last-Modified: Wed, 25 Mar 2020 16:35:17 GMT
Server: Apache
ETag: "76181c-20bd1-5a1b074125cc4"
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 37951
Expires: Wed, 25 Mar 2020 17:55:14 GMT

GET
H2 200 moatheader.js Show response
z.moatads.com/condenastprebidheader987326845656/ 187 KB
66 KB 123ms
38ms Script
application/x-javascript 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/condenastprebidheader987326845656/moatheader.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 0eb438ad4233f9cdadd2cf6e5e3544a29b1e693a03f45b0b9fa25e70f2675917

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
last-modified: Tue, 29 Oct 2019 23:07:10 GMT
server: AmazonS3
x-amz-request-id: C4EB885645F7EADB
etag: "36eff026ea983609efb74e7f83fac3f5"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=8741
accept-ranges: bytes
content-length: 67412
x-amz-id-2: 0OuSBOQTL5bWL5GbKshqc8LH0N1zUvVKyRv9aIh2fHkVjjuH49AGM6AVvGrpdrcS27mrdbb8wc4=

GET
H2 200 ars-technica.min.js Show response
cdn.arstechnica.net/cns/ 137 KB
45 KB 23ms
22ms Script
application/javascript 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.arstechnica.net/cns/ars-technica.min.js

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),

Reverse DNS

vip1.G-anycast1.cachefly.net

Software

CFS 0215 /

Resource Hash

cb332c513481e682f5a087a5be5f3956277cc4f940568a872ab87c14ad536443

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cf3: H
x-amz-request-id: 0F95B3749A7398F5
x-cf1: 14961:fC.lon1:co:1576089267:cacheN.lon1-01:H
status: 200
vary: Accept-Encoding
content-length: 44956
x-amz-id-2: ajkWxixt4A1iCbTA0ahKTIgmGyV8vIjqPP/LTsy/MBw1+D6H1gZR6N/NQD2Kdb/U8x/Xh1MNAak=
x-cf-tsc: 1581020466
cf4ttl: 43200.000
x-cf2: H
expires: Thu, 26 Mar 2020 16:55:14 GMT
last-modified: Thu, 30 Jan 2020 22:03:26 GMT
server: CFS 0215
x-timer: S1581010250.410338,VS0,VE61
x-cff: B
etag: "06d02814d9b071f29951bf3adbc5eca2"
x-served-by: cache-bwi5057-BWI
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=86400
cf4age: 10216
x-amz-version-id: ztCM6GSJ.kG8cN67f93sCUGypNpsY0jZ
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
accept-ranges: bytes
x-cf-rand: 82.981
x-cache-hits: 0

GET
H2 200 ars-bcfee6c82a.ads.us.js Show response
cdn.arstechnica.net/wp-content/themes/ars/assets/js/ 4 KB
2 KB 34ms
34ms Script
application/javascript 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/js/ars-bcfee6c82a.ads.us.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 032027ea92b8b014594b64b514f922a12029c27c3dc27e5c11b09eabfaf810c3

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
x-cf3: M
cf4ttl: 43200.000
x-cf1: 14961:fC.lon1:co:1581035284:cacheN.lon1-01:H
status: 200
content-length: 1415
x-cf-tsc: 1581035291
x-cf2: H
last-modified: Thu, 06 Feb 2020 21:26:43 GMT
server: CFS 0215
x-cff: B
etag: W/"5e3c8493-e66"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 0
accept-ranges: bytes
x-cf-rand: 86.720
expires: Wed, 20 May 2020 16:55:14 GMT

GET
H2 200 oil-eqipment.png
cdn.arstechnica.net/wp-content/uploads/2012/08/ 314 KB
315 KB 57ms
55ms Image
image/png 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.arstechnica.net/wp-content/uploads/2012/08/oil-eqipment.png
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 7c7e293df2bbe2936e847fa708aebca6f9818ea17e9584bc46459576a3a80648

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
x-cf3: H
x-amz-request-id: 0BFA80B41EAADB62
x-cf1: 14961:fC.lon1:co:1525808045:cacheN.lon1-01:H
status: 200
content-length: 321903
x-amz-id-2: ++HAENzWPshvAK8IxnbqUgxMtXVg+SNJ3Se06x5HbcCUBfj5BEjLEyz9BN3jRzi16v7UqHr72wc=
x-cf-tsc: 1585133250
cf4ttl: 43200.000
x-cf2: H
last-modified: Fri, 20 Dec 2019 22:37:00 GMT
server: CFS 0215
x-cff: B
etag: "a8c5d154d02cb9b17a7de218122e75fb"
x-amz-version-id: null
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 23
accept-ranges: bytes
content-type: image/png
x-cf-rand: 88.989
expires: Wed, 20 May 2020 16:55:14 GMT

GET
H2 200 milum-targets-640x286.png
cdn.arstechnica.net/wp-content/uploads/2020/03/ 67 KB
68 KB 82ms
81ms Image
image/png 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.arstechnica.net/wp-content/uploads/2020/03/milum-targets-640x286.png
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 9a4ba60ec6263a87283ed290b98ab1b4447973d91fe47404af49ee70c4165ff3

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
x-cf3: M
x-amz-request-id: 91AB854A1EC6782D
x-cf1: 14961:fC.lon1:co:1525808045:cacheN.lon1-01:H
status: 200
content-length: 68648
x-amz-id-2: 83UWIgT5DAxyngn77xA8C6XhFt/zf9knXdedUTEahiO5uTEXiSUBf+bLWBJ8rBDJLr5UzJVGbaM=
x-cf-tsc: 1585133251
cf4ttl: 43200.000
x-cf2: H
last-modified: Wed, 25 Mar 2020 01:04:52 GMT
server: CFS 0215
x-cff: B
etag: "88633eb5200f24d7e85f2d649b29187b"
x-amz-version-id: null
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 0
accept-ranges: bytes
content-type: image/png
x-cf-rand: 9.424
expires: Wed, 20 May 2020 16:55:14 GMT

GET
H2 200 main-e8e6d92966.js Show response
cdn.arstechnica.net/wp-content/themes/ars/assets/js/ 661 KB
215 KB 23ms
21ms Script
application/javascript 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/js/main-e8e6d92966.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 05a2975ca40e7d714018e9704c2d82812a8735f335f78a5f8d274203bc2976da

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fC.lon1:co:1525808045:cacheN.lon1-01:H
status: 200
content-length: 219284
x-cf-tsc: 1585088069
x-cf2: H
last-modified: Tue, 24 Mar 2020 19:31:06 GMT
server: CFS 0215
x-cff: B
etag: W/"5e7a5ffa-a552c"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 9
accept-ranges: bytes
x-cf-rand: 58.372
expires: Wed, 20 May 2020 16:55:14 GMT

GET
H/1.1 200
OK widget.min.js Show response
embed.actionbutton.co/widget/ 55 KB
18 KB 203ms
38ms Script
application/javascript 143.204.202.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://embed.actionbutton.co/widget/widget.min.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.115 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-115.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 015045182758a421636084e2a2e43027e6ba1dd7005a2ec231b08d63c72d0fd7

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 14:32:29 GMT
Content-Encoding: gzip
Last-Modified: Wed, 25 Mar 2020 14:32:21 GMT
Server: AmazonS3
Age: 8566
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 c5c25772c7f14e267596e0f8ce51d9bc.cloudfront.net (CloudFront)
Cache-Control: no-cache
Transfer-Encoding: chunked
X-Amz-Cf-Pop: FRA53-C1
Connection: keep-alive
X-Amz-Cf-Id: K9nNaAwkNpBJXv42VtlRdfXzMhuSlt_9zh3k3VO84CwPVrKj6z_lsg==

GET
H/1.1 200
OK arstechnica.js Show response
player.cnevids.com/interlude/ 109 KB
28 KB 214ms
57ms Script
text/javascript 13.32.2.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://player.cnevids.com/interlude/arstechnica.js

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.32.2.59 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-2-59.muc51.r.cloudfront.net

Software

nginx/1.14.1 /

Resource Hash

02a9db289d960e3196e2269632ee772bbcb51333e9ab3503105ae7f3b1665062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 16:54:21 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Age: 53
X-Cache: Hit from cloudfront
Status: 200 OK
Connection: keep-alive
Content-Length: 27527
X-XSS-Protection: 1; mode=block
X-Request-Id: fce5e476-2080-4640-880c-ab46e7ac3a31
X-Runtime: 0.010926
X-Backend-Node: 10.110.29.24
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx/1.14.1
ETag: W/"8accb88ed7b1defc732713c62e3516c0"
X-Download-Options: noopen
Vary: Origin,Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Via: 1.1 5ff5eb6edcbc169906f2124a1927ecc9.cloudfront.net (CloudFront)
Cache-Control: max-age=0, private, must-revalidate
X-Amz-Cf-Pop: MUC51
X-Amz-Cf-Id: u7TvOnxlPVmATQ5mR-M6SqLUBQROB6HiUmtYe5kiNoDttcGqKaAM9Q==

GET
H2 200 conde-asa-polar-master.js Show response
cdn.mediavoice.com/nativeads/script/condenastcorporate/ 5 KB
2 KB 48ms
20ms Script
text/javascript 2606:4700::6813:da83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mediavoice.com/nativeads/script/condenastcorporate/conde-asa-polar-master.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:da83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 030e91b7512dbb40e9b9057f20bcf54c296a7f28c04bbcde0f2d2706dd2a3a06

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 2542
status: 200
content-type: text/javascript
content-length: 2018
via: 1.1 varnish
server: cloudflare
cache-control: max-age=21600
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 2028053757 2027438945
x-country: DE
cf-ipcountry: DE
accept-ranges: bytes
cf-ray: 579a28896ea21f39-FRA

GET
H2 200 100098X1555750.skimlinks.js Show response
s.skimresources.com/js/ 41 KB
16 KB 87ms
31ms Script
application/octet-stream 151.139.128.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://s.skimresources.com/js/100098X1555750.skimlinks.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 55953987d8104311838ce0414adb751e86b32a69a9cbb441381ef67f1c4bbbb2

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
last-modified: Thu, 12 Mar 2020 11:43:35 GMT
server: AmazonS3
x-amz-request-id: 59FE00C2C6A21FF2
etag: "d061a130936c12bec6f7b673c7e2b811"
x-hw: 1585155314.cds041.lo4.hn,1585155314.cds222.lo4.c
content-type: application/octet-stream
status: 200
cache-control: max-age=3600
accept-ranges: bytes
content-length: 15820
x-amz-id-2: r/Sh1EARyv32pldz5487Bo/mY6oJowfAmH7kWT8gMtKO26hqf2wwAEN1nvAfvusXslNDKkTK5X0=

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 299 KB
73 KB 30ms
16ms Script
application/javascript 2a00:1450:4001:800::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NLXNPCQ

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

72ff898f6d799030f097fb900d4a78a7ab005254a02e8f76f0455c1cfcc43497

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 73732
x-xss-protection: 0
last-modified: Wed, 25 Mar 2020 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 25 Mar 2020 16:55:14 GMT

GET
H2 200 ads.js Show response
arstechnica.com/hotzones/src/ 0
502 B 113ms
112ms XHR
application/javascript 3.20.147.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arstechnica.com/hotzones/src/ads.js

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/ars-technica.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.20.147.38 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-20-147-38.us-east-2.compute.amazonaws.com

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
x-content-type-options: nosniff
last-modified: Tue, 24 Mar 2020 19:28:22 GMT
server: nginx/1.17.9
etag: "5e7a5f56-0"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
accept-ranges: bytes
content-length: 0
x-xss-protection: 1; mode=block

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 78c8c364b438f0be81f1c51627902fda95b7aebdd2c04aee28c2f72cd4390207

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 357 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f95836cdd8c1af1d8261e8e198a4c1dd306e2b50ddc389fe820b56212a9cb17d

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 economica-bold-otf-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 25 KB
25 KB 150ms
99ms Font
font/woff2 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/economica-bold-otf-webfont.woff2
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 5315cf641e62ac7de4a82e6003cc1bd1ff09218400d8ff5286c951e25aee966b

Request headers

Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
Origin: https://arstechnica.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fD.lon1:co:1525808045:cacheN.lon1-01:H
status: 200
content-length: 25592
x-cf-tsc: 1584928121
x-cf2: H
last-modified: Thu, 19 Mar 2020 01:03:34 GMT
server: CFS 0215
x-cff: B
etag: "5e72c4e6-63f8"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 15943
accept-ranges: bytes
x-cf-rand: 81.861
expires: Wed, 20 May 2020 16:55:14 GMT

GET
H2 200 economica-regular-otf-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 24 KB
24 KB 126ms
75ms Font
font/woff2 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/economica-regular-otf-webfont.woff2
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: c14a030b0b5ef06f710d9bbff164662d4b43c037e62f254aa6280504013caa34

Request headers

Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
Origin: https://arstechnica.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fD.lon1:co:1525808045:cacheN.lon1-01:H
status: 200
content-length: 24264
x-cf-tsc: 1584928121
x-cf2: H
last-modified: Thu, 19 Mar 2020 01:03:34 GMT
server: CFS 0215
x-cff: B
etag: "5e72c4e6-5ec8"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 15943
accept-ranges: bytes
x-cf-rand: 47.499
expires: Wed, 20 May 2020 16:55:14 GMT

GET
DATA 200
OK truncated
/ 279 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5ecbfb541946a9a9437190a21d98e1c7ab7d863837d7d038a9a1e053c649c8ba

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 400 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6f261533d4b74ae931965cf3609bf47bb55001e39eb7029502d96cec73c4749a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 700 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5ab499494548829e507e9b6cd57247a6cd565e7f1bc6eb55e3da445af76f1f0c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 715 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 49282a74c6ced31e99f808232188ade8d82652004df4d664dcdb98c32563dd39

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 841 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 039f13cdf684666dd973e2385f773385adb074039e8a832ec48e1ae35fb20c15

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 Dang.jpg
cdn.arstechnica.net/wp-content/uploads/2018/10/ 90 KB
91 KB 85ms
84ms Image
image/jpeg 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.arstechnica.net/wp-content/uploads/2018/10/Dang.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),

Reverse DNS

vip1.G-anycast1.cachefly.net

Software

CFS 0215 /

Resource Hash

d6f350f62fc19bfd7091e3841649be70e806fb94c00a1f777dbed2ea8ecc9daa

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
x-content-type-options: nosniff
x-cf3: H
x-amz-request-id: 20ACF616C13FB8B0
x-cf1: 14961:fC.lon1:co:1525808045:cacheN.lon1-01:H
status: 200
content-length: 92486
x-amz-id-2: q4/HU2R+xAJE+/gnljuW/yhn7G2/672JGhjsyncHFlbQPitRgzZyGDMqG/bfWqq48YWpiOfFCb0=
x-cf-tsc: 1585021716
cf4ttl: 43200.000
x-cf2: H
last-modified: Sat, 21 Dec 2019 01:48:48 GMT
server: CFS 0215
x-cff: B
etag: "03e5fec9e7ca5f8064d945bd791bd4c3"
x-frame-options: SAMEORIGIN
x-amz-version-id: null
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=4838400
cf4age: 25358
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
accept-ranges: bytes
content-type: image/jpeg
x-cf-rand: 2.270
expires: Wed, 20 May 2020 16:55:14 GMT

GET
H2 200 channel-ars-be7bb52ba9.png
cdn.arstechnica.net/wp-content/themes/ars/assets/img/ 5 KB
5 KB 84ms
83ms Image
image/png 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/img/channel-ars-be7bb52ba9.png
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 08ed3bf6e73a999bafb422b878fb05b87269b00a65230c9457ce75aee10b873e

Request headers

Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fC.lon1:co:1525808045:cacheN.lon1-01:H
status: 200
content-length: 4809
x-cf-tsc: 1583639608
x-cf2: H
last-modified: Thu, 05 Mar 2020 20:33:32 GMT
server: CFS 0215
x-cff: B
etag: "5e61621c-12c9"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 23217
accept-ranges: bytes
x-cf-rand: 68.569
expires: Wed, 20 May 2020 16:55:14 GMT

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c7f2558d7005dc61e343b6abb61a63da8ace760a0fdd45cb0cc124b0de5b4c2f

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 18 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 62c7d2da9a5942053f17c9756e53b7cda414541619bd35c2b1441cd88c77f235

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4ec4b6769730ca98db1f40b152c52bd5bec01f61f559fb92709c307750388ac8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 opensans-regular-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 18 KB
19 KB 125ms
95ms Font
font/woff2 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/opensans-regular-webfont.woff2
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: caa3854f28740fa98125ded826446ee4456379e8ad7c4ff46643347d1901506a

Request headers

Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
Origin: https://arstechnica.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fD.lon1:co:1525808045:cacheN.lon1-01:H
status: 200
content-length: 18824
x-cf-tsc: 1584928121
x-cf2: H
last-modified: Thu, 19 Mar 2020 01:03:34 GMT
server: CFS 0215
x-cff: B
etag: "5e72c4e6-4988"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 15943
accept-ranges: bytes
x-cf-rand: 92.304
expires: Wed, 20 May 2020 16:55:14 GMT

GET
H2 200 bitter-italic-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 24 KB
24 KB 126ms
95ms Font
font/woff2 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/bitter-italic-webfont.woff2
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 1193e934b76ed372f47e23f78f8a13e99d9588e564aff866e8f700e7a0650a83

Request headers

Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
Origin: https://arstechnica.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fD.lon1:co:1525808045:cacheN.lon1-01:H
status: 200
content-length: 24212
x-cf-tsc: 1584928121
x-cf2: H
last-modified: Thu, 19 Mar 2020 01:03:34 GMT
server: CFS 0215
x-cff: B
etag: "5e72c4e6-5e94"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 15943
accept-ranges: bytes
x-cf-rand: 11.348
expires: Wed, 20 May 2020 16:55:14 GMT

GET
H2 200 bitter-regular-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 22 KB
23 KB 93ms
63ms Font
font/woff2 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/bitter-regular-webfont.woff2
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 0186840386391fa2c0750ff7450a78e066498ba3274546a6fcf0fa9c55cd457c

Request headers

Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
Origin: https://arstechnica.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fD.lon1:co:1525808045:cacheN.lon1-01:H
status: 200
content-length: 22872
x-cf-tsc: 1584928121
x-cf2: H
last-modified: Thu, 19 Mar 2020 01:03:34 GMT
server: CFS 0215
x-cff: B
etag: "5e72c4e6-5958"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 15943
accept-ranges: bytes
x-cf-rand: 95.852
expires: Wed, 20 May 2020 16:55:14 GMT

GET
H2 200 opensans-semibold-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 19 KB
19 KB 83ms
53ms Font
font/woff2 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/opensans-semibold-webfont.woff2
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 1f9cd4a445ba85172da6090dd7b95edf55fd9e81ddb193e0b78093c1afa84378

Request headers

Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
Origin: https://arstechnica.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fD.lon1:co:1525808045:cacheN.lon1-01:H
status: 200
content-length: 18972
x-cf-tsc: 1584928121
x-cf2: H
last-modified: Thu, 19 Mar 2020 01:03:34 GMT
server: CFS 0215
x-cff: B
etag: "5e72c4e6-4a1c"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 14875
accept-ranges: bytes
x-cf-rand: 13.415
expires: Wed, 20 May 2020 16:55:14 GMT

GET
H2 200 opensans-semibolditalic-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 20 KB
21 KB 134ms
105ms Font
font/woff2 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/opensans-semibolditalic-webfont.woff2
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 59201950b83489808587827b4050ffe0597992825daa88c227476cdbbf8ca282

Request headers

Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
Origin: https://arstechnica.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fD.lon1:co:1525808045:cacheN.lon1-01:H
status: 200
content-length: 20872
x-cf-tsc: 1584928121
x-cf2: H
last-modified: Thu, 19 Mar 2020 01:03:34 GMT
server: CFS 0215
x-cff: B
etag: "5e72c4e6-5188"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 5097
accept-ranges: bytes
x-cf-rand: 21.452
expires: Wed, 20 May 2020 16:55:14 GMT

GET
H2 200 opensans-bold-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 19 KB
19 KB 61ms
32ms Font
font/woff2 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/opensans-bold-webfont.woff2
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 86096831a70c72ac0c08f5e65ae92d98330d9fd2b7511dde65ff50b8a16bfd9a

Request headers

Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
Origin: https://arstechnica.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fD.lon1:co:1525808045:cacheN.lon1-01:H
status: 200
content-length: 19516
x-cf-tsc: 1584928121
x-cf2: H
last-modified: Thu, 19 Mar 2020 01:03:34 GMT
server: CFS 0215
x-cff: B
etag: "5e72c4e6-4c3c"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 30980
accept-ranges: bytes
x-cf-rand: 37.428
expires: Wed, 20 May 2020 16:55:14 GMT

GET
H2 200 bitter-bold-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 22 KB
22 KB 108ms
83ms Font
font/woff2 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/bitter-bold-webfont.woff2
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 807271433f80bb33654a84ec904035be3d2b34e505a051e3469a47fe39ccb752

Request headers

Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-532e43a155.css
Origin: https://arstechnica.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fD.lon1:co:1525808045:cacheN.lon1-01:H
status: 200
content-length: 22104
x-cf-tsc: 1584928121
x-cf2: H
last-modified: Thu, 19 Mar 2020 01:03:34 GMT
server: CFS 0215
x-cff: B
etag: "5e72c4e6-5658"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 15721
accept-ranges: bytes
x-cf-rand: 54.030
expires: Wed, 20 May 2020 16:55:14 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
839 B 42ms
17ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=arstechnica.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
839 B 43ms
17ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=arstechnica.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2020032401.js Show response
securepubads.g.doubleclick.net/gpt/ 168 KB
62 KB 138ms
67ms Script
text/javascript 172.217.22.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032401.js?21065778

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s18-in-f98.1e100.net

Software

sffe /

Resource Hash

123d4b411f97e36f72e2f44be0b18944489e908ff159f59ab8aba984c69517fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 24 Mar 2020 13:43:01 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 62966
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:14 GMT

GET
H/1.1 200
OK outbrain.js Show response
widgets.outbrain.com/ 127 KB
43 KB 583ms
502ms Script
application/x-javascript 95.101.185.159
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/outbrain.js?_=1585155314242
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/js/main-e8e6d92966.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.159 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-159.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4db16433a1f26ff7f90e3525190e9debe2ac5545309ab47e5a06133e06f9f128

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 16:55:14 GMT
Content-Encoding: gzip
Last-Modified: Wed, 25 Mar 2020 08:30:47 GMT
ETag: W/"1fbb3-KoHnezOYyT0SUusJEB8aDSXQE/s"
Vary: Accept-Encoding
Edge-Cache-Tag: widget-cheetah
Content-Type: application/x-javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=14400
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET,POST
Connection: keep-alive, Transfer-Encoding
Access-Control-Allow-Credentials: false
Timing-Allow-Origin: *

GET
H/1.1 200
OK video_groups Show response
api.cnevids.com/v1/ 4 KB
1 KB 403ms
100ms XHR
application/json 18.211.127.174
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.cnevids.com/v1/video_groups?filters={%22channel_key%22:%22arstechnica%22}&pagesize=20&endpoint=oo.arstechnica

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/js/main-e8e6d92966.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.211.127.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-211-127-174.compute-1.amazonaws.com

Software

nginx/1.14.1 /

Resource Hash

5e5adf6f3067a94181543155e349c4b4059feca0670da7be23f539f9c08ea34f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/*
Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 25 Mar 2020 16:55:14 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Status: 200 OK
Access-Control-Max-Age: 1728000
Connection: keep-alive
Content-Length: 663
X-XSS-Protection: 1; mode=block
X-Request-Id: ef4e76ba-b983-4539-afa8-d08d76bf8b7d
X-Runtime: 0.001875
X-Backend-Node: 10.110.126.151
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx/1.14.1
X-Frame-Options: SAMEORIGIN
ETag: W/"443d60a39c813369e67acc2ef9119235"
X-Download-Options: noopen
Vary: Accept-Encoding, Origin
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers
Cache-Control: max-age=0, private, must-revalidate

GET
H/1.1 200
OK p.js Show response
d1z2jf7jlzjs58.cloudfront.net/ 6 KB
3 KB 124ms
42ms Script
application/x-javascript 143.204.208.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1z2jf7jlzjs58.cloudfront.net/p.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.208.228 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-208-228.fra53.r.cloudfront.net
Software: nginx /
Resource Hash: 2f17ab3ac118eeddb8ac29b08b41a35c0a5f6cdb4a94097c69a36569c5e4d87e

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 00:26:01 GMT
Content-Encoding: gzip
Age: 59354
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Pragma: public
Last-Modified: Mon, 16 Mar 2020 20:58:13 GMT
Server: nginx
ETag: W/"5e6fe865-19d2"
Content-Type: application/x-javascript
Via: 1.1 1f5757b46371746e677236d4fc67d364.cloudfront.net (CloudFront)
Cache-Control: max-age=86400, public
X-Amz-Cf-Pop: FRA53-C1
X-Amz-Cf-Id: y13Dl-pYTNsYaiwBRDtKCDhOyTW8mzNbIAqSu9CXCwJz3vkKKOHqrg==
Expires: Wed, 25 Mar 2020 00:25:56 GMT

GET
H/1.1 200
OK conde-nast Show response
segment-data.zqtk.net/ 757 B
568 B 136ms
33ms Script
application/javascript 52.19.1.241
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://segment-data.zqtk.net/conde-nast?url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.19.1.241 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-19-1-241.eu-west-1.compute.amazonaws.com
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: a972b7850e0da6563764f0a628cf86e0fcb2a7984abaca122b85e2726d375a7f

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 16:55:14 GMT
Content-Encoding: gzip
Last-Modified: Wed, 25 Mar 2020 10:46:57 GMT
Server: nginx/1.10.3 (Ubuntu)
Content-Type: application/javascript; charset=UTF-8
Connection: keep-alive
Content-Length: 273
Expires: Fri, 27 Mar 2020 10:46:57 GMT

GET
H/1.1 200
OK ixmatch.html
js-sec.indexww.com/um/ Frame C915 0
0 116ms
38ms Document
text/html 95.101.185.51
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Response headers

Server: Apache
Last-Modified: Mon, 19 Jun 2017 19:18:19 GMT
ETag: "74087b-112-55254ff6699bb"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 211
Date: Wed, 25 Mar 2020 16:55:14 GMT
Connection: keep-alive

GET
H/1.1 200
OK ars-technica.config.js Show response
pixel.condenastdigital.com/config/v2/production/ 6 KB
2 KB 134ms
41ms Script
application/javascript 151.101.12.239
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.condenastdigital.com/config/v2/production/ars-technica.config.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.239 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 50ef3043544193fed57957cde3087cb24a4af2a605c37a6ddc4c11105ac7bbe0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 16:55:14 GMT
Content-Encoding: gzip
Age: 138826
Via: 1.1 varnish, 1.1 varnish
X-Cache: MISS, HIT
X-Cache-Hits: 0, 515
Connection: keep-alive
Content-Length: 1151
x-amz-id-2: ITo7KklX/OsJa28NOAepmGqGmZ5+ObSbbJ+qFh4ShK18ZAifo7V+hoXPpwsNJxUCVfRqYgi/z6o=
X-Served-By: cache-iad2135-IAD, cache-fra19120-FRA
Last-Modified: Wed, 05 Feb 2020 18:01:17 GMT
Server: AmazonS3
X-Timer: S1585155314.412096,VS0,VE0
ETag: "b2d7ed50cf3dbf4d93df75f579b3a6b4"
Vary: Accept-Encoding
x-amz-request-id: AD6C37A989D0117F
Access-Control-Allow-Origin: *
Cache-Control: no-cache, public, max-age=604800
Accept-Ranges: bytes
Content-Type: application/javascript
Expires: Tue, 25 Feb 2020 07:45:38 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 22ms
9ms Script
text/javascript 2a00:1450:4001:817::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NLXNPCQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 999
date: Wed, 25 Mar 2020 16:38:35 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 18174
expires: Wed, 25 Mar 2020 18:38:35 GMT

GET
H2 200 plugin.js Show response
plugin.mediavoice.com/ 343 KB
127 KB 22ms
14ms Script
application/javascript 2606:4700::6813:da83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://plugin.mediavoice.com/plugin.js
Requested by: Host: cdn.mediavoice.com
URL: https://cdn.mediavoice.com/nativeads/script/condenastcorporate/conde-asa-polar-master.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:da83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 17cfd03c7324bff29a75eed9529fb31764b922489e32030d4acabea1cc5a216f

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 8836
cf-ray: 579a288abab01f39-FRA
status: 200
content-length: 129661
via: 1.1 varnish
x-varnish: 2006918692 2006918688
last-modified: Mon, 23 Mar 2020 14:27:53 GMT
server: cloudflare
etag: W/"5e78c769-55b9e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=43200
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Thu, 26 Mar 2020 02:27:58 GMT

GET
H2 200 condenastcorporate Show response
polarcdn-terrax.com/nativeads/v1.4.0/json/hostname/arstechnica.com/organization/ 181 B
594 B 72ms
47ms XHR
application/json 2606:4700::6811:4032
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://polarcdn-terrax.com/nativeads/v1.4.0/json/hostname/arstechnica.com/organization/condenastcorporate
Requested by: Host: cdn.mediavoice.com
URL: https://cdn.mediavoice.com/nativeads/script/condenastcorporate/conde-asa-polar-master.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:4032 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6bd131d59efb6aa6a2d98ce4af498a811c84f74148129e140ff5a76904ca9f74

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
server: cloudflare
status: 200
etag: W/"4ed41fc03a3c3b67ac78af86ee19d7f1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Country, CF-Ray
cache-control: max-age=3600
x-country: DE
cf-ray: 579a288ac86d9724-FRA

POST
H2

307

/ Show response
r.skimresources.com/api/
Redirect Chain

https://r.skimresources.com/api/
https://r.skimresources.com/api/?xguid=01E499X4R5ZBGYRSSYS20HAV2V&persistence=1&checksum=be84f6f33491e8b82555da6ac292cd828ed0777e5f657bc985c3b03e1068a7f6

0
-1 B

85ms
30ms

XHR
text/html

35.190.59.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r.skimresources.com/api/?xguid=01E499X4R5ZBGYRSSYS20HAV2V&persistence=1&checksum=be84f6f33491e8b82555da6ac292cd828ed0777e5f657bc985c3b03e1068a7f6

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.190.59.101 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

101.59.190.35.bc.googleusercontent.com

Software

openresty/1.11.2.5 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
via: 1.1 google
server: openresty/1.11.2.5
access-control-allow-origin: https://arstechnica.com
location: https://r.skimresources.com/api/?xguid=01E499X4R5ZBGYRSSYS20HAV2V&persistence=1&checksum=be84f6f33491e8b82555da6ac292cd828ed0777e5f657bc985c3b03e1068a7f6
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status: 307
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
content-type: text/html
alt-svc: clear
content-length: 193

Redirect headers

date: Wed, 25 Mar 2020 16:55:14 GMT
via: 1.1 google
server: openresty/1.11.2.5
status: 307
location: https://r.skimresources.com/api/?xguid=01E499X4R5ZBGYRSSYS20HAV2V&persistence=1&checksum=be84f6f33491e8b82555da6ac292cd828ed0777e5f657bc985c3b03e1068a7f6
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://arstechnica.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
content-type: text/html
alt-svc: clear
content-length: 193

GET
H2 206 robots.txt
t.skimresources.com/api/v2/ Frame FD81 0
105 B 96ms
46ms Image
text/plain 35.201.67.47
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.skimresources.com/api/v2/robots.txt?__skimjs_preflight__please_ignore__=true&rnd=0.3041695240511262
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.201.67.47 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 47.67.201.35.bc.googleusercontent.com
Software: Python/3.7 aiohttp/3.5.4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

status: 206
date: Wed, 25 Mar 2020 16:55:14 GMT
via: 1.1 google
server: Python/3.7 aiohttp/3.5.4
alt-svc: clear
content-length: 0
content-type: text/plain charset=UTF-8

GET
H2 200 px.gif
p.skimresources.com/ 43 B
473 B 33ms
23ms Image
image/gif 151.139.128.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=1&rn=2.3574299615462677
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: UploadServer /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
status: 200
x-guploader-uploadid: AEnB2UrGcZdEYyz3dCXVCFeT1HXpg40ZpkOon1fX0XDxSnBVuKIThhY_mFRgpCXaL-QhZv-FomNUz2YGPVooYoVkYmbIalPaYA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 4
x-goog-stored-content-encoding: identity
content-length: 43
x-hw: 1585155314.cds041.lo4.hn,1585155314.cds208.lo4.c
last-modified: Tue, 23 Oct 2018 13:19:28 GMT
server: UploadServer
etag: "f837aa60b6fe83458f790db60d529fc9"
x-goog-hash: crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
x-goog-generation: 1540300768038458
cache-control: public, max-age=7200
x-goog-stored-content-length: 43
accept-ranges: bytes
content-type: image/gif

GET
H2 200 px.gif
p.skimresources.com/ 43 B
107 B 38ms
28ms Image
image/gif 151.139.128.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=2&rn=2.3574299615462677
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: UploadServer /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
status: 200
x-guploader-uploadid: AEnB2UrGcZdEYyz3dCXVCFeT1HXpg40ZpkOon1fX0XDxSnBVuKIThhY_mFRgpCXaL-QhZv-FomNUz2YGPVooYoVkYmbIalPaYA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 4
x-goog-stored-content-encoding: identity
content-length: 43
x-hw: 1585155314.cds041.lo4.hn,1585155314.cds208.lo4.c
last-modified: Tue, 23 Oct 2018 13:19:28 GMT
server: UploadServer
etag: "f837aa60b6fe83458f790db60d529fc9"
x-goog-hash: crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
x-goog-generation: 1540300768038458
cache-control: public, max-age=7200
x-goog-stored-content-length: 43
accept-ranges: bytes
content-type: image/gif

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 114ms
39ms XHR
application/javascript 99.86.0.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.0.120 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-0-120.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 01:46:20 GMT
content-encoding: gzip
vary: Origin
age: 54535
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Thu, 05 Mar 2020 08:28:46 GMT
server: AmazonS3
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 f0a97a8c56cd2bb79a1739863489ed4c.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: YbNv8flKQHoIDnhf7E-dsXG74JLzKmFaLkl2uapJZMKa_YAc5bLSCg==

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 11 KB
4 KB 92ms
22ms Script
application/javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NLXNPCQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lha/8C8F) /
Resource Hash: 8e00ebebe053ff93e139bab1a80ced2517b33572ab374ae641e0e1cfed58d8e0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
content-md5: N1nkxqP8FRR4U7sOR6dsSg==
age: 186
x-cache: HIT
status: 200
content-length: 3742
x-ms-lease-status: unlocked
last-modified: Wed, 18 Mar 2020 20:41:16 GMT
server: ECAcc (lha/8C8F)
etag: 0x8D7CB7CB4C4B02D
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: c21ccfae-901e-0071-3cc5-02aadf000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Wed, 25 Mar 2020 20:55:14 GMT

GET
H2 200 yi.js Show response
mb.moatads.com/ 1 KB
2 KB 176ms
99ms Script
text/html 52.213.78.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mb.moatads.com/yi.js?ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjhBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&confidence=2&pcode=condenastprebidheader987326845656&callback=MoatNadoAllJsonpRequest_58823006
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/condenastprebidheader987326845656/moatheader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.78.12 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-78-12.eu-west-1.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: dbc8fb765b93c91460eb006d8c4a1f3332c78fdf0da2a04e357ecc2b0ffedb12

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
server: TornadoServer/4.5.3
etag: "4fa81acd89289b48232cec90981a4c8e95f8ccf2"
content-type: text/html; charset=UTF-8
status: 200
cache-control: max-age=900
timing-allow-origin: *
content-length: 1514

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 41ms
35ms Image
image/gif 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&t=1585155314422&de=368100489506&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=29bb202-clean&iw=81ef8f7&zMoatRendered=0&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=0&zMoatPageDataTargetingSet=0&zMoatSafetyTargetingSet=0&zMoatEmptySlot=0&zMoatNadoDataLoadTime=Not%20Loaded&zMoatAllDataLoadTime=Not%20Loaded&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations&ac=1&bq=11&f=0&na=998497479&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:14 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 25 Mar 2020 16:55:14 GMT

POST
H2 200 / Show response
r.skimresources.com/api/ 152 B
494 B 31ms
31ms XHR
application/json 35.190.59.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r.skimresources.com/api/?xguid=01E499X4R5ZBGYRSSYS20HAV2V&persistence=1&checksum=be84f6f33491e8b82555da6ac292cd828ed0777e5f657bc985c3b03e1068a7f6

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.190.59.101 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

101.59.190.35.bc.googleusercontent.com

Software

openresty/1.11.2.5 /

Resource Hash

8252f276dd50d6f69c8aed7feb6be52863cf6cfc2348b9ab89814c713e4b556d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: openresty/1.11.2.5
status: 200
vary: Accept-Encoding
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://arstechnica.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
content-type: application/json
alt-svc: clear
via: 1.1 google

GET
H2 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
1013 B 6ms
6ms Script
text/javascript 2a00:1450:4001:817::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:14:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 2447
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=3600
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 859
x-xss-protection: 0
expires: Wed, 25 Mar 2020 17:14:27 GMT

POST
H2 200 publisher:getClientId Show response
ampcid.google.com/v1/ 74 B
549 B 31ms
15ms XHR
application/json 2a00:1450:4001:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ampcid.google.com/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
server: ESF
status: 200
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
vary: Origin, X-Origin, Referer
content-length: 94
x-xss-protection: 0

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 401ms
97ms Image
image/gif 52.202.152.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&app=playerservice&cCh=videos%2Fshow&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pID=&sID=&uId=&xid=&_ts=2020-03-25T16%3A55%3A14.513Z&_c=error&_t=Interlude%20Insertion%20Error&dim1=%7B%22interludeFailure%22%3A%22unsupported%20template%22%2C%22pageTemplate%22%3A%22article%7Creport%22%2C%22url%22%3A%22information-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%22%7D&dim3=Availability%3A%20unsupported%20template
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.202.152.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-202-152-193.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 16:55:14 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

POST
H2 200 publisher:getClientId Show response
ampcid.google.de/v1/ 3 B
478 B 39ms
18ms XHR
application/json 2a00:1450:4001:81b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ampcid.google.de/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
server: ESF
status: 200
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
vary: Origin, X-Origin, Referer
content-length: 23
x-xss-protection: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 418 B
388 B 118ms
117ms XHR
text/plain 172.217.22.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=909767448522644&correlator=877859042265284&output=ldjh&impl=fifs&adsid=NT&eid=21065778%2C21062833%2C21065559&vrg=2020032401&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200325&iu_parts=3379%2Cconde.ars%2Cinterstitial%2Cinformation-technology%2Carticle%2C1&enc_prev_ius=0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=1x1&ists=1&prev_scp=pos%3Dinterstitial%26ctx_slot_type%3Dout_of_page%26ctx_slot_rn%3D0%26pos_instance%3D1%26ctx_slot_instance%3D0%26ctx_slot_name%3Dout_of_page_0&eri=1&cust_params=amznbid%3D0%26amznp%3D0%26m_data%3Dwaiting%26m_safety%3Dwaiting%26m_categories%3Dwaiting%26m_mv%3Dwaiting%26m_gv%3Dwaiting%26env_device_type%3Ddesktop%26ctx_template%3Darticle%26ctx_page_channel%3Dinformation-technology%26env_server%3Dproduction%26ctx_cns_version%3D6.32.6%26ctx_page_slug%3Dnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%26cnt_tags%3Dhacking%252Cmalware%252Cmiddle-east%26cnt_platform%3Dwordpress%26cnt_copilotid%3D%26vnd_4d_cached%3D0%26vnd_4d_ctx_sg%3D%26vnd_4d_ctx_topics%3D%26vnd_4d_ctx_entities%3D%26vnd_4d_ctx_keywords%3D%26vnd_4d_usr_topics%3D&cookie_enabled=1&bc=31&abxe=1&lmt=1585155314&dt=1585155314585&dlt=1585155313954&idt=564&frm=20&biw=1585&bih=1200&oid=3&adxs=0&adys=0&adks=2746652139&ucis=1&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&dssz=35&icsg=137482993664&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x1&msz=1585x1&ga_vid=505617916.1585155315&ga_sid=1585155315&ga_hid=1860456522&fws=4&ohw=1585

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032401.js?21065778

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s18-in-f98.1e100.net

Software

cafe /

Resource Hash

256b712bc8b7729e9ab23a024cfa5241ce2d3461d6261865a89f4b87e91ebe7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 210
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2020032401.js Show response
securepubads.g.doubleclick.net/gpt/ 66 KB
24 KB 71ms
71ms Script
text/javascript 172.217.22.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032401.js?21065778

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032401.js?21065778

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s18-in-f98.1e100.net

Software

sffe /

Resource Hash

0290a012deb1b25451f5211d8cb8b40d8fa6f3942d23ecc12d96670e4c0ed7a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 24 Mar 2020 13:43:01 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 24573
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:14 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 24ms
6ms Other
text/html 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032401.js?21065778
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 419 B
716 B 100ms
100ms XHR
text/plain 172.217.22.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=909767448522644&correlator=877859042265284&output=ldjh&impl=fifs&adsid=NT&eid=21065778%2C21062833%2C21065559&vrg=2020032401&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200325&iu_parts=3379%2Cconde.ars.native%2Clegacy%2Cinformation-technology%2Carticle%2C1&enc_prev_ius=0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=2x2&prev_scp=pos%3Dlegacy%26ctx_slot_type%3Dnative_xrail%26ctx_slot_rn%3D0%26pos_instance%3D1%26ctx_slot_instance%3D0%26ctx_slot_name%3Dnative_xrail_0&eri=1&cust_params=amznbid%3D0%26amznp%3D0%26m_data%3Dwaiting%26m_safety%3Dwaiting%26m_categories%3Dwaiting%26m_mv%3Dwaiting%26m_gv%3Dwaiting%26env_device_type%3Ddesktop%26ctx_template%3Darticle%26ctx_page_channel%3Dinformation-technology%26env_server%3Dproduction%26ctx_cns_version%3D6.32.6%26ctx_page_slug%3Dnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%26cnt_tags%3Dhacking%252Cmalware%252Cmiddle-east%26cnt_platform%3Dwordpress%26cnt_copilotid%3D%26vnd_4d_cached%3D0%26vnd_4d_ctx_sg%3D%26vnd_4d_ctx_topics%3D%26vnd_4d_ctx_entities%3D%26vnd_4d_ctx_keywords%3D%26vnd_4d_usr_topics%3D&cookie_enabled=1&bc=31&abxe=1&lmt=1585155314&dt=1585155314599&dlt=1585155313954&idt=564&frm=20&biw=1585&bih=1200&oid=3&adxs=1063&adys=661&adks=2072965525&ucis=2&ifi=2&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&dssz=36&icsg=563087436414976&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x0&msz=300x2&ga_vid=505617916.1585155315&ga_sid=1585155315&ga_hid=1860456522&fws=516&ohw=300

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032401.js?21065778

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s18-in-f98.1e100.net

Software

cafe /

Resource Hash

075fb4374a67c8d8950af7094b704e4d7d660a85e3a9b96c3a98c0830b27be70

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 207
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
polarcdn-terrax.com/privacy/v1.0.0/html/optout/readwrite/ Frame 3F14 0
0 51ms
21ms Document
text/html 2606:4700::6811:4032
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://polarcdn-terrax.com/privacy/v1.0.0/html/optout/readwrite/
Requested by: Host: plugin.mediavoice.com
URL: https://plugin.mediavoice.com/plugin.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:4032 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: polarcdn-terrax.com
:scheme: https
:path: /privacy/v1.0.0/html/optout/readwrite/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe

Response headers

status: 200
date: Wed, 25 Mar 2020 16:55:14 GMT
content-type: text/html; charset=utf-8
content-length: 1291
set-cookie: __cfduid=dc364fb0961e1a42ce450e994a4d1e6711585155314; expires=Fri, 24-Apr-20 16:55:14 GMT; path=/; domain=.polarcdn-terrax.com; HttpOnly; SameSite=Lax
vary: Accept-Encoding
access-control-allow-headers: Authorization
access-control-expose-headers: CF-IPCountry, X-Country, CF-Ray
cache-control: max-age=900
access-control-allow-origin: *
access-control-allow-methods: GET
timing-allow-origin: *
content-encoding: gzip
x-varnish: 2028135152 2028114558
age: 344
via: 1.1 varnish
cf-cache-status: HIT
accept-ranges: bytes
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 579a288c8f48650f-FRA

GET
H/1.1 200
OK sparrow.min.js Show response
pixel.condenastdigital.com/ 38 KB
14 KB 40ms
40ms Script
application/javascript 151.101.12.239
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.condenastdigital.com/sparrow.min.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.239 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a4a43521cee4006a9d54ffc1e769752ea89ea213e5474e886a32a5b7613163c3

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 16:55:14 GMT
Content-Encoding: gzip
Age: 5804
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 1, 187
Connection: keep-alive
Content-Length: 13530
x-amz-id-2: V7K8JplftiA2s1suZXvyVzNbacQoab1VNwREgJOCYWoFuujHKSy99OilwFaojZkynDTbjoCTSmI=
X-Served-By: cache-iad2149-IAD, cache-fra19120-FRA
Last-Modified: Wed, 05 Feb 2020 15:16:27 GMT
Server: AmazonS3
X-Timer: S1585155315.649041,VS0,VE0
ETag: "e6435598257a425dcb2054251b81b21a"
Vary: Accept-Encoding
x-amz-request-id: AD73D82969378DC2
Access-Control-Allow-Origin: *
Cache-Control: no-cache, public, max-age=604800
Accept-Ranges: bytes
Content-Type: application/javascript
Expires: Wed, 05 Feb 2020 21:18:34 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 35ms
35ms Image
image/gif 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&t=1585155314422&de=368100489506&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=29bb202-clean&iw=81ef8f7&zMoatRendered=0&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=0&zMoatPageDataTargetingSet=0&zMoatSafetyTargetingSet=0&zMoatEmptySlot=0&zMoatNadoDataLoadTime=Not%20Loaded&zMoatAllDataLoadTime=Not%20Loaded&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations&ac=1&bq=11&f=0&zn=0&na=1796321730&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:14 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 25 Mar 2020 16:55:14 GMT

GET
H/1.1 200
OK arstechnica.com Show response
srv-2020-03-25-16.config.parsely.com/config/ 415 B
657 B 398ms
99ms Script
text/javascript 52.0.203.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://srv-2020-03-25-16.config.parsely.com/config/arstechnica.com
Requested by: Host: d1z2jf7jlzjs58.cloudfront.net
URL: https://d1z2jf7jlzjs58.cloudfront.net/p.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.0.203.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-0-203-166.compute-1.amazonaws.com
Software: / Express
Resource Hash: 49222defe350690c02c86315654351fdc2dda500c5c20c64fa72321cc564a267

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 16:55:14 GMT
Cache-Control: private, no-cache
Connection: keep-alive
X-Powered-By: Express
ETag: W/"19f-GG3ysvdfu02LfmP648lmQw"
Content-Length: 415
Content-Type: text/javascript; charset=utf-8

GET
H2 200 collect
www.google-analytics.com/ 35 B
197 B 6ms
5ms Image
image/gif 2a00:1450:4001:817::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j81&a=1860456522&t=pageview&_s=1&dl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&dr=%2F&dp=%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&ul=en-us&de=UTF-8&dt=Never-before-seen%20attackers%20are%20targeting%20Mideast%20industrial%20organizations%20%7C%20Ars%20Technica&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=aChAgUAjAAQC~&jid=1500212355&gjid=1306996031&cid=505617916.1585155315&tid=UA-31997-1&_gid=265694875.1585155315&gtm=2wg3i0NLXNPCQ&cg1=article%7Creport&cg2=information-technology&cg3=information%20technology&cd1=GTM-NLXNPCQ&cd2=170&cd4=&cd6=Wed%20Mar%2025%202020%2017%3A55%3A14%20GMT%2B0100%20(Central%20European%20Standard%20Time)&cd7=1585155314306.jrwxmly9&cd8=-1&cd9=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&cd10=English&cd11=desktop&cd12=0&cd13=Tag%20Name%3A%20GA%20-%20Pageview%20-%20Core%20Pageview%20-%20All%20Pages&cd20=none&cd25=Dan%20Goodin&cd26=1663038&cd27=881&cd28=Never-before-seen%20attackers%20are%20targeting%20Mideast%20industrial%20organizations&cd29=web&cd32=2020-03-25T10%3A45%3A24%2B00%3A00&cd34=2020-03-25T12%3A13%3A12%2B00%3A00&cd35=hacking%7Cmalware%7Cmiddle%20east&cd36=web&cd43=Ars%20Technica&cd45=Adblock%20Enabled%20-%20false&cd62=https%3A%2F%2Farstechnica.com%2F%3Fp%3D1663038&cd63=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&cd65=&cd72=1.0.0&cd92=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&cd93=information%20technology&cd98=article%7Creport&cd103=&cd113=data-layer-loaded&cm21=1&cd3=505617916.1585155315&z=1577113509

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 02 Mar 2020 13:34:29 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 1999245
content-type: image/gif
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j81&tid=UA-31997-1&cid=505617916.1585155315&jid=1500212355&gjid=1306996031&_gid=265694875.1585155315&_u=aChAgUAjAAQC~&z=220461619
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=505617916.1585155315&jid=1500212355&_v=j81&z=220461619
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=505617916.1585155315&jid=1500212355&_v=j81&z=220461619&slf_rd=1&random=2064984353

42 B
499 B

34ms
21ms

Image
image/gif

2a00:1450:4001:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=505617916.1585155315&jid=1500212355&_v=j81&z=220461619&slf_rd=1&random=2064984353

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:14 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-31997-1&cid=505617916.1585155315&jid=1500212355&_v=j81&z=220461619&slf_rd=1&random=2064984353
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 b10882a1-8446-4e7d-bfb2-ce2c770ad910.json Show response
cdn.cookielaw.org/consent/b10882a1-8446-4e7d-bfb2-ce2c770ad910/ 2 KB
1 KB 86ms
21ms XHR
application/x-javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/consent/b10882a1-8446-4e7d-bfb2-ce2c770ad910/b10882a1-8446-4e7d-bfb2-ce2c770ad910.json
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lha/8DA7) /
Resource Hash: 0df18872a7d32620388cdc4df1e18acaa761a157830bbf8e258599352fa933fb

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
content-md5: egjsK/D2d+BJxj1PL28vfg==
age: 7840
x-cache: HIT
status: 200
content-length: 754
x-ms-lease-status: unlocked
last-modified: Tue, 10 Mar 2020 22:30:57 GMT
server: ECAcc (lha/8DA7)
etag: 0x8D7C542B43D786A
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: f0266ed3-701e-0059-51b3-02dd60000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Wed, 25 Mar 2020 20:55:14 GMT

GET
H2 200 otCCPAiab.js Show response
cdn.cookielaw.org/opt-out/ 22 KB
6 KB 22ms
22ms Script
application/javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/opt-out/otCCPAiab.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lha/8DE6) /
Resource Hash: 10c75f7c6402ea3c15ba35494f299a73e62877fca5786e50f18983243fa16873

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
content-md5: GLZFlYkrNGqcBQA787bV9Q==
age: 7998
x-cache: HIT
status: 200
content-length: 5611
x-ms-lease-status: unlocked
last-modified: Wed, 18 Mar 2020 14:51:28 GMT
server: ECAcc (lha/8DE6)
etag: 0x8D7CB4BD6F4A8BF
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: f0b18d56-001e-009a-46b3-025423000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
expires: Wed, 25 Mar 2020 20:55:14 GMT

POST
H2 200 page Show response
t.skimresources.com/api/v2/ 22 B
342 B 41ms
41ms XHR
application/javascript 35.201.67.47
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://t.skimresources.com/api/v2/page

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/100098X1555750.skimlinks.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.201.67.47 , Ascension Island, ASN15169 (GOOGLE, US),

Reverse DNS

47.67.201.35.bc.googleusercontent.com

Software

Python/3.7 aiohttp/3.5.4 /

Resource Hash

fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: text/plain

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:14 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.7 aiohttp/3.5.4
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
status: 200
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8, application/javascript
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 22

GET
H2 200 iab Show response
api.skimlinks.mgr.consensu.org/ 772 B
636 B 87ms
37ms XHR
application/json 35.190.40.172
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.skimlinks.mgr.consensu.org/iab?nocache=1585155314653

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/100098X1555750.skimlinks.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.190.40.172 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

172.40.190.35.bc.googleusercontent.com

Software

nginx/1.14.0 /

Resource Hash

4898c2b9f8c2f931ef6a819d36e0019867931d9519af933ab4bd5edce724b2a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx/1.14.0
access-control-allow-headers: *
status: 200
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://arstechnica.com
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
via: 1.1 google

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 35ms
34ms Image
image/gif 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=44&t=1585155314422&de=368100489506&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=29bb202-clean&iw=81ef8f7&zMoatRendered=0&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=0&zMoatPageDataTargetingSet=0&zMoatSafetyTargetingSet=0&zMoatEmptySlot=0&zMoatNadoDataLoadTime=242&zMoatAllDataLoadTime=242&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations&ac=1&bq=11&f=0&zn=0&if=242&na=1365855190&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:14 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 25 Mar 2020 16:55:14 GMT

GET
H2 200 dnsfeed Show response
geolocation.1trust.app/cookieconsentpub/v1/geo/location/ 113 B
486 B 56ms
38ms Script
text/javascript 2606:4700::6812:da5d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.1trust.app/cookieconsentpub/v1/geo/location/dnsfeed

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/opt-out/otCCPAiab.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:da5d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1c89250469c4a6df401abf15a6bafed900638d24b7e497b9327124a59b80c0ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000; includeSubDomains; preload
content-type: text/javascript
status: 200
cf-ray: 579a288cd83dd6cd-FRA
vary: Accept-Encoding

GET
H/1.1 200
OK / Show response
infinityid.condenastdigital.com/ 36 B
1 KB 510ms
99ms XHR
text/plain 34.231.184.25
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://infinityid.condenastdigital.com/?rand=1585155314694
Requested by: Host: pixel.condenastdigital.com
URL: https://pixel.condenastdigital.com/sparrow.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.231.184.25 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-231-184-25.compute-1.amazonaws.com
Software: nginx/1.15.8 /
Resource Hash: d1506f0e7eddcc25fa7a9a701118490c8d482e65b118489144f5ccee722db516

Request headers

Accept: text/plain
Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 25 Mar 2020 16:55:15 GMT
content-encoding: gzip
Server: nginx/1.15.8
vary: origin,accept-encoding
Content-Type: text/plain; charset=utf-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
access-control-allow-credentials: true
Connection: keep-alive
transfer-encoding: chunked

GET
H/1.1 200
OK content Show response
4d.condenastdigital.com/ 4 KB
2 KB 420ms
111ms XHR
application/json 52.73.54.41
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://4d.condenastdigital.com/content?url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F
Requested by: Host: pixel.condenastdigital.com
URL: https://pixel.condenastdigital.com/sparrow.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.73.54.41 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-54-41.compute-1.amazonaws.com
Software: /
Resource Hash: 605e8b796740ef943e0e6be4215488c0da90f32d46255d31589fbb7c9c13c015

Request headers

Accept: text/plain
Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 25 Mar 2020 16:55:15 GMT
content-encoding: gzip
Content-Type: application/json; charset=utf-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
Connection: keep-alive
Content-Length: 1305

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 309ms
97ms Image
image/gif 52.202.152.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2020-03-25T16%3A55%3A14.695Z&_t=pubadsReady&cBr=Ars%20Technica&cKe=hacking%7Cmalware%7Cmiddle%20east&cCh=information%20technology&cTi=Never-before-seen%20attackers%20are%20targeting%20Mideast%20industrial%20organizations&cTy=article%7Creport&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=881&cId=1663038&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations&pRt=referral&pHp=%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pWw=1600&pWh=1200&pPw=1600&pPh=4300&pSw=1600&pSh=1200&uID=bc50767f-d812-4c75-ac0c-c19b40302590&uNw=1&uUq=1&sID=cf093b2b-316f-4c4b-8e77-f2305790a46b&pID=8e521b23-5a96-40d9-be16-2809b697fba7&uDt=desktop&dim1=%7B%22runtimeId%22%3A%2228gYRMhoZpa4y%22%2C%22pageContext%22%3A%7B%22contentType%22%3A%22article%22%2C%22templateType%22%3A%22article%22%2C%22channel%22%3A%22information-technology%22%2C%22slug%22%3A%22never-before-seen-attackers-are-targeting-mideast-industrial-organizations%22%2C%22server%22%3A%22production%22%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22hacking%22%2C%22malware%22%2C%22middle-east%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%7D%2C%22version%22%3A%226.32.6%22%7D&_o=ars-technica&_c=ad_metrics&environment=prod&origin=ars-technica
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.202.152.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-202-152-193.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 16:55:14 GMT
Connection: keep-alive
transfer-encoding: chunked
Content-Type: image/gif

GET
H/1.1 200
OK 5b27ee7e8c1abc4e7900000f Show response
api.cnevids.com/v1/video_groups/ 54 KB
10 KB 101ms
100ms XHR
application/json 18.211.127.174
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.cnevids.com/v1/video_groups/5b27ee7e8c1abc4e7900000f?endpoint=oo.arstechnica

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/js/main-e8e6d92966.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.211.127.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-211-127-174.compute-1.amazonaws.com

Software

nginx/1.14.1 /

Resource Hash

069e870b6e87f44740da86df09060fc20ea42bf7517d33c5900e08b00e899599

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/*
Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 25 Mar 2020 16:55:14 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Status: 200 OK
Access-Control-Max-Age: 1728000
Connection: keep-alive
Content-Length: 9573
X-XSS-Protection: 1; mode=block
X-Request-Id: d4f86fc1-d6f4-4f1e-9f5a-69135187e123
X-Runtime: 0.002872
X-Backend-Node: 10.110.10.11
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx/1.14.1
X-Frame-Options: SAMEORIGIN
ETag: W/"4a0226eff78a2340f5d8e3ce26df75cb"
X-Download-Options: noopen
Vary: Accept-Encoding, Origin
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers
Cache-Control: max-age=0, private, must-revalidate

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 374ms
98ms Image
image/gif 52.202.152.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2020-03-25T16%3A55%3A14.712Z&_t=slot_rendered&cBr=Ars%20Technica&cKe=hacking%7Cmalware%7Cmiddle%20east&cCh=information%20technology&cTi=Never-before-seen%20attackers%20are%20targeting%20Mideast%20industrial%20organizations&cTy=article%7Creport&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=881&cId=1663038&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations&pRt=referral&pHp=%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pWw=1600&pWh=1200&pPw=1600&pPh=4300&pSw=1600&pSh=1200&uID=bc50767f-d812-4c75-ac0c-c19b40302590&sID=cf093b2b-316f-4c4b-8e77-f2305790a46b&pID=8e521b23-5a96-40d9-be16-2809b697fba7&uDt=desktop&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.32.6%22%7D&_o=ars-technica&_c=cns_ads&dim2=%7B%22adUnitPath%22%3A%223379%2Fconde.ars.native%2Flegacy%2Finformation-technology%2Farticle%2F1%22%2C%22advertiserId%22%3Anull%2C%22campaignId%22%3Anull%2C%22creativeId%22%3Anull%2C%22elementId%22%3A%22native_xrail_0%22%2C%22instance%22%3A%220%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Atrue%2C%22isFirstRequested%22%3Atrue%2C%22isFirstMoneyRequested%22%3Afalse%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22hacking%22%2C%22malware%22%2C%22middle-east%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3Anull%2C%22name%22%3A%22native_xrail_0%22%2C%22outOfPage%22%3Afalse%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%222x2%22%2C%22slug%22%3A%22never-before-seen-attackers-are-targeting-mideast-industrial-organizations%22%7D&dim3=%7B%22footerStart%22%3A1585155314114%2C%22headerStart%22%3A1585155314091%2C%22navigationStart%22%3A1585155313458%2C%22injected%22%3A1585155314712%2C%22viewable%22%3A%22%22%2C%22viewport%22%3A%22%22%2C%22impression%22%3A%22%22%7D&dim4=%7B%22pos%22%3A%5B%22legacy%22%5D%2C%22ctx_slot_type%22%3A%5B%22native_xrail%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_instance%22%3A%5B%220%22%5D%2C%22ctx_slot_name%22%3A%5B%22native_xrail_0%22%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22amznbid%22%3A%5B%220%22%5D%2C%22amznp%22%3A%5B%220%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.32.6%22%5D%2C%22ctx_page_slug%22%3A%5B%22never-before-seen-attackers-are-targeting-mideast-industrial-organizations%22%5D%2C%22cnt_tags%22%3A%5B%22hacking%22%2C%22malware%22%2C%22middle-east%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_sg%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%2C%22vnd_prx_segments%22%3A%5B%22300003%22%2C%22121100%22%2C%22131100%22%2C%22112200%22%2C%22210000%22%2C%22210012%22%2C%22240000%22%2C%22240002%22%2C%22240003%22%2C%22240004%22%2C%22240001%22%2C%22240005%22%2C%22240006%22%2C%22240007%22%2C%22240008%22%2C%22240009%22%2C%22240011%22%2C%22240012%22%2C%22240013%22%2C%22240014%22%2C%22240017%22%2C%22240015%22%2C%22240016%22%2C%22qx7745%22%2C%22xm1ai0%22%2C%22wmhp4i%22%2C%22euwba9%22%2C%22dcxr0c%22%2C%222hkgm5%22%2C%22ap05we%22%2C%22fdf1wd%22%2C%22v8lc56%22%2C%2265f9pd%22%2C%22uas8ja%22%2C%22_FnZJCTv8E0_%22%5D%7D&environment=prod&origin=ars-technica
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.202.152.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-202-152-193.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 16:55:15 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
368 B 80ms
79ms XHR
text/javascript 99.86.0.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=3035&u=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pid=hb5XD4FuFrIgF&cb=0&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22hero%2Fdesktop%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22rail%2Fdesktop%22%7D%5D&pj=%7B%22si_section%22%3A%22information-technology%22%2C%22us_privacy%22%3A%221---%22%7D&cfgv=0&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.0.120 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-0-120.fra6.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
via: 1.1 94faae20b0f122c4555025f52a2fd745.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA6-C1
status: 200
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://arstechnica.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: vEFulDkMLqN8Pt3UD9OjiH0swQc-289RuKm7brxukzSvhehvl-1G2w==

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 379ms
97ms Image
image/gif 52.202.152.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2020-03-25T16%3A55%3A14.725Z&_t=slot_rendered&cBr=Ars%20Technica&cKe=hacking%7Cmalware%7Cmiddle%20east&cCh=information%20technology&cTi=Never-before-seen%20attackers%20are%20targeting%20Mideast%20industrial%20organizations&cTy=article%7Creport&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=881&cId=1663038&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations&pRt=referral&pHp=%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pWw=1600&pWh=1200&pPw=1600&pPh=4300&pSw=1600&pSh=1200&uID=bc50767f-d812-4c75-ac0c-c19b40302590&sID=cf093b2b-316f-4c4b-8e77-f2305790a46b&pID=8e521b23-5a96-40d9-be16-2809b697fba7&uDt=desktop&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.32.6%22%7D&_o=ars-technica&_c=cns_ads&dim2=%7B%22adUnitPath%22%3A%223379%2Fconde.ars%2Finterstitial%2Finformation-technology%2Farticle%2F1%22%2C%22advertiserId%22%3Anull%2C%22campaignId%22%3Anull%2C%22creativeId%22%3Anull%2C%22elementId%22%3A%22_out_of_page_0%22%2C%22instance%22%3A%220%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Atrue%2C%22isFirstRequested%22%3Afalse%2C%22isFirstMoneyRequested%22%3Afalse%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22hacking%22%2C%22malware%22%2C%22middle-east%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3Anull%2C%22name%22%3A%22out_of_page_0%22%2C%22outOfPage%22%3Atrue%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%221x1%22%2C%22slug%22%3A%22never-before-seen-attackers-are-targeting-mideast-industrial-organizations%22%7D&dim3=%7B%22footerStart%22%3A1585155314114%2C%22headerStart%22%3A1585155314091%2C%22navigationStart%22%3A1585155313458%2C%22injected%22%3A1585155314725%2C%22viewable%22%3A%22%22%2C%22viewport%22%3A%22%22%2C%22impression%22%3A%22%22%7D&dim4=%7B%22pos%22%3A%5B%22interstitial%22%5D%2C%22ctx_slot_type%22%3A%5B%22out_of_page%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_instance%22%3A%5B%220%22%5D%2C%22ctx_slot_name%22%3A%5B%22out_of_page_0%22%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.32.6%22%5D%2C%22ctx_page_slug%22%3A%5B%22never-before-seen-attackers-are-targeting-mideast-industrial-organizations%22%5D%2C%22cnt_tags%22%3A%5B%22hacking%22%2C%22malware%22%2C%22middle-east%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_sg%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%2C%22vnd_prx_segments%22%3A%5B%22300003%22%2C%22121100%22%2C%22131100%22%2C%22112200%22%2C%22210000%22%2C%22210012%22%2C%22240000%22%2C%22240002%22%2C%22240003%22%2C%22240004%22%2C%22240001%22%2C%22240005%22%2C%22240006%22%2C%22240007%22%2C%22240008%22%2C%22240009%22%2C%22240011%22%2C%22240012%22%2C%22240013%22%2C%22240014%22%2C%22240017%22%2C%22240015%22%2C%22240016%22%2C%22qx7745%22%2C%22xm1ai0%22%2C%22wmhp4i%22%2C%22euwba9%22%2C%22dcxr0c%22%2C%222hkgm5%22%2C%22ap05we%22%2C%22fdf1wd%22%2C%22v8lc56%22%2C%2265f9pd%22%2C%22uas8ja%22%2C%22_FnZJCTv8E0_%22%5D%7D&environment=prod&origin=ars-technica
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.202.152.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-202-152-193.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 16:55:15 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 35ms
35ms Image
image/gif 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=43&t=1585155314422&de=368100489506&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=29bb202-clean&iw=81ef8f7&zMoatDfpSlotId=native_xrail_0&zMoatRendered=1&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=1&zMoatPageDataTargetingSet=1&zMoatSafetyTargetingSet=1&zMoatEmptySlot=1&zMoatNadoDataLoadTime=242&zMoatAllDataLoadTime=242&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations&ac=1&bq=11&f=0&zn=0&if=242&na=939468794&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:14 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 25 Mar 2020 16:55:14 GMT

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 115 B
466 B 61ms
35ms Script
text/javascript 2606:4700:10::6814:b844
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:b844 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6109d5731632d64df9eb483fcde4fb912fbe0e95eab63b7db6739f7a3f6ee757

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 579a288d38eb6383-FRA

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 35ms
35ms Image
image/gif 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=43&t=1585155314422&de=368100489506&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=29bb202-clean&iw=81ef8f7&zMoatDfpSlotId=_out_of_page_0&zMoatRendered=2&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=2&zMoatPageDataTargetingSet=2&zMoatSafetyTargetingSet=2&zMoatEmptySlot=2&zMoatNadoDataLoadTime=242&zMoatAllDataLoadTime=242&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations&ac=1&bq=11&f=0&zn=0&if=242&na=749028362&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:14 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 25 Mar 2020 16:55:14 GMT

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/5.13.0/ 389 KB
94 KB 22ms
21ms Script
application/javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/5.13.0/otBannerSdk.js
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lha/8DC6) /
Resource Hash: 759cbd9881e14214af52dfb585ccf70ea59037598b67cc9cf6df7d3fea7abfd0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
content-md5: av5EYi/+VJcKyIBzruXtUw==
age: 7989
x-cache: HIT
status: 200
content-length: 95775
x-ms-lease-status: unlocked
last-modified: Tue, 25 Feb 2020 19:24:49 GMT
server: ECAcc (lha/8DC6)
etag: 0x8D7BA2861DF0E68
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: f1fbf5d0-601e-00e7-03b3-02c8eb000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Wed, 25 Mar 2020 20:55:14 GMT

GET
H/1.1 200
OK 5e5822b938d0690743f48b68.jsautoplay=0&muted=0&hasCompanion=0&adsDisabled=0&onReady=arsVideoModulePlayerReady52871907 Show response
player.cnevids.com/script/video/ 63 KB
21 KB 147ms
147ms Script
text/javascript 13.32.2.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://player.cnevids.com/script/video/5e5822b938d0690743f48b68.jsautoplay=0&muted=0&hasCompanion=0&adsDisabled=0&onReady=arsVideoModulePlayerReady52871907

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/js/main-e8e6d92966.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.32.2.59 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-2-59.muc51.r.cloudfront.net

Software

nginx/1.14.1 /

Resource Hash

543503d624bea2b1bf99cebc7728bf03a5a0d820f9db140a3dab3044c1f77632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 16:55:14 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Amz-Cf-Pop: MUC51
X-Cache: Miss from cloudfront
Status: 200 OK
Connection: keep-alive
Content-Length: 20742
X-XSS-Protection: 1; mode=block
X-Request-Id: 193a1b03-021e-4fbc-b459-f5895b023ce9
X-Runtime: 0.005044
X-Backend-Node: 10.110.45.152
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx/1.14.1
ETag: W/"f3004f56c11b2b660166f97ccc19ee96"
X-Download-Options: noopen
Vary: Origin,Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Via: 1.1 5ff5eb6edcbc169906f2124a1927ecc9.cloudfront.net (CloudFront)
Cache-Control: max-age=0, private, must-revalidate
X-Amz-Cf-Id: rlyeCTZN8JfSGZ_UfJrHx_afxzDQn43sMBcIAUx2gR5JP5kwtS7gvw==

GET
H/1.1 200
OK arstechnica_war-stories-prince-of-persia.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1584454477/ 15 KB
16 KB 172ms
41ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1584454477/arstechnica_war-stories-prince-of-persia.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

56f8838a24cb0cc47dc34a19d6b84d6ce8bf8086b1682bbb990abc13b1e2da65

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 b4218ccd1119ca854cbcd7af81b9efc5.cloudfront.net (CloudFront)
Age: 123
X-Cache: Hit from cloudfront
Date: Wed, 25 Mar 2020 16:53:56 GMT
Server-Timing: fastly;dur=0;total=1;start=2020-03-19T16:11:58.232Z;desc=hit,rtt;dur=1
Content-Length: 15682
Last-Modified: Wed, 18 Mar 2020 01:43:41 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "e9cccef2a4a4cf217be0ba162f6b4296"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, max-age=300
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: b5lzj4hJCrkL2yDdNvZKA6BXEAkiA7GVhg-V3MmZ4r6aIJeO0hEwpw==

GET
H/1.1 200
OK arstechnica_war-stories-how-crash-bandicoot-hacked-the-playstation-to-run.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1582755533/ 17 KB
18 KB 176ms
45ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1582755533/arstechnica_war-stories-how-crash-bandicoot-hacked-the-playstation-to-run.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

46a9ddb1f206a46900872e0a832750ae06925528f81883a3d3517fdb42aefb6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 59a6ba0c52394bdd68c0d9c4f1900068.cloudfront.net (CloudFront)
Age: 187
X-Cache: Hit from cloudfront
Date: Wed, 25 Mar 2020 16:52:49 GMT
Server-Timing: cloudinary;dur=15;start=2020-02-27T18:18:09.474Z,fastly;dur=0;start=2020-03-07T17:15:41.903Z;desc=HIT,rtt;dur=0
Content-Length: 17475
Last-Modified: Thu, 27 Feb 2020 18:16:40 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "7588b83c6eb2a1165344abad7e12e715"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, max-age=300
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: 66F9bZpVzHlOXI1yhu-2sh8TpqxqCpcQeRBmJV9UxnzmzDIO7bX2Kg==

GET
H/1.1 200
OK arstechnica_war-stories-myst.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1580223113/ 13 KB
14 KB 130ms
41ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1580223113/arstechnica_war-stories-myst.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

1bf55bc00dbf13180884211c3d301729e67b81f3456225c1fbf97d271d636509

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 b4218ccd1119ca854cbcd7af81b9efc5.cloudfront.net (CloudFront)
Age: 188
X-Cache: Hit from cloudfront
Date: Wed, 25 Mar 2020 16:52:34 GMT
Server-Timing: cloudinary;dur=12;start=2020-01-29T20:54:25.685Z,fastly;dur=1;start=2020-03-07T16:48:44.717Z;desc=HIT,rtt;dur=0
Content-Length: 13522
Last-Modified: Wed, 29 Jan 2020 20:33:36 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "ed8c6a9aa19e7d5c7aa46a3aead23a87"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, max-age=300
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: NiNgD4RKYy4xL_-VrFTZ2hkonWGfUVokEeQSel1YIUG9glgFelpu3g==

GET
H/1.1 200
OK arstechnica_markiplier-reacts-to-his-top-1000-youtube-comments.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1579194313/ 9 KB
9 KB 109ms
41ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1579194313/arstechnica_markiplier-reacts-to-his-top-1000-youtube-comments.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

e336ff50623cff960c2396944be4392139f63dcc032e5f3428d81489fdfe697a

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 59a6ba0c52394bdd68c0d9c4f1900068.cloudfront.net (CloudFront)
Age: 188
X-Cache: Hit from cloudfront
Date: Wed, 25 Mar 2020 16:52:49 GMT
Server-Timing: fastly;dur=0;start=2020-03-08T20:19:23.263Z;desc=HIT,rtt;dur=0
Content-Length: 8832
Last-Modified: Tue, 21 Jan 2020 16:11:08 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "2bad386c14ac040d530ceb2ae89c8bbb"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, max-age=300
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: XXUncMxfVgt_ycBL5AB29e3xxYxPp2S46pTqKOqgmFPYL7XoEp1FPQ==

GET
H/1.1 200
OK arstechnica_mini-4wd-racing.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1575930137/ 17 KB
18 KB 123ms
66ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1575930137/arstechnica_mini-4wd-racing.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

5c57a0f6d257ca6be9e6bcb6039fea214962c35b7b30fee3dcc112b8cec18d59

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 aa3e70dc6bc5c311a11feeade5070f72.cloudfront.net (CloudFront)
Age: 271
X-Cache: Hit from cloudfront
Date: Wed, 25 Mar 2020 16:51:14 GMT
Server-Timing: fastly;dur=0;total=1;start=2020-03-08T00:22:37.523Z;desc=HIT,rtt;dur=7
Content-Length: 17267
Last-Modified: Thu, 12 Dec 2019 14:30:32 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "7cfa0c5590f779efc925bf7aee626a20"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, max-age=300
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: D1k2gKvCwDxt4IloU5r0SEYZErWfAVutOvT8wV4ZdUq49hFW5BjvLQ==

GET
H/1.1 200
OK arstechnica_war-stories-war-stories-oddworld.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1582815531/ 12 KB
13 KB 121ms
41ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1582815531/arstechnica_war-stories-war-stories-oddworld.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

1097abb6f0992cccc79428374463e7f23b99dae5eb85d7317b20bd57c96031bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Thu, 27 Feb 2020 15:06:27 GMT
Via: 1.1 c0093508e95ee3f9ebe60485284279c0.cloudfront.net (CloudFront)
Age: 2339328
X-Cache: Hit from cloudfront
Server-Timing: cloudinary;dur=930;start=2020-02-27T15:06:26.318Z,cld-id;desc=91472fb1eee53be8784252f7ee17a908,fastly;dur=0;total=1030;start=2020-02-27T15:06:26.268Z;desc=MISS,rtt;dur=1
Content-Length: 12614
X-Request-Id: 91472fb1eee53be8784252f7ee17a908
Last-Modified: Thu, 27 Feb 2020 15:06:28 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "4a7903cbe66890b5688d843661943ccd"
Strict-Transport-Security: max-age=604800
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, immutable, max-age=2592000
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: dM9XFuZ-7jp2uCj46zepTBRbS0vSo41-KnXLHXqbz4jfcLV03fMknQ==

GET
H/1.1 200
OK arstechnica_unsolved-mysteries-bioware-answers-unsolved-mysteries-of-the-mass-effect-universe.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1573140819/ 11 KB
12 KB 89ms
41ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1573140819/arstechnica_unsolved-mysteries-bioware-answers-unsolved-mysteries-of-the-mass-effect-universe.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

de24551bd4396fc8579b2d87ce01944553dd48fb52775d14373725a50efa0c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 b4218ccd1119ca854cbcd7af81b9efc5.cloudfront.net (CloudFront)
Age: 188
X-Cache: Hit from cloudfront
Date: Wed, 25 Mar 2020 16:52:34 GMT
Server-Timing: fastly;dur=0;start=2020-03-09T09:21:03.847Z;desc=HIT,rtt;dur=0
Content-Length: 11417
Last-Modified: Fri, 08 Nov 2019 14:35:23 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "3e8509d06c6610d54babcac0d91e5d93"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, max-age=300
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: K5XeUj6dkb4M_w2AD8ZakV-WEuvAuxjTlD84FQWuLWnZeNwItwn_xA==

GET
H/1.1 200
OK arstechnica_war-stories-civilization.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1569003425/ 16 KB
17 KB 87ms
41ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1569003425/arstechnica_war-stories-civilization.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

1c7dcc8216c6f82da2998ceeac2523632c7f9bffe510824b6d082621201f2012

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 59a6ba0c52394bdd68c0d9c4f1900068.cloudfront.net (CloudFront)
Age: 188
X-Cache: Hit from cloudfront
Date: Wed, 25 Mar 2020 16:52:49 GMT
Server-Timing: fastly;dur=0;start=2020-03-08T15:15:47.973Z;desc=HIT,rtt;dur=0
Content-Length: 16236
Last-Modified: Mon, 23 Sep 2019 11:27:54 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "72002610618f7bf8bf0e52c760e39897"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, max-age=300
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: tQK7vT2zGkfbEs9vv25S1hDjEkItM5ndkf8eM81J9kR05nzUJz6cCA==

GET
H/1.1 200
OK arstechnica_sitrep-dod-resets-ballistic-missile-interceptor-program.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1568662260/ 11 KB
11 KB 77ms
41ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1568662260/arstechnica_sitrep-dod-resets-ballistic-missile-interceptor-program.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

7fc88c65d46e83b3f3e9f098f05fd639480332fc3718cd714725e2e4633af4e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 aa3e70dc6bc5c311a11feeade5070f72.cloudfront.net (CloudFront)
Age: 1093655
X-Cache: Hit from cloudfront
Date: Fri, 13 Mar 2020 01:09:27 GMT
Server-Timing: cloudinary;dur=30;start=2020-02-08T14:56:10.394Z,fastly;dur=0;total=1;start=2020-02-12T01:07:35.237Z;desc=HIT,rtt;dur=4
Content-Length: 10793
Last-Modified: Tue, 17 Sep 2019 19:55:15 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "0e1ff58ccf6d97759de3d774a7ff835a"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, immutable, max-age=2592000
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: AUy-uEG2AGG24-0iO4hoN_fZl8IEzXbghfgqZMu-oBXajgkWgS98LQ==

GET
H/1.1 200
OK arstechnica_warframe-reviews.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1561556730/ 14 KB
15 KB 87ms
48ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1561556730/arstechnica_warframe-reviews.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

83a366075eb2387c6d9f848f42b08df0546027333eccf5813edf95ba45709be2

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 c0093508e95ee3f9ebe60485284279c0.cloudfront.net (CloudFront)
Age: 188
X-Cache: Hit from cloudfront
Date: Wed, 25 Mar 2020 16:52:49 GMT
Server-Timing: cloudinary;dur=87;start=2020-03-05T21:15:17.268Z,fastly;dur=0;total=1;start=2020-03-07T14:06:56.434Z;desc=HIT,rtt;dur=0
Content-Length: 14837
Last-Modified: Thu, 27 Jun 2019 19:34:59 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "1d90d6aef7585f963e1270a1a02a4dd4"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, max-age=300
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: tqxXbvOVpWj0jeITVxQVgB2l5kaXPhh1SJThCvWjNLaUXDsS3MOUcA==

GET
H/1.1 200
OK arstechnica_war-stories-subnautica.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1559747425/ 15 KB
16 KB 66ms
48ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1559747425/arstechnica_war-stories-subnautica.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

20660a9ef7ec454c15b2dc62b3db084e0cc9f74c5bb6de71a96fb1a54aef00f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 b4218ccd1119ca854cbcd7af81b9efc5.cloudfront.net (CloudFront)
Age: 188
X-Cache: Hit from cloudfront
Date: Wed, 25 Mar 2020 16:52:49 GMT
Server-Timing: cloudinary;dur=63;start=2020-02-25T01:30:57.676Z,fastly;dur=0;total=1;start=2020-03-07T23:26:14.752Z;desc=HIT,rtt;dur=5
Content-Length: 15222
Last-Modified: Wed, 05 Jun 2019 17:40:02 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "8c45b6c645caba59f4b14d3fbdc09062"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, max-age=300
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: 0A1zn3SYr5v42pU59jp5d5yQDEXe5wxV70Bg9wRVE91yfVmqNzukDw==

GET
H/1.1 200
OK arstechnica_army-s-new-pistol-has-had-some-misfires.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1556912500/ 8 KB
8 KB 79ms
64ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1556912500/arstechnica_army-s-new-pistol-has-had-some-misfires.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

a91d62b47f02a7e638d1749e3791ac328b2dd89dac630578f76e65b1ed91ed89

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 59a6ba0c52394bdd68c0d9c4f1900068.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MUC51-C1
X-Cache: Hit from cloudfront
Date: Wed, 25 Mar 2020 16:55:15 GMT
Server-Timing: cloudinary;dur=50;start=2020-03-04T00:38:36.591Z,fastly;dur=1;start=2020-03-08T13:33:56.455Z;desc=HIT,rtt;dur=1
Content-Length: 7863
Last-Modified: Mon, 13 May 2019 19:11:27 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "31902de995c98904a55c605571f06530"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, max-age=300
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: BmcjyAakFvfLWY9qcSjnN-yM7rjMbrsRF2bAx1hPXvZGqq1tmZpnkA==

GET
H/1.1 200
OK arstechnica_war-stories-slay-the-spire-war-stories.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1556741487/ 15 KB
16 KB 69ms
41ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1556741487/arstechnica_war-stories-slay-the-spire-war-stories.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

f9d9e96c4439beeca49a1a10f9dffe6f5cd0b604d13aa13af170d0bc62d8ca1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 aa3e70dc6bc5c311a11feeade5070f72.cloudfront.net (CloudFront)
Age: 188
X-Cache: Hit from cloudfront
Date: Wed, 25 Mar 2020 16:52:49 GMT
Server-Timing: cloudinary;dur=77;start=2020-02-26T04:03:50.561Z,fastly;dur=0;total=1;start=2020-03-08T15:56:40.398Z;desc=HIT,rtt;dur=5
Content-Length: 15634
Last-Modified: Thu, 02 May 2019 18:45:52 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "abee90e53f29ba0127fca9442ab50902"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, max-age=300
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: -AxJ0JLO_0EvChZWB_kFnlPj8J4T99u14wcSPrsH_Cz2RXcJbrFpeA==

GET
H/1.1 200
OK arstechnica_war-stories-amnesia-the-dark-descent-the-horror-facade.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1555359865/ 15 KB
16 KB 76ms
41ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1555359865/arstechnica_war-stories-amnesia-the-dark-descent-the-horror-facade.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

1defb6bc54a7ee9c066136908360e8455c23ee9ad0dec9924e7255d7948cd4be

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 c0093508e95ee3f9ebe60485284279c0.cloudfront.net (CloudFront)
Age: 183
X-Cache: Hit from cloudfront
Date: Wed, 25 Mar 2020 16:52:49 GMT
Server-Timing: fastly;dur=0;total=1;start=2020-03-09T08:22:44.421Z;desc=HIT,rtt;dur=3
Content-Length: 15251
Last-Modified: Tue, 16 Apr 2019 18:59:19 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "3e7cdc13e718680bf5e1efa64468b560"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, max-age=300
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: js0o93AVkOECIeP0FkAMCO2nSklxO5ibBzz085FCHGO3BjJ___tlvg==

GET
H/1.1 200
OK arstechnica_war-stories-c-and-c-tiberian-sun.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1551193450/ 19 KB
19 KB 65ms
42ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1551193450/arstechnica_war-stories-c-and-c-tiberian-sun.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

27348ba4b98bd80f1038496ec5dea6ad865680540058fb085b8ca199b8aaf4c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 b4218ccd1119ca854cbcd7af81b9efc5.cloudfront.net (CloudFront)
Age: 188
X-Cache: Hit from cloudfront
Date: Wed, 25 Mar 2020 16:52:49 GMT
Server-Timing: fastly;dur=1;start=2020-03-07T16:29:46.032Z;desc=HIT,rtt;dur=0
Content-Length: 19022
Last-Modified: Wed, 27 Feb 2019 16:48:24 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "fe52b9acd391d8bee8de15a0f429b377"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, max-age=300
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: 6VLgvf2sTjE3QPkyKW-oe4Zba1Jl7w7Ksdr729VjXuW5P3cTxtKrhQ==

GET
H/1.1 200
OK arstechnica_war-stories-blade-runner-skinjobs-voxels-and-future-noir.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1550244434/ 18 KB
19 KB 74ms
42ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1550244434/arstechnica_war-stories-blade-runner-skinjobs-voxels-and-future-noir.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

8b72952d3fd656ee6594f0d9735d928113ad1d590705b14f77abf75f1d4d5d69

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 59a6ba0c52394bdd68c0d9c4f1900068.cloudfront.net (CloudFront)
Age: 110
X-Cache: Hit from cloudfront
Date: Wed, 25 Mar 2020 16:53:56 GMT
Server-Timing: fastly;dur=0;total=1;start=2020-03-07T20:03:57.211Z;desc=HIT,rtt;dur=4
Content-Length: 18172
Last-Modified: Fri, 15 Feb 2019 15:34:33 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "32f1b8954559c8d598e9861f5b8360b9"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, max-age=300
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: IUdl9NF0wknPIVNZlyl1qtdVHM3NfUdUbb5spbf-sWXpm39_S3YE0g==

GET
H/1.1 200
OK arstechnica_war-stories-dead-space-the-drag-tentacle.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1546889545/ 7 KB
8 KB 68ms
41ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1546889545/arstechnica_war-stories-dead-space-the-drag-tentacle.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

9933997608e86beaf1e7f7188a5c657cdad8ccd9d20eb7b1a46adaa83fa850ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 aa3e70dc6bc5c311a11feeade5070f72.cloudfront.net (CloudFront)
Age: 1092225
X-Cache: Hit from cloudfront
Date: Fri, 13 Mar 2020 01:33:21 GMT
Server-Timing: cloudinary;dur=53;start=2020-02-07T22:30:13.069Z,fastly;dur=0;total=1;start=2020-02-12T01:10:53.540Z;desc=HIT,rtt;dur=5
Content-Length: 7393
Last-Modified: Tue, 08 Jan 2019 16:38:58 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "17a6e4b5eb75eb12f5d8c89eb3d0ace8"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, immutable, max-age=2592000
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: MgycPK2o3U3lZWzEFQO6FZ0NKyMdEFACMP3aeU-PBk6kRWE59TntZg==

GET
H/1.1 200
OK arstechnica_teach-the-controversy-flat-earthers.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1541592304/ 10 KB
11 KB 59ms
41ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1541592304/arstechnica_teach-the-controversy-flat-earthers.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

7364fcbb6c5d775f07816712af8a6419db99268f72c337a4977f706dc3423bb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 c0093508e95ee3f9ebe60485284279c0.cloudfront.net (CloudFront)
Age: 188
X-Cache: Hit from cloudfront
Date: Wed, 25 Mar 2020 16:54:22 GMT
Server-Timing: fastly;dur=0;start=2020-03-09T09:12:14.940Z;desc=HIT,rtt;dur=5
Content-Length: 10595
Last-Modified: Fri, 09 Nov 2018 14:44:53 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "6c0c4f8a9d61ed2b5863a8058c624a37"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, max-age=300
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: 3DmQwoxnmG35xYwpeDOD9WmbCCrhMI8LxzaK3N6U_nuqviE04n6jew==

GET
H/1.1 200
OK arstechnica_delta-v-the-burgeoning-world-of-small-rockets-paul-allen-s-huge-plane-and-spacex-get-s-a-crucial-green-light.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1537406983/ 12 KB
13 KB 75ms
48ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1537406983/arstechnica_delta-v-the-burgeoning-world-of-small-rockets-paul-allen-s-huge-plane-and-spacex-get-s-a-crucial-green-light.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

16f86804dd013db340fee4020a539d3e9d6e5a03d6841e431e50c428e99c26e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 b4218ccd1119ca854cbcd7af81b9efc5.cloudfront.net (CloudFront)
Age: 9
X-Cache: Hit from cloudfront
Date: Wed, 25 Mar 2020 16:55:06 GMT
Server-Timing: fastly;dur=0;total=1;start=2020-03-08T05:56:31.764Z;desc=HIT,rtt;dur=6
Content-Length: 12509
Last-Modified: Fri, 21 Sep 2018 16:51:30 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "b9c502ffc902b60d0eb13698b37a945d"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, max-age=300
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: DxzFmJY0Tx2AUxbM4xK9L99A9n3Abw_HJTPBU71Asl9WIQNDiCbZMw==

GET
H/1.1 200
OK arstechnica_chris-hadfield-explains-his-space-oddity-video.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1522031130/ 7 KB
8 KB 76ms
44ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1522031130/arstechnica_chris-hadfield-explains-his-space-oddity-video.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

3ce7e824185893264ab44fbf8370a8f1262831c4c6c367b15f7d4f1e88fadc8c

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 59a6ba0c52394bdd68c0d9c4f1900068.cloudfront.net (CloudFront)
Age: 1092160
X-Cache: Hit from cloudfront
Date: Fri, 13 Mar 2020 01:32:35 GMT
Server-Timing: cloudinary;dur=52;start=2020-02-12T01:32:29.646Z,fastly;dur=0;total=141;start=2020-02-12T01:32:29.599Z;desc=MISS,rtt;dur=4
Content-Length: 7181
Last-Modified: Fri, 06 Jul 2018 12:23:22 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "0549828edcecd339d8d10ebe6119de70"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, immutable, max-age=2592000
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: 0fSdXUYYIEEcLIROLeW6hBMFQy892EmOsZGQ51iSZKx1tNA3x94u3Q==

GET
H/1.1 200
OK arstechnica_apollo-mission-episode-1.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1512424612/ 14 KB
15 KB 80ms
63ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1512424612/arstechnica_apollo-mission-episode-1.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

82cd1a97f81e5b63a621311be2993916eea0907b5eadd53bb6b280f4bb0f8391

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 aa3e70dc6bc5c311a11feeade5070f72.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MUC51-C1
X-Cache: Hit from cloudfront
Date: Wed, 25 Mar 2020 16:55:15 GMT
Server-Timing: cloudinary;dur=84;start=2020-02-05T04:47:14.560Z,fastly;dur=0;total=1;start=2020-03-07T15:05:47.087Z;desc=HIT,rtt;dur=3
Content-Length: 14040
Last-Modified: Tue, 05 Dec 2017 01:52:25 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "ecc047c6eed3dc571a78eab647201220"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, max-age=300
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: xL6KYrXlSwd7CDhfIRfY4F_pd52z19HqNMUSOELKlZXkjWbaJnU5Mw==

GET
H/1.1 200
OK arstechnica_richard-garriot-war-stories.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1513807048/ 14 KB
14 KB 54ms
41ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1513807048/arstechnica_richard-garriot-war-stories.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

4980853759711c8e9e2779239acd62e9e802fba38371763c65ecdd016a83fdbd

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 c0093508e95ee3f9ebe60485284279c0.cloudfront.net (CloudFront)
Age: 225
X-Cache: Hit from cloudfront
Date: Wed, 25 Mar 2020 16:52:49 GMT
Server-Timing: cloudinary;dur=82;start=2020-02-26T05:17:40.518Z,fastly;dur=0;start=2020-03-09T08:34:52.083Z;desc=HIT,rtt;dur=0
Content-Length: 13885
Last-Modified: Fri, 06 Jul 2018 19:56:42 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "13d45a1733ad4d2f3ae707584d6a8a32"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, max-age=300
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: TCverPfDJl1hijBhs0tukCkjfgCDHlcW8Xw_E9Otd79SKop4woRpLQ==

GET
DATA 200
OK truncated
/ 408 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c21029f21dc145723d40362da85504ee5a5bd33f5db6636beae3a01c7aba1fa2

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/b10882a1-8446-4e7d-bfb2-ce2c770ad910/ef17d20e-0b37-40e7-a82c-27f698052aea/ 122 KB
18 KB 22ms
21ms Fetch
application/x-javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/consent/b10882a1-8446-4e7d-bfb2-ce2c770ad910/ef17d20e-0b37-40e7-a82c-27f698052aea/en.json
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.13.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lha/8CA3) /
Resource Hash: 8379daabd87751a7da8f1ed0c4b558d62f7d19a01b72a7f50153c1ec95f4ac9a

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
content-md5: oDldTv707db2pxAKcgGc8A==
age: 7839
x-cache: HIT
status: 200
content-length: 18348
x-ms-lease-status: unlocked
last-modified: Tue, 10 Mar 2020 22:31:07 GMT
server: ECAcc (lha/8CA3)
etag: 0x8D7C542BA1BB286
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: d1730e04-b01e-0083-21b3-02784b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Wed, 25 Mar 2020 20:55:14 GMT

GET
H2 200 otCMP.js Show response
cdn.cookielaw.org/scripttemplates/5.13.0/ 16 KB
5 KB 28ms
27ms Script
application/javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/5.13.0/otCMP.js
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.13.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lha/8D9C) /
Resource Hash: fd9ee23548e148a3798e79ae0553689b81675afe6791f53d5e8af20973e6a7b0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
content-md5: cgEQ1F8+NKFKe9J6MXvYfw==
age: 7999
x-cache: HIT
status: 200
content-length: 5312
x-ms-lease-status: unlocked
last-modified: Tue, 25 Feb 2020 19:24:55 GMT
server: ECAcc (lha/8D9C)
etag: 0x8D7BA2865557BD9
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: c69fce34-e01e-00f6-19b3-02fff0000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
expires: Wed, 25 Mar 2020 20:55:14 GMT

GET
H2 200 iabData.json Show response
cdn.cookielaw.org/vendorlist/ 92 KB
17 KB 23ms
22ms Fetch
application/x-javascript 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/vendorlist/iabData.json
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.13.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lha/8D3C) /
Resource Hash: 981898ccfc444d54beb452d380c685515410830fb12494784729fd1eaa68167f

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 25 Mar 2020 16:55:14 GMT
content-encoding: gzip
content-md5: kf/kUmh1gsah5KhM3yzvvw==
age: 454397
x-cache: HIT
status: 200
content-length: 17115
x-ms-lease-status: unlocked
last-modified: Sat, 14 Mar 2020 06:00:11 GMT
server: ECAcc (lha/8D3C)
etag: 0x8D7C7DCF4F45245
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 9d69d7c4-201e-002c-0aa4-fe5adb000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=604800
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Wed, 25 Mar 2020 20:55:14 GMT

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ 96 KB
30 KB 63ms
29ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.js
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: d8435911753d7e931e1dda44b3ec12ce5158d6389131eadb584f0097a809c901

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:15 GMT
content-encoding: gzip
last-modified: Tue, 17 Mar 2020 08:42:53 GMT
server: nginx
access-control-allow-origin: *
etag: W/"5e708d8d-18138"
content-type: text/javascript
status: 200
cache-control: max-age=86400, public
timing-allow-origin: *
expires: Thu, 26 Mar 2020 16:55:15 GMT

GET
H2 404 idsv2 Show response
mid.rkdms.com/ 0
0 125ms
41ms XHR
application/xml 143.204.202.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mid.rkdms.com/idsv2?ptk=17c1789b-e660-493b-aa74-3c8fb990dc5f&pubid=CONDENAST
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.100 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-100.fra53.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
541 B 31ms
31ms XHR
application/json 54.77.139.233
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=183973
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.139.233 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-139-233.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 577d41cdf575c24619ed9f4609d74905e67b4afe20b50ecbda5ed2b7311f169d

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Wed, 25 Mar 2020 16:55:14 GMT
x-aspnet-version: 4.0.30319
status: 200
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://arstechnica.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Fri, 24 Apr 2020 16:55:14 GMT

GET
H/1.1 200
OK Cookie set put.html
widgets.outbrain.com/nanoWidget/externals/cookie/ Frame A6D3 0
0 36ms
35ms Document
text/html 95.101.185.159
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/nanoWidget/externals/cookie/put.html
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585155314242
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.159 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-159.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash

Request headers

Host: widgets.outbrain.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Response headers

Accept-Ranges: bytes
Content-Type: text/html
ETag: "c0311cf15c21ddda054005e92fad3f9e:1585128557.048626"
Last-Modified: Wed, 25 Mar 2020 08:30:07 GMT
Server: AkamaiNetStorage
Content-Length: 416
Cache-Control: max-age=604800
Date: Wed, 25 Mar 2020 16:55:14 GMT
Connection: keep-alive
Timing-Allow-Origin: *
Access-Control-Allow-Credentials: false
Access-Control-Allow-Methods: GET,POST
Access-Control-Allow-Origin: *
Set-Cookie: akacd_widgets_routing=1585155314~rv=42~id=4fedee5c81682726c52359999c85b101; path=/; Expires=Wed, 25 Mar 2020 16:55:14 GMT; Secure; SameSite=None

GET
H/1.1 200
OK YXJzdGVjaG5pY2EuY29t Show response
tcheck.outbrainimg.com/tcheck/check/ 16 B
477 B 368ms
40ms XHR
application/json 95.101.186.38
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://tcheck.outbrainimg.com/tcheck/check/YXJzdGVjaG5pY2EuY29t

Requested by

Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585155314242

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.186.38 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a95-101-186-38.deploy.static.akamaitechnologies.com

Software

Resource Hash

929701ed632814943e3df803ddd9e3f179ccf889c0ad7b7f3392bd8d109b174f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=0; includeSubDomains;
ETag: W/"10-us8lSJutAxKqLzf8c1+n5XstcwY"
Access-Control-Max-Age: 43200
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=16264
Date: Wed, 25 Mar 2020 16:55:15 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: false
Content-Length: 16
Expires: Wed, 25 Mar 2020 21:26:19 GMT

GET
H/1.1 200
OK embed-api.json Show response
player.cnevids.com/ 7 KB
3 KB 288ms
163ms Fetch
application/json 13.32.2.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://player.cnevids.com/embed-api.json?videoId=5e5822b938d0690743f48b68&embedLocation=arstechnica

Requested by

Host: player.cnevids.com
URL: https://player.cnevids.com/script/video/5e5822b938d0690743f48b68.jsautoplay=0&muted=0&hasCompanion=0&adsDisabled=0&onReady=arsVideoModulePlayerReady52871907

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.32.2.59 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-2-59.muc51.r.cloudfront.net

Software

nginx/1.14.1 /

Resource Hash

2db34386505467cf0982cbdecdc8303c7b2ac8feee1519487168834d4536c60a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 25 Mar 2020 16:55:15 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Amz-Cf-Pop: MUC51
X-Cache: Miss from cloudfront
Status: 200 OK
Access-Control-Max-Age: 1728000
Connection: keep-alive
Content-Length: 2217
X-XSS-Protection: 1; mode=block
X-Request-Id: 57f29289-7fd6-487e-9bae-2eb936df2e16
X-Runtime: 0.012977
X-Backend-Node: 10.110.120.110
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx/1.14.1
ETag: W/"e331d44e5ad1c16dc777a42f37b88bf7"
X-Download-Options: noopen
Vary: Origin,Accept-Encoding
Access-Control-Allow-Methods: GET, OPTIONS
Content-Type: application/json; charset=utf-8
Via: 1.1 53ab41ef66579f807f4211d0a85fe42a.cloudfront.net (CloudFront)
Access-Control-Expose-Headers
Cache-Control: max-age=0, private, must-revalidate
Access-Control-Allow-Origin: *
X-Amz-Cf-Id: z_M8i9SlXBpOrU36fK9pJogs-izTO8Zn84DraFMV4fgs6AaM8wWrFQ==

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame A8BC 264 KB
90 KB 63ms
41ms Script
text/javascript 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: player.cnevids.com
URL: https://player.cnevids.com/script/video/5e5822b938d0690743f48b68.jsautoplay=0&muted=0&hasCompanion=0&adsDisabled=0&onReady=arsVideoModulePlayerReady52871907

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd9c4ff9e4c840fd5a0de9b08d276d0c6b21c7810dcc4c829365809082019a48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 91727
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:15 GMT

GET
H2 200 gpt_proxy.js Show response
imasdk.googleapis.com/js/sdkloader/ 65 KB
24 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/gpt_proxy.js

Requested by

Host: player.cnevids.com
URL: https://player.cnevids.com/script/video/5e5822b938d0690743f48b68.jsautoplay=0&muted=0&hasCompanion=0&adsDisabled=0&onReady=arsVideoModulePlayerReady52871907

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5840907b4c9bf2f9a2ff4a6ce7f4087fef8dcaf67c8e2b4ccabad6a3b50d18c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 20 Mar 2020 23:14:12 GMT
server: sffe
age: 559
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=900
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 24215
x-xss-protection: 0
expires: Wed, 25 Mar 2020 17:00:56 GMT

GET
H/1.1 200
OK player-style-3b3a013ac40046610e8f2fefe02c3b07.css
d2c8v52ll5s99u.cloudfront.net/player/ Frame A8BC 74 KB
12 KB 248ms
41ms Stylesheet
text/css 13.227.157.149
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2c8v52ll5s99u.cloudfront.net/player/player-style-3b3a013ac40046610e8f2fefe02c3b07.css
Requested by: Host: player.cnevids.com
URL: https://player.cnevids.com/script/video/5e5822b938d0690743f48b68.jsautoplay=0&muted=0&hasCompanion=0&adsDisabled=0&onReady=arsVideoModulePlayerReady52871907
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.227.157.149 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-157-149.muc51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 596b76b93c7801ba85fb53f2f6e2281d4dbffc96ddc18bb056e8cb0e94be34fd

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Wed, 04 Mar 2020 23:40:15 GMT
Content-Encoding: gzip
Age: 1790101
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 11365
Last-Modified: Wed, 05 Jun 2019 16:03:54 GMT
Server: AmazonS3
ETag: "cff060eda5015972d532696ec91d375b"
Content-Type: text/css; charset=utf-8
Via: 1.1 f2424402a7dcebaf6b6ffb2e5689533f.cloudfront.net (CloudFront)
Cache-Control: max-age=63072000, public
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
X-Amz-Cf-Id: E8IXGUQm6WuOKK3xHurSnQr9geYW578w9PU9YrvHogwJMXAe4iRI3A==
Expires: Tue, 01 Jan 2030 00:00:00 GMT

GET
H/1.1 200
OK main-8acd27185b78ea8d8dde.js Show response
d2c8v52ll5s99u.cloudfront.net/player/ Frame A8BC 915 KB
230 KB 215ms
41ms Script
application/javascript 13.227.157.149
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-8acd27185b78ea8d8dde.js
Requested by: Host: player.cnevids.com
URL: https://player.cnevids.com/script/video/5e5822b938d0690743f48b68.jsautoplay=0&muted=0&hasCompanion=0&adsDisabled=0&onReady=arsVideoModulePlayerReady52871907
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.227.157.149 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-157-149.muc51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5c6c066d45fcff5eb73d9f8c6e7b2d756d46229d4c05a7b776054c71c05c70b4

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Tue, 07 Jan 2020 21:11:21 GMT
Content-Encoding: gzip
Age: 6723835
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 234924
Last-Modified: Tue, 07 Jan 2020 21:03:27 GMT
Server: AmazonS3
ETag: "fb0b5702877a9be5aaeeec5b6ba4c842"
Content-Type: application/javascript
Via: 1.1 f2424402a7dcebaf6b6ffb2e5689533f.cloudfront.net (CloudFront)
Cache-Control: max-age=63072000, public
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
X-Amz-Cf-Id: AX3VJ8fr6U8jmQYO3Gqa9OWCmVCR54NUEjy2BWOZX6pdDrZbshCF7A==
Expires: Tue, 01 Jan 2030 00:00:00 GMT

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 715 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/5.13.0/assets/ 15 KB
3 KB 22ms
22ms Fetch
application/json 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/5.13.0/assets/otFlat.json
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.13.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lha/8DB3) /
Resource Hash: f52e4e999a441c151183d77efd6dad3915e650409ea65b94b7e0fc067dcd0abd

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 25 Mar 2020 16:55:15 GMT
content-encoding: gzip
content-md5: idLIfkDq/eva4EuRGVQzZQ==
age: 7999
x-cache: HIT
status: 200
content-length: 2839
x-ms-lease-status: unlocked
last-modified: Tue, 25 Feb 2020 19:24:47 GMT
server: ECAcc (lha/8DB3)
etag: 0x8D7BA28607C070E
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: b088eb0a-701e-0112-54b3-02aaaf000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Wed, 25 Mar 2020 20:55:15 GMT

GET
H2 200 otPcCenter.json Show response
cdn.cookielaw.org/scripttemplates/5.13.0/assets/ 84 KB
17 KB 23ms
22ms Fetch
application/json 152.195.132.202
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/5.13.0/assets/otPcCenter.json
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.13.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lha/8D2B) /
Resource Hash: 2bd6c30a523ce8b33d96dc79b1d759b5d5634740ae76aa6557e2d3741082e067

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 25 Mar 2020 16:55:15 GMT
content-encoding: gzip
content-md5: Bbq+cqhXBxu2QqVrgDpPqg==
age: 7998
x-cache: HIT
status: 200
content-length: 17012
x-ms-lease-status: unlocked
last-modified: Tue, 25 Feb 2020 19:24:47 GMT
server: ECAcc (lha/8D2B)
etag: 0x8D7BA28609F260F
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: d025f9ca-601e-002b-29b3-02ac5e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Wed, 25 Mar 2020 20:55:15 GMT

GET
H/1.1 200
OK ptrack-v1.4.1-dev.4-engagedtime-slots.js Show response
d1z2jf7jlzjs58.cloudfront.net/code/ 46 KB
18 KB 61ms
60ms Script
application/x-javascript 143.204.208.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1z2jf7jlzjs58.cloudfront.net/code/ptrack-v1.4.1-dev.4-engagedtime-slots.js
Requested by: Host: d1z2jf7jlzjs58.cloudfront.net
URL: https://d1z2jf7jlzjs58.cloudfront.net/p.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.208.228 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-208-228.fra53.r.cloudfront.net
Software: nginx /
Resource Hash: 6971adb7fc147ab4028012f8c0afa86bfad4101212c5881d1aab7c2fa6977b39

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 17 Feb 2020 23:03:52 GMT
Content-Encoding: gzip
Age: 3174680
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Pragma: public
Last-Modified: Mon, 17 Feb 2020 22:55:27 GMT
Server: nginx
ETag: W/"5e4b19df-b7c7"
Content-Type: application/x-javascript
Via: 1.1 1f5757b46371746e677236d4fc67d364.cloudfront.net (CloudFront)
Cache-Control: max-age=315360000, public
X-Amz-Cf-Pop: FRA53-C1
X-Amz-Cf-Id: mPfb3DoJtaQd-clHxR2PBjQgAN6xq5M6i0KQ_5q1nij2Z4LyIiTDBg==
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
DATA 200
OK truncated
/ 817 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK /
srv-2020-03-25-16.pixel.parsely.com/plogger/ 43 B
229 B 392ms
98ms Image
image/gif 52.3.43.18
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://srv-2020-03-25-16.pixel.parsely.com/plogger/?rand=1585155315178&plid=71256748&idsite=arstechnica.com&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%22parsely_uuid%22%3A%2299836f6b-ff72-40a0-aedd-883cc0f72f97%22%2C%22parsely_site_uuid%22%3A%2299836f6b-ff72-40a0-aedd-883cc0f72f97%22%7D&sid=1&surl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&sref=&sts=1585155315173&slts=0&title=Never-before-seen+attackers+are+targeting+Mideast+industrial+organizations+%7C+Ars+Technica&date=Wed+Mar+25+2020+17%3A55%3A15+GMT%2B0100+(Central+European+Standard+Time)&action=pageview&pvid=81360933&u=99836f6b-ff72-40a0-aedd-883cc0f72f97
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.3.43.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-3-43-18.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Wed, 25 Mar 2020 16:55:15 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK dwce_cheq_events Show response
log.outbrainimg.com/loggerServices/ 4 B
325 B 534ms
91ms XHR
application/json 64.202.112.127
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://log.outbrainimg.com/loggerServices/dwce_cheq_events?timestamp=1585155315188&sessionId=754bd2b7-c83d-237c-9a9d-b1719cca0c57&url=arstechnica.com&cheqSource=1&cheqEvent=0&exitReason=1
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585155314242
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.202.112.127 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 25 Mar 2020 16:55:15 GMT
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
X-TraceId: abb9c56187289392038bc536dd59de65
Content-Length: 4
Expires: 0

GET
H/1.1 200
OK user Show response
4d.condenastdigital.com/ 67 B
428 B 113ms
112ms XHR
application/json 52.73.54.41
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://4d.condenastdigital.com/user?xid=2ab080d4-e824-4f62-a70e-67d18c7e7eb4
Requested by: Host: pixel.condenastdigital.com
URL: https://pixel.condenastdigital.com/sparrow.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.73.54.41 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-54-41.compute-1.amazonaws.com
Software: /
Resource Hash: 1aba8822e3f693e42c79877d0ec6d34e7066e69e0cac0c4565683e45b1021505

Request headers

Accept: text/plain
Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 25 Mar 2020 16:55:15 GMT
content-encoding: gzip
transfer-encoding: chunked
Content-Type: application/json; charset=utf-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
Connection: keep-alive

GET
H/1.1 200
OK dwce_cheq_events Show response
log.outbrainimg.com/loggerServices/ 4 B
325 B 450ms
91ms XHR
application/json 64.202.112.127
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://log.outbrainimg.com/loggerServices/dwce_cheq_events?timestamp=1585155315353&sessionId=754bd2b7-c83d-237c-9a9d-b1719cca0c57&url=arstechnica.com&cheqSource=1&cheqEvent=3&responseTime=371
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585155314242
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.202.112.127 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 25 Mar 2020 16:55:15 GMT
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
X-TraceId: d87e50c107ae6305d504bf15ccf89237
Content-Length: 4
Expires: 0

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 98ms
97ms Image
image/gif 52.202.152.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2020-03-25T16%3A55%3A15.362Z&_t=pageview&cBr=Ars%20Technica&cKe=hacking%7Cmalware%7Cmiddle%20east&cCh=information%20technology&cTi=Never-before-seen%20attackers%20are%20targeting%20Mideast%20industrial%20organizations&cTy=article%7Creport&cTp=ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192&cTpw=0.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495&cEnt=malware%2C%20milum%2C%20kaspersky%20lab%2C%20page%20layout%2C%20middle%20east%2C%20iran%2C%20dan%20goodin%2C%20mideast%2C%20vpn%2C%20utc%2C%20json%2C%20middle%20eastern%2C%2064-bit%2C%20cond%C3%A9%20nast%2C%20denis%20legezo%2C%20ars%20orbital%20transmission%2C%20c%2B%2B%2C%20us%2C%20saudi%20arabian%2C%20ars%20technica%20addendum&cEnw=1%2C%200.6906379545219714%2C%200.6877128322284288%2C%200.6615894629690477%2C%200.5946571427809644%2C%200.4921362430533071%2C%200.4103889677627687%2C%200.4041333983659949%2C%200.3913882334036157%2C%200.38007900317315924%2C%200.37162764148642624%2C%200.3565682437182297%2C%200.3426552132063025%2C%200.33462725081747424%2C%200.30206502850039274%2C%200.2997686267310179%2C%200.2902701446479252%2C%200.2751866283263286%2C%200.26480398171397435%2C%200.2530766852930854&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=881&cId=1663038&cPd=2020-03-25T10%3A45%3A24.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations&pRt=referral&pHp=%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pWw=1600&pWh=1200&pPw=1600&pPh=4800&pSw=1600&pSh=1200&uID=07843961-f9a3-463c-83e3-3b7508dd8927&uNw=1&uUq=1&pID=62940348-df41-46b8-9c0c-5f1dbd727e94&uDt=desktop&_o=ars-technica&_c=general&xID=2ab080d4-e824-4f62-a70e-67d18c7e7eb4&environment=prod&origin=ars-technica&cKh=malware%2Corganization%2Cnever-before-seen%20attacker%2Cresearcher%2Cmilum%2Ckaspersky%20lab%2Cpage%20layout%2Cwildpressure
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.202.152.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-202-152-193.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 16:55:15 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
BLOB 200
OK b9181ffc-2c60-4cd0-b2eb-bcef0b540977
https://arstechnica.com/ Frame A8BC 31 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://arstechnica.com/b9181ffc-2c60-4cd0-b2eb-bcef0b540977
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-8acd27185b78ea8d8dde.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: worker

Response headers

Content-Length: 31
Content-Type: application/javascript

GET
H/1.1 200
OK sf-ui-display-medium-webfont.woff2
d2c8v52ll5s99u.cloudfront.net/assets/fonts/ Frame A8BC 29 KB
30 KB 632ms
505ms Font
application/font-woff2 13.227.157.149
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2c8v52ll5s99u.cloudfront.net/assets/fonts/sf-ui-display-medium-webfont.woff2
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.227.157.149 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-157-149.muc51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d281c9d6bae645f3da6d2f0769a2cf0668709fd28e2021ce74821cdd8c7117b3

Request headers

Referer: https://d2c8v52ll5s99u.cloudfront.net/player/player-style-3b3a013ac40046610e8f2fefe02c3b07.css
Origin: https://arstechnica.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 25 Mar 2020 16:55:17 GMT
Content-Encoding: gzip
X-Amz-Cf-Pop: MUC51-C1
X-Cache: RefreshHit from cloudfront
Access-Control-Max-Age: 3000
Connection: keep-alive
Content-Length: 29632
Via: 1.1 c0093508e95ee3f9ebe60485284279c0.cloudfront.net (CloudFront)
Last-Modified: Mon, 26 Jun 2017 15:24:42 GMT
Server: AmazonS3
ETag: "7d18db04f980971f2a9c5026bbc34bed"
Vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
Access-Control-Allow-Methods: GET
Content-Type: application/font-woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=63072000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: UzkJYhbnJiBczuOoDq4KQtHAX7HrRHB-hSlzRjHOYIUvR8sHsknYCA==
Expires: Tue, 01 Jan 2030 00:00:00 GMT

GET
H2 200 bridge3.376.3_en.html
imasdk.googleapis.com/js/core/ Frame 643E 0
0 6ms
6ms Document
text/html 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.376.3_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: imasdk.googleapis.com
:scheme: https
:path: /js/core/bridge3.376.3_en.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 196758
date: Wed, 25 Mar 2020 14:33:17 GMT
expires: Thu, 25 Mar 2021 14:33:17 GMT
last-modified: Fri, 20 Mar 2020 23:10:57 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 8518
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ Frame A8BC 26 KB
11 KB 39ms
13ms Script
text/javascript 2a00:1450:4001:809::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 10523
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:15 GMT

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame A8BC 109 B
171 B 22ms
22ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=arstechnica.com

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame A8BC 126 KB
31 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-8acd27185b78ea8d8dde.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=3600
content-length: 30466
x-xss-protection: 0
pragma: public
x-fb-debug: lbro8qyGQ8ESfiBfkRMlhuClF6t0vt7n40NNbWavLTcz5hd5WKCtUN5Ob5eRrR80gdK2UW2BTyP5mIpvIwdw7A==
x-fb-trip-id: 420120009
date: Wed, 25 Mar 2020 16:55:15 GMT, Wed, 25 Mar 2020 16:55:15 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK comscore-min.js Show response
d2c8v52ll5s99u.cloudfront.net/player/ Frame A8BC 38 KB
11 KB 42ms
41ms Script
text/javascript 13.227.157.149
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2c8v52ll5s99u.cloudfront.net/player/comscore-min.js
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-8acd27185b78ea8d8dde.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.227.157.149 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-157-149.muc51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 833a86642252016b29f08dd45ffd27f9e00ca237f28d8c5f0147a6e15d009377

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 16:55:07 GMT
Content-Encoding: gzip
Last-Modified: Wed, 24 May 2017 18:19:15 GMT
Server: AmazonS3
Age: 9
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Via: 1.1 f2424402a7dcebaf6b6ffb2e5689533f.cloudfront.net (CloudFront)
Transfer-Encoding: chunked
X-Amz-Cf-Pop: MUC51-C1
Connection: keep-alive
X-Amz-Cf-Id: 1MFuNzrY5OEA7d2ztH0xZqDyMgQlx3QEgmthd3ejsK9o-X-mjb2llw==

POST
H2 200 collect
www.google-analytics.com/r/ 35 B
169 B 13ms
13ms Other
image/gif 2a00:1450:4001:817::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/r/collect

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:15 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: https://arstechnica.com
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK infinityid Show response
infinityid.condenastdigital.com/ Frame A8BC 36 B
1 KB 100ms
100ms XHR
text/plain 34.231.184.25
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://infinityid.condenastdigital.com/infinityid
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-8acd27185b78ea8d8dde.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.231.184.25 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-231-184-25.compute-1.amazonaws.com
Software: nginx/1.15.8 /
Resource Hash: 87bb7b8c0a5fb93a2caca3df4756904b8ff76303f6d3d12085ca0cbf23699b62

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 25 Mar 2020 16:55:15 GMT
content-encoding: gzip
Server: nginx/1.15.8
vary: origin,accept-encoding
Content-Type: text/plain; charset=utf-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
access-control-allow-credentials: true
Connection: keep-alive
transfer-encoding: chunked

GET
H/1.1 200
OK track
capture.condenastdigital.com/ Frame A8BC 48 B
48 B 98ms
98ms Image
image/gif 52.202.152.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&_ts=2020-03-25T16%3A55%3A15.448Z&_c=&_t=Player%20Requested&sID=07ad7b93-856c-42c4-8a7b-dcde40374913&pID=62940348-df41-46b8-9c0c-5f1dbd727e94&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.202.152.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-202-152-193.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 16:55:15 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H/1.1 200
OK arstechnica_war-stories-prince-of-persia.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_arstechnica.png,fl_progressive,g_face,h_450,q_80,w_800/v1584454477/ Frame A8BC 70 KB
71 KB 41ms
41ms Image
image/jpeg 13.227.157.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_arstechnica.png,fl_progressive,g_face,h_450,q_80,w_800/v1584454477/arstechnica_war-stories-prince-of-persia.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

ea4101dd4137f8a8eee9a6f243d17a5cde9db3ea3013a4e16c34418de335a552

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Tue, 17 Mar 2020 15:14:51 GMT
Via: 1.1 aa3e70dc6bc5c311a11feeade5070f72.cloudfront.net (CloudFront)
Age: 697224
X-Cache: Hit from cloudfront
Server-Timing: cloudinary;dur=536;start=2020-03-17T15:14:51.161Z,cld-id;desc=e4530d80b3ec485f26bfd11cc28e0957,fastly;dur=0;total=631;start=2020-03-17T15:14:51.115Z;desc=MISS,rtt;dur=1
Content-Length: 72134
X-Request-Id: e4530d80b3ec485f26bfd11cc28e0957
Last-Modified: Tue, 17 Mar 2020 15:14:52 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "6edb7af6cfacb59c1bd9fb8e267a7712"
Strict-Transport-Security: max-age=604800
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, immutable, max-age=2592000
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: Mf7WZRY0WEOjTVQc_Nj8oiTvkZp0i5flIblUiabfykZV2GNs-K9THg==

GET
H/1.1 206
Partial Content f5e876af-cedc-4721-a22b-6aa34c36e925thumbs.mp4
dp8hsntg6do36.cloudfront.net/5e5822b938d0690743f48b68/ Frame A8BC 128 KB
0 180ms
41ms Media
video/mp4 99.84.89.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5e5822b938d0690743f48b68/f5e876af-cedc-4721-a22b-6aa34c36e925thumbs.mp4
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.84.89.112 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-89-112.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Sec-Fetch-Dest: video
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range: bytes=0-

Response headers

Date: Wed, 25 Mar 2020 12:50:30 GMT
Via: 1.1 89a45b9ac94fb6c6e52c37fdd89a6cb1.cloudfront.net (CloudFront)
Last-Modified: Thu, 27 Feb 2020 20:30:21 GMT
Server: AmazonS3
Age: 14686
ETag: "aa156369293534f8e2d2b04a52fa5623"
X-Cache: Hit from cloudfront
Content-Type: video/mp4
Content-Range: bytes 0-3737313/3737314
Connection: keep-alive
X-Amz-Cf-Pop: MUC50-C1
Accept-Ranges: bytes
Content-Length: 3737314
X-Amz-Cf-Id: 7leGktpVgBTrzwis9_krNz_ruz12XcoN9O9Gpu1CbUm0BdZb6va5rA==

GET
H/1.1 206
Partial Content f5e876af-cedc-4721-a22b-6aa34c36e925thumbs.mp4
dp8hsntg6do36.cloudfront.net/5e5822b938d0690743f48b68/ Frame A8BC 16 KB
0 375ms
41ms Media
video/mp4 99.84.89.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5e5822b938d0690743f48b68/f5e876af-cedc-4721-a22b-6aa34c36e925thumbs.mp4
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.84.89.112 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-89-112.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Sec-Fetch-Dest: video
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range: bytes=0-

Response headers

Date: Wed, 25 Mar 2020 12:50:30 GMT
Via: 1.1 c7cdb483c2afdb721f3c8ba14cd43e86.cloudfront.net (CloudFront)
Last-Modified: Thu, 27 Feb 2020 20:30:21 GMT
Server: AmazonS3
Age: 14687
ETag: "aa156369293534f8e2d2b04a52fa5623"
X-Cache: Hit from cloudfront
Content-Type: video/mp4
Content-Range: bytes 0-3737313/3737314
Connection: keep-alive
X-Amz-Cf-Pop: MUC50-C1
Accept-Ranges: bytes
Content-Length: 3737314
X-Amz-Cf-Id: 1pHW1ewO_LxFhzsDjnWPhGlzrsfdnZbUKVda27urBHssSte7Gp3kng==

GET
H2 200 get Show response
odb.outbrain.com/utils/ 15 KB
10 KB 308ms
231ms Script
text/x-json 151.101.14.2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://odb.outbrain.com/utils/get?url=http%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&srcUrl=http%3A%2F%2Ffeeds.arstechnica.com%2Farstechnica%2Findex%2F&settings=true&recs=true&widgetJSId=JS_1&key=NANOWDGT01&idx=0&version=1050170&apv=false&sig=6deULkXw&format=vjapi&va=true&rand=81324&pdobuid=-1&osLang=en-US&winW=1600&winH=1200&scrW=1600&scrH=1200&adblck=false&secured=true&cmpStat=1&ccpaStat=1&ref=

Requested by

Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585155314242

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

f0edd652f0fc3395f47fda8c616c0a82eef9ea479ebb9897e93370c0f8a122d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=0; includeSubDomains;
content-encoding: gzip
traffic-path: NYDC1, JFK, FRA, Europe1
x-cache: MISS, MISS
p3p: policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
status: 200
x-traceid: 36e671235cfa5320fd74b4e8da828c5a
content-length: 9097
x-served-by: cache-jfk8147-JFK, cache-fra19157-FRA
pragma: no-cache
x-timer: S1585155316.750807,VS0,VE192
date: Wed, 25 Mar 2020 16:55:15 GMT
vary: Accept-Encoding, User-Agent
content-type: text/x-json; charset=UTF-8
via: 1.1 varnish, 1.1 varnish
expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache
backend-ip: 104.156.90.47
accept-ranges: bytes, bytes
x-cache-hits: 0, 0

GET
H/1.1 200
OK track
capture.condenastdigital.com/ Frame A8BC 48 B
48 B 99ms
98ms Image
image/gif 52.202.152.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&_ts=2020-03-25T16%3A55%3A15.657Z&_c=Player%20Event&_t=Player%20Loaded&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fwww.arstechnica.com%2Fvideo%2Fwatch%2Fwar-stories-how-prince-of-persia-defeated-apple-ii-s-memory-limitations&cId=5e5822b938d0690743f48b68&cKe=video%20games%2Cprince%20of%20persia%2Cprince%20of%20persia%20apple%20ii%2Capple%20ii%20games%2Cars%20technica%20war%20stories%2Cclassic%20video%20games%2Cretro%20gaming%2Crotoscope%2Crotoscoping%2Crotoscope%20animation%2Cinterview%2Cgame%20development%2Cvideo%20game%20development%2Cgame%20developer%2Cvideo%20game%20developer&cPd=2020-03-17T15%3A00%3A00%2B00%3A00&cTi=How%20Prince%20of%20Persia%20Defeated%20Apple%20II%27s%20Memory%20Limitations&mDu=1248&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pID=62940348-df41-46b8-9c0c-5f1dbd727e94&pWw=540&pWh=303.75&sID=07ad7b93-856c-42c4-8a7b-dcde40374913&uId=07843961-f9a3-463c-83e3-3b7508dd8927&dim1=%7B%22contentStartType%22%3A%22manual%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22gitBranch%22%3A%22master%22%2C%22gitSha%22%3A%227a2672b%22%2C%22guid%22%3A%22b273a256-c272-94c2-daf0-dfde2be1b974%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22manual%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A3529.8125%2C%22playerType%22%3A%22video-continuous%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3Anull%2C%22recStrategy%22%3Anull%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22versoPageType%22%3A%22article%7Creport%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3A%22OUT_OF_VIEWPORT%22%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&adId=&pageType=article%7Creport
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.202.152.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-202-152-193.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 16:55:15 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
BLOB 200
OK de1781dc-f1f8-4d95-bd6b-7966b1b3e727
https://arstechnica.com/ Frame A8BC 5 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://arstechnica.com/de1781dc-f1f8-4d95-bd6b-7966b1b3e727
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-8acd27185b78ea8d8dde.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d5f3418a3fa657175d5341b5e032be036cb4d5818de5d1497f2175be5a7e3701

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: worker

Response headers

Content-Length: 5463
Content-Type: application/javascript

GET
H/1.1 200
OK f5e876af-cedc-4721-a22b-6aa34c36e925manifest-ios.m3u8 Show response
dp8hsntg6do36.cloudfront.net/5e5822b938d0690743f48b68/ Frame A8BC 918 B
1 KB 167ms
40ms XHR
application/x-mpegurl 99.84.89.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5e5822b938d0690743f48b68/f5e876af-cedc-4721-a22b-6aa34c36e925manifest-ios.m3u8?videoIndex=0&requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-8acd27185b78ea8d8dde.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.84.89.112 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-89-112.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 50f762386cb9f2b1f96aa93356b1e3d7a5063bc1bd5a4bc62d849fc52a971b07

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 25 Mar 2020 16:26:30 GMT
Via: 1.1 2d469870f5a756385a1eb37325629a1f.cloudfront.net (CloudFront)
Vary: Origin
Age: 1726
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 918
Last-Modified: Thu, 27 Feb 2020 20:27:03 GMT
Server: AmazonS3
ETag: "a1a39c6e4bf3cfaede68b313469202bb"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: MUC50-C1
Accept-Ranges: bytes
X-Amz-Cf-Id: KEBebIOXMxRHuQ9zlK_dZMBLJvW0s9pgoPMrvIJuDiZDry2B_OLoTw==

GET
H2 200 1663130473914833 Show response
connect.facebook.net/signals/config/ Frame A8BC 447 KB
113 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1663130473914833?v=2.9.15&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

875a11a56b643b49e30cb7137449c2ff9b3e47e47eed68e4a024bc17d7286bcd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=3600
content-length: 115417
x-xss-protection: 0
pragma: public
x-fb-debug: bpog7f4Og3wGpZIcXXkoZrS9kXBok7j0Wq65RDEbKz197STwNkRtnsB8JUoYxRhhUEPN69lGZx2u7FreWpFQFg==
x-fb-trip-id: 420120009
date: Wed, 25 Mar 2020 16:55:15 GMT, Wed, 25 Mar 2020 16:55:15 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_arstechnica.png,fl_progressive,g_face,h_450,q_80,w_800/v1584454477/arstechnica_war-stories-prince-of-persia.jpg

Requested by

Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-8acd27185b78ea8d8dde.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

ea4101dd4137f8a8eee9a6f243d17a5cde9db3ea3013a4e16c34418de335a552

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: image
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 17 Mar 2020 15:14:51 GMT
Via: 1.1 7187cfd76669785d6cdaa648abee3065.cloudfront.net (CloudFront)
Age: 697225
X-Cache: Hit from cloudfront
Server-Timing: cloudinary;dur=536;start=2020-03-17T15:14:51.161Z,cld-id;desc=e4530d80b3ec485f26bfd11cc28e0957,fastly;dur=0;total=631;start=2020-03-17T15:14:51.115Z;desc=MISS,rtt;dur=1
Content-Length: 72134
X-Request-Id: e4530d80b3ec485f26bfd11cc28e0957
Last-Modified: Tue, 17 Mar 2020 15:14:52 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "6edb7af6cfacb59c1bd9fb8e267a7712"
Strict-Transport-Security: max-age=604800
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, immutable, max-age=2592000
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: FlRb8GGg2_yqpkc2qI2-tmYcUVvbgBmoYI-pVECQPXOJJ-3SFRbIJw==

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_arstechnica.png,fl_progressive,g_face,h_450,q_80,w_800/v1584454477/arstechnica_war-stories-prince-of-persia.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.157.224 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-157-224.muc51.r.cloudfront.net

Software

Cloudinary /

Resource Hash

ea4101dd4137f8a8eee9a6f243d17a5cde9db3ea3013a4e16c34418de335a552

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Tue, 17 Mar 2020 15:14:51 GMT
Via: 1.1 aa3e70dc6bc5c311a11feeade5070f72.cloudfront.net (CloudFront)
Age: 697224
X-Cache: Hit from cloudfront
Server-Timing: cloudinary;dur=536;start=2020-03-17T15:14:51.161Z,cld-id;desc=e4530d80b3ec485f26bfd11cc28e0957,fastly;dur=0;total=631;start=2020-03-17T15:14:51.115Z;desc=MISS,rtt;dur=1
Content-Length: 72134
X-Request-Id: e4530d80b3ec485f26bfd11cc28e0957
Last-Modified: Tue, 17 Mar 2020 15:14:52 GMT
Server: Cloudinary
Connection: keep-alive
ETag: "6edb7af6cfacb59c1bd9fb8e267a7712"
Strict-Transport-Security: max-age=604800
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Disposition,Server-Timing
Cache-Control: public, no-transform, immutable, max-age=2592000
X-Amz-Cf-Pop: MUC51-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: GUSwarFBOWkk49vP5E8nurJmFFlQW7xGGZLDAzi5PAgmXvPtXV8rFg==

POST
H/1.1 204
No Content events
wren.condenastdigital.com/1.0/conde/ 0
732 B 431ms
105ms Other
image/gif 52.0.16.6
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wren.condenastdigital.com/1.0/conde/events?topic=wren.events.ads&api_key=d3Jlbg

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/ars-technica.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.0.16.6 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-0-16-6.compute-1.amazonaws.com

Software

nginx/1.15.8 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Wed, 25 Mar 2020 16:55:16 GMT
strict-transport-security: max-age=15768000; preload
x-content-type-options: nosniff
Server: nginx/1.15.8
x-download-options: noopen
x-frame-options: DENY
Content-Type: image/gif
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
access-control-allow-credentials: true
Connection: keep-alive
vary: origin
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK f5e876af-cedc-4721-a22b-6aa34c36e925file-1422k-128-48000-768.m3u8 Show response
dp8hsntg6do36.cloudfront.net/5e5822b938d0690743f48b68/ Frame A8BC 17 KB
1 KB 42ms
41ms XHR
application/x-mpegurl 99.84.89.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5e5822b938d0690743f48b68/f5e876af-cedc-4721-a22b-6aa34c36e925file-1422k-128-48000-768.m3u8?requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-8acd27185b78ea8d8dde.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.84.89.112 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-89-112.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cf0bd1da56c1ce18f78560b5bf4fb33dbc214a4254d25c42b92b21cca2f1380d

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 25 Mar 2020 16:34:18 GMT
Content-Encoding: gzip
Vary: Origin
Age: 1258
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Thu, 27 Feb 2020 20:36:32 GMT
Server: AmazonS3
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Via: 1.1 2d469870f5a756385a1eb37325629a1f.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MUC50-C1
X-Amz-Cf-Id: n1vgr7Yvxofh6FrAtEwHKenCDVAVenXGweiIlqaFZwXVZd7_yErBzw==

GET
BLOB 200
OK 11ad5371-1a8b-45bf-9d07-ae022abcb3af
https://arstechnica.com/ Frame A8BC 64 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://arstechnica.com/11ad5371-1a8b-45bf-9d07-ae022abcb3af
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-8acd27185b78ea8d8dde.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4b188a568fa90fa61d4bbe76dd6cf523abe65787e0ac3dc6b5c44db5e823685b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: worker

Response headers

Content-Length: 65790
Content-Type: application/javascript

GET
H/1.1 200
OK f5e876af-cedc-4721-a22b-6aa34c36e925file-1422k-128-48000-768-00001.ts Show response
dp8hsntg6do36.cloudfront.net/5e5822b938d0690743f48b68/ Frame A8BC 349 KB
283 KB 41ms
41ms XHR
application/x-mpegurl 99.84.89.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5e5822b938d0690743f48b68/f5e876af-cedc-4721-a22b-6aa34c36e925file-1422k-128-48000-768-00001.ts?requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-8acd27185b78ea8d8dde.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.84.89.112 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-89-112.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3c113d157ed4ce3b4f80767998fba3f8dc9900f3945f619329afe5e386f02660

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 25 Mar 2020 16:34:20 GMT
Content-Encoding: gzip
Vary: Origin
Age: 1256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Thu, 27 Feb 2020 20:36:22 GMT
Server: AmazonS3
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Via: 1.1 2d469870f5a756385a1eb37325629a1f.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MUC50-C1
X-Amz-Cf-Id: -Zroq9qDvW_ftO19p6zM_cL9gq6DsAQnSgbzfB3hzYFmX8bBn9Djtw==

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 4 KB
2 KB 76ms
76ms XHR
text/plain 172.217.22.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=909767448522644&correlator=877859042265284&output=ldjh&impl=fifs&adsid=NT&eid=21065778%2C21062833%2C21065559&vrg=2020032401&npa=1&guci=1.2.0.0.2.1.0.0&sc=1&sfv=1-0-37&ecs=20200325&iu_parts=3379%2Cconde.ars%2Chero%2Cinformation-technology%2Carticle%2C1&enc_prev_ius=0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=728x90%7C970x250%7C9x1%7C10x1&prev_scp=pos%3Dhero%26ctx_slot_type%3Dpost_nav%26ctx_slot_rn%3D0%26m_mv%3DslotNoHistData%26m_gv%3DslotNoHistData%26amznbid%3D2%26amznp%3D2%26pos_instance%3D1%26ctx_slot_instance%3D0%26ctx_slot_name%3Dpost_nav_0&eri=1&cust_params=m_data%3D1%26m_safety%3Dsafe%26m_categories%3D%26m_mv%3DnoHistData%26m_gv%3DnoHistData%26env_device_type%3Ddesktop%26ctx_template%3Darticle%26ctx_page_channel%3Dinformation-technology%26env_server%3Dproduction%26ctx_cns_version%3D6.32.6%26ctx_page_slug%3Dnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%26cnt_tags%3Dhacking%252Cmalware%252Cmiddle-east%26cnt_platform%3Dwordpress%26cnt_copilotid%3D%26vnd_4d_cached%3D0%26vnd_4d_ctx_sg%3D%26vnd_4d_ctx_topics%3D%26vnd_4d_ctx_entities%3D%26vnd_4d_ctx_keywords%3D%26vnd_4d_usr_topics%3D%26vnd_prx_segments%3D300003%252C121100%252C131100%252C112200%252C210000%252C210012%252C240000%252C240002%252C240003%252C240004%252C240001%252C240005%252C240006%252C240007%252C240008%252C240009%252C240011%252C240012%252C240013%252C240014%252C240017%252C240015%252C240016%252Cqx7745%252Cxm1ai0%252Cwmhp4i%252Ceuwba9%252Cdcxr0c%252C2hkgm5%252Cap05we%252Cfdf1wd%252Cv8lc56%252C65f9pd%252Cuas8ja%252C_FnZJCTv8E0_&cookie_enabled=1&bc=31&abxe=1&lmt=1585155315&dt=1585155315957&dlt=1585155313954&idt=564&frm=20&biw=1585&bih=1200&oid=3&adxs=0&adys=80&adks=2385402828&ucis=3&ifi=3&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&dssz=48&icsg=563130342047744&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x90&msz=1585x90&ga_vid=505617916.1585155315&ga_sid=1585155315&ga_hid=1860456522&fws=4&ohw=1585

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032401.js?21065778

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s18-in-f98.1e100.net

Software

cafe /

Resource Hash

461e49b8fa83529ed9a7ebafcf200213d78d38d545083fe8de902ea25d2d5d37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 2171
x-xss-protection: 0
google-lineitem-id: 4860183109
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138250144973
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 4 KB
2 KB 141ms
141ms XHR
text/plain 172.217.22.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=909767448522644&correlator=877859042265284&output=ldjh&impl=fifs&adsid=NT&eid=21065778%2C21062833%2C21065559&vrg=2020032401&npa=1&guci=1.2.0.0.2.1.0.0&sc=1&sfv=1-0-37&ecs=20200325&iu_parts=3379%2Cconde.ars%2Crail%2Cinformation-technology%2Carticle%2C1&enc_prev_ius=0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=300x250%7C300x600&prev_scp=pos%3Drail%26ctx_slot_type%3Dsiderail%26ctx_slot_rn%3D0%26m_mv%3DslotNoHistData%26m_gv%3DslotNoHistData%26amznbid%3D2%26amznp%3D2%26pos_instance%3D1%26ctx_slot_instance%3D0%26ctx_slot_name%3Dsiderail_0&eri=1&cust_params=m_data%3D1%26m_safety%3Dsafe%26m_categories%3D%26m_mv%3DnoHistData%26m_gv%3DnoHistData%26env_device_type%3Ddesktop%26ctx_template%3Darticle%26ctx_page_channel%3Dinformation-technology%26env_server%3Dproduction%26ctx_cns_version%3D6.32.6%26ctx_page_slug%3Dnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%26cnt_tags%3Dhacking%252Cmalware%252Cmiddle-east%26cnt_platform%3Dwordpress%26cnt_copilotid%3D%26vnd_4d_cached%3D0%26vnd_4d_ctx_sg%3D%26vnd_4d_ctx_topics%3D%26vnd_4d_ctx_entities%3D%26vnd_4d_ctx_keywords%3D%26vnd_4d_usr_topics%3D%26vnd_prx_segments%3D300003%252C121100%252C131100%252C112200%252C210000%252C210012%252C240000%252C240002%252C240003%252C240004%252C240001%252C240005%252C240006%252C240007%252C240008%252C240009%252C240011%252C240012%252C240013%252C240014%252C240017%252C240015%252C240016%252Cqx7745%252Cxm1ai0%252Cwmhp4i%252Ceuwba9%252Cdcxr0c%252C2hkgm5%252Cap05we%252Cfdf1wd%252Cv8lc56%252C65f9pd%252Cuas8ja%252C_FnZJCTv8E0_&cookie_enabled=1&bc=31&abxe=1&lmt=1585155315&dt=1585155315963&dlt=1585155313954&idt=564&frm=20&biw=1585&bih=1200&oid=3&adxs=1063&adys=370&adks=1483574547&ucis=4&ifi=4&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&dssz=48&icsg=563130342047744&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x250&msz=300x250&ga_vid=505617916.1585155315&ga_sid=1585155315&ga_hid=1860456522&fws=516&ohw=300

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032401.js?21065778

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s18-in-f98.1e100.net

Software

cafe /

Resource Hash

aef1677736f291276889ef8546a8f0af8af086e120d3cf9adc0ec255418810b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 2164
x-xss-protection: 0
google-lineitem-id: 4860183109
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138250089663
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK l Show response
mcdp-nydc1.outbrain.com/ 4 B
377 B 377ms
95ms XHR
application/json 70.42.32.127
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL

https://mcdp-nydc1.outbrain.com/l?token=01d7c2f6a44ea8e667b7d6e688fdf2ee_6817_1585155315895&tm=989&eT=0&tpcs=0&wRV=1050170&pVis=0&lsd=9b700ffe-b076-4746-b200-8bbb874cd1b8&eIdx=&cheq=0&ab=0&wl=0

Requested by

Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585155314242

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

70.42.32.127 , United States, ASN22075 (AS-OUTBRAIN, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

c48b5b1a9776c84602de2306d7903a7241158a5077e7a8519af75c33441b8334

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
Strict-Transport-Security: max-age=0; includeSubDomains;
Content-Type: application/json; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: content-range
Connection: close
X-TraceId: 717cba39e00b5bf5abcd23e0eb00778a
Content-Length: 30

GET
H/1.1 200
OK Cookie set obUserSync.html
widgets.outbrain.com/widgetOBUserSync/ Frame ED2F 0
0 38ms
37ms Document
text/html 95.101.185.159
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585155314242
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.159 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-159.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash

Request headers

Host: widgets.outbrain.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: obuid=9b700ffe-b076-4746-b200-8bbb874cd1b8; recs_d37bc2689ca0ed750ea991f603e76006=0B1925901673A2304348158A2395459944A2337984879A2523717943A2198356354ACD1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Response headers

Accept-Ranges: bytes
Content-Type: text/html
ETag: "938505833703786e7ccfce1fecf1cd66:1582216491.628225"
Last-Modified: Thu, 20 Feb 2020 16:34:45 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=604800
Date: Wed, 25 Mar 2020 16:55:15 GMT
Content-Length: 3518
Connection: keep-alive
Timing-Allow-Origin: *
Access-Control-Allow-Credentials: false
Access-Control-Allow-Methods: GET,POST
Access-Control-Allow-Origin: *
Set-Cookie: akacd_widgets_routing=1585155315~rv=78~id=5beac7afd0acb5ec06900d45060066a8; path=/; Expires=Wed, 25 Mar 2020 16:55:15 GMT; Secure; SameSite=None

GET
H/1.1 200
OK eyJpdSI6IjlhOWUwMDAwYjBmMmFjNGNiOTY2NjI1NTczNDhjYjRiMzA1NTNiYTkyZDY3NjM4MTdiZTc4YzAyZDVkZTc0YjMiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/ 3 KB
4 KB 1111ms
35ms Image
image/webp 95.101.186.38
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.outbrainimg.com/transform/v3/eyJpdSI6IjlhOWUwMDAwYjBmMmFjNGNiOTY2NjI1NTczNDhjYjRiMzA1NTNiYTkyZDY3NjM4MTdiZTc4YzAyZDVkZTc0YjMiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.186.38 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a95-101-186-38.deploy.static.akamaitechnologies.com

Software

Resource Hash

ec4f9cb92382a86382d7d8be4447c7c97bcec7e8136cdbf4d88a11b2f64e9e30

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=0; includeSubDomains;
Content-Encoding: gzip
Last-Modified: Sun, 23 Feb 2020 10:14:17 GMT
Date: Wed, 25 Mar 2020 16:55:17 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=1136158
Connection: keep-alive
X-TraceId: 9eef95c49cccfc9c1c368d3f2eff6eb0
Timing-Allow-Origin: *
Content-Length: 3478

GET
H/1.1 200
OK eyJpdSI6ImU5MmNlOTFmZDYwNzY1Mzk5NmYyZWMyM2ZlNjkxOTI1ZTA0YzU0MjJjZjQwZGZkOTZhY2Y4NmUxODc3ZDc0ZjYiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/ 12 KB
12 KB 1111ms
35ms Image
image/webp 95.101.186.38
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.outbrainimg.com/transform/v3/eyJpdSI6ImU5MmNlOTFmZDYwNzY1Mzk5NmYyZWMyM2ZlNjkxOTI1ZTA0YzU0MjJjZjQwZGZkOTZhY2Y4NmUxODc3ZDc0ZjYiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.186.38 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a95-101-186-38.deploy.static.akamaitechnologies.com

Software

Resource Hash

e820c158e61e2d49d32db6151062d7f01fd8f79a1eaacbec311509d584d796e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=0; includeSubDomains;
Content-Encoding: gzip
Last-Modified: Tue, 18 Feb 2020 13:34:18 GMT
Date: Wed, 25 Mar 2020 16:55:17 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=598244
Connection: keep-alive
X-TraceId: eeaf9aa457b1e3ca0d32456d71be884f
Timing-Allow-Origin: *
Content-Length: 11872

GET
H/1.1 200
OK eyJpdSI6IjBmM2Y0MjIyZDljMzU3ZjJjYmFiN2JjNzcwYzViZjAyYzc5NDhkN2U5NWZjOTE4ZDc1NWEwMmI5MzRkZDY0MTgiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/ 12 KB
12 KB 1148ms
36ms Image
image/webp 95.101.186.38
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrainimg.com/transform/v3/eyJpdSI6IjBmM2Y0MjIyZDljMzU3ZjJjYmFiN2JjNzcwYzViZjAyYzc5NDhkN2U5NWZjOTE4ZDc1NWEwMmI5MzRkZDY0MTgiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.186.38 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-186-38.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: dd02f59e7c35e2164392b968738edf79b7ef3f2ea81879942e50789baa41026a

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Wed, 25 Mar 2020 16:55:17 GMT
Content-Encoding: gzip
Last-Modified: Mon, 09 Mar 2020 12:16:54 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=1255643
Connection: keep-alive
X-TraceId: 7ef21ce8cd53fc623ff124696c889f63
Timing-Allow-Origin: *
Content-Length: 12144

GET
H/1.1 200
OK eyJpdSI6IjEzNDQwZGFlMzg5MTEyMTY1NTkzZWY2NzFmMzc5ZmY1ZmFlNDE2MmQ3OTUzZGFiNmNiYWQyMTc1ZmE3Mjg5Y2QiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/ 6 KB
6 KB 1150ms
38ms Image
image/webp 95.101.186.38
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.outbrainimg.com/transform/v3/eyJpdSI6IjEzNDQwZGFlMzg5MTEyMTY1NTkzZWY2NzFmMzc5ZmY1ZmFlNDE2MmQ3OTUzZGFiNmNiYWQyMTc1ZmE3Mjg5Y2QiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.186.38 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a95-101-186-38.deploy.static.akamaitechnologies.com

Software

Resource Hash

b76cf3219c684e87a2e9bd78f75467d0b9f89dd9becfcf9d0f2ff1a47f3fb795

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=0; includeSubDomains;
Content-Encoding: gzip
Last-Modified: Thu, 20 Feb 2020 22:21:28 GMT
Date: Wed, 25 Mar 2020 16:55:17 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=1078476
Connection: keep-alive
X-TraceId: cdb805d8567601f38565d0bb7b1b49c8
Timing-Allow-Origin: *
Content-Length: 5950

GET
H/1.1 200
OK eyJpdSI6ImRkYTkyYTMyODIzODRmZGM5OThmOTgxMjk5YWM3NjM1MGFjY2MwN2MwZDcxNmVkMGE2MDc1NmViMzljMGY0OTMiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/ 10 KB
10 KB 1187ms
39ms Image
image/webp 95.101.186.38
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.outbrainimg.com/transform/v3/eyJpdSI6ImRkYTkyYTMyODIzODRmZGM5OThmOTgxMjk5YWM3NjM1MGFjY2MwN2MwZDcxNmVkMGE2MDc1NmViMzljMGY0OTMiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.186.38 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a95-101-186-38.deploy.static.akamaitechnologies.com

Software

Resource Hash

b2dc46e53b06954bd2df39c8b2a78f75e4589aad0086c7b9cf42e53ec097baeb

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=0; includeSubDomains;
Content-Encoding: gzip
Last-Modified: Thu, 19 Mar 2020 13:46:31 GMT
Date: Wed, 25 Mar 2020 16:55:17 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=2214205
Connection: keep-alive
X-TraceId: 4da47c370537b30391d4ca51007a4064
Timing-Allow-Origin: *
Content-Length: 9914

GET
H/1.1 200
OK eyJpdSI6IjBmZThhNWI2ZjEzZDgwN2I3NDExODhlNmEwYzVlMDU3YmMzNWY2MDJhNjQwNTA2ZWQyYjc1YzU5NzZlMDQzNDkiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/ 8 KB
8 KB 1188ms
38ms Image
image/webp 95.101.186.38
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.outbrainimg.com/transform/v3/eyJpdSI6IjBmZThhNWI2ZjEzZDgwN2I3NDExODhlNmEwYzVlMDU3YmMzNWY2MDJhNjQwNTA2ZWQyYjc1YzU5NzZlMDQzNDkiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.186.38 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a95-101-186-38.deploy.static.akamaitechnologies.com

Software

Resource Hash

d864616d46389ea4c823da0b356a8d7ab36f38133de303ec8adb884a1f76981a

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Strict-Transport-Security: max-age=0; includeSubDomains;
Content-Encoding: gzip
Last-Modified: Sun, 09 Feb 2020 11:38:35 GMT
Date: Wed, 25 Mar 2020 16:55:17 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=545869
Connection: keep-alive
X-TraceId: 300cc9aec87d3fc1a4abfaa876d0d049
Timing-Allow-Origin: *
Content-Length: 8102

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 4F33 0
0 47ms
46ms Fetch
image/gif 172.217.22.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsth8_MZvK8NCHLCLqUR4S4ZqpMSO5Ohd34SiYeumR-uJ4aU24JOlOqtQvLsrPFBt33tA2uUK22sWMLRl8XAK_vZsMbqIk6pRea7QeGDbLZtukUsXON6TxgwXHQ56jpSVCye32h3AoH1zRCQdIZByzcMNcbM09zGRpSUVudix-eCwbwsaib7Vg9K8iRTTnpnSCXjNPs1VGPz8PfJbZnydBBVUVg2xsqr1lxXKAYPGhDSqJPoH7VhuWWqIA3RyNCbM-e3p9SHru2mI7CwOiiGcOp01f72T_vATApLTLpUDmZUS0-33g&sai=AMfl-YS6URutPAwG9xrRreK7ngtwRZiEaM_cQXOwgJ4od6t8Jrz64L57GDVyHiD_KDvoHgekg8vHX3bLUh1sJh6U1Gn-Gj4FDAwxnB6h-qbI&sig=Cg0ArKJSzBxAv0ht2BWUEAE&urlfix=1&adurl=

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s18-in-f98.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Wed, 25 Mar 2020 16:55:16 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:16 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame 4F33 43 KB
14 KB 45ms
43ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032401.js?21065778

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2ad6f11aca9703e03bfe4c7bfc653ed76c80da9ead9eb8fbd4c4f883e967caba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "466 / 426 of 1000 / last-modified: 1585081309"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 14458
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:16 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4F33 74 KB
28 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032401.js?21065778

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a1b118736ba9dc41f144f350574bec748a1ba0e8b355a99cbfe570ad236b50e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1584962844677376"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28201
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:16 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/condenastdfp9588492144/ Frame 4F33 305 KB
102 KB 36ms
35ms Script
application/x-javascript 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/condenastdfp9588492144/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032401.js?21065778
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: e3a3887bf312677ec43a4bdbc7ba772304f62a1f55573e6c55372f1757cb7f42

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
last-modified: Thu, 20 Feb 2020 16:26:37 GMT
server: AmazonS3
x-amz-request-id: E900255BB404E6B3
etag: "2c762a4ad391b25a73e9e0b5e560bfbf"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=45379
accept-ranges: bytes
content-length: 104203
x-amz-id-2: fTFMlX4oxgS0IRYo7c44ll02v0Hl8SxbpBFjLogMv8UmrBC2cLIp8SU18/NX1dpttUO4UCoVkaI=

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 74 KB
27 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032401.js?21065778

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

351e508c1da4f9d1535747086accb41121466a52044aa868eba4a36009fdb101

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1584962844677376"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 27941
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:16 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 35ms
35ms Image
image/gif 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=43&t=1585155314422&de=368100489506&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=29bb202-clean&iw=81ef8f7&zMoatDfpSlotId=post_nav_0&zMoatRendered=3&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=3&zMoatPageDataTargetingSet=3&zMoatSafetyTargetingSet=3&zMoatEmptySlot=2&zMoatNadoDataLoadTime=242&zMoatAllDataLoadTime=242&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations&ac=1&bq=11&f=0&zn=0&if=242&na=1142214043&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:16 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 25 Mar 2020 16:55:16 GMT

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 101ms
101ms Image
image/gif 52.202.152.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2020-03-25T16%3A55%3A16.067Z&_t=slot_rendered&cBr=Ars%20Technica&cKe=hacking%7Cmalware%7Cmiddle%20east&cCh=information%20technology&cTi=Never-before-seen%20attackers%20are%20targeting%20Mideast%20industrial%20organizations&cTy=article%7Creport&cTp=ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192&cTpw=0.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495&cEnt=malware%2C%20milum%2C%20kaspersky%20lab%2C%20page%20layout%2C%20middle%20east%2C%20iran%2C%20dan%20goodin%2C%20mideast%2C%20vpn%2C%20utc%2C%20json%2C%20middle%20eastern%2C%2064-bit%2C%20cond%C3%A9%20nast%2C%20denis%20legezo%2C%20ars%20orbital%20transmission%2C%20c%2B%2B%2C%20us%2C%20saudi%20arabian%2C%20ars%20technica%20addendum&cEnw=1%2C%200.6906379545219714%2C%200.6877128322284288%2C%200.6615894629690477%2C%200.5946571427809644%2C%200.4921362430533071%2C%200.4103889677627687%2C%200.4041333983659949%2C%200.3913882334036157%2C%200.38007900317315924%2C%200.37162764148642624%2C%200.3565682437182297%2C%200.3426552132063025%2C%200.33462725081747424%2C%200.30206502850039274%2C%200.2997686267310179%2C%200.2902701446479252%2C%200.2751866283263286%2C%200.26480398171397435%2C%200.2530766852930854&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=881&cId=1663038&cPd=2020-03-25T10%3A45%3A24.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations&pRt=referral&pHp=%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pWw=1600&pWh=1200&pPw=1600&pPh=4900&pSw=1600&pSh=1200&uID=07843961-f9a3-463c-83e3-3b7508dd8927&sID=07ad7b93-856c-42c4-8a7b-dcde40374913&pID=62940348-df41-46b8-9c0c-5f1dbd727e94&uDt=desktop&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.32.6%22%7D&_o=ars-technica&_c=cns_ads&xID=2ab080d4-e824-4f62-a70e-67d18c7e7eb4&dim2=%7B%22adUnitPath%22%3A%223379%2Fconde.ars%2Fhero%2Finformation-technology%2Farticle%2F1%22%2C%22advertiserId%22%3A4592559319%2C%22campaignId%22%3A2345665434%2C%22creativeId%22%3A138250144973%2C%22elementId%22%3A%22post_nav_0%22%2C%22instance%22%3A%220%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Afalse%2C%22isFirstRequested%22%3Afalse%2C%22isFirstMoneyRequested%22%3Atrue%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22hacking%22%2C%22malware%22%2C%22middle-east%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3A4860183109%2C%22name%22%3A%22post_nav_0%22%2C%22outOfPage%22%3Afalse%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%22728x90%22%2C%22slug%22%3A%22never-before-seen-attackers-are-targeting-mideast-industrial-organizations%22%7D&dim3=%7B%22footerStart%22%3A1585155314114%2C%22headerStart%22%3A1585155314091%2C%22navigationStart%22%3A1585155313458%2C%22injected%22%3A1585155316067%2C%22viewable%22%3A%22%22%2C%22viewport%22%3A%22%22%2C%22impression%22%3A%22%22%7D&dim4=%7B%22pos%22%3A%5B%22hero%22%5D%2C%22ctx_slot_type%22%3A%5B%22post_nav%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22amznbid%22%3A%5B%222%22%5D%2C%22amznp%22%3A%5B%222%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_instance%22%3A%5B%220%22%5D%2C%22ctx_slot_name%22%3A%5B%22post_nav_0%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.32.6%22%5D%2C%22ctx_page_slug%22%3A%5B%22never-before-seen-attackers-are-targeting-mideast-industrial-organizations%22%5D%2C%22cnt_tags%22%3A%5B%22hacking%22%2C%22malware%22%2C%22middle-east%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_sg%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%2C%22vnd_prx_segments%22%3A%5B%22300003%22%2C%22121100%22%2C%22131100%22%2C%22112200%22%2C%22210000%22%2C%22210012%22%2C%22240000%22%2C%22240002%22%2C%22240003%22%2C%22240004%22%2C%22240001%22%2C%22240005%22%2C%22240006%22%2C%22240007%22%2C%22240008%22%2C%22240009%22%2C%22240011%22%2C%22240012%22%2C%22240013%22%2C%22240014%22%2C%22240017%22%2C%22240015%22%2C%22240016%22%2C%22qx7745%22%2C%22xm1ai0%22%2C%22wmhp4i%22%2C%22euwba9%22%2C%22dcxr0c%22%2C%222hkgm5%22%2C%22ap05we%22%2C%22fdf1wd%22%2C%22v8lc56%22%2C%2265f9pd%22%2C%22uas8ja%22%2C%22_FnZJCTv8E0_%22%5D%7D&environment=prod&origin=ars-technica&cKh=malware%2Corganization%2Cnever-before-seen%20attacker%2Cresearcher%2Cmilum%2Ckaspersky%20lab%2Cpage%20layout%2Cwildpressure
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.202.152.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-202-152-193.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 16:55:16 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 1C97 0
0 47ms
44ms Fetch
image/gif 172.217.22.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuS593dwvgo24QZ2YPiSd3dT-idlz-UCYfNyBhLPV6A3y8pfpCgn14ifSTlgmTZE-l3ZRNBJVFnbrCWS-J-7pEPtoUw2x9CXnIa5j01LbVDlOZGMkoWo2kU3TxZRNZCOAjM6a-OE7z2rBuGfA58cRmxJPfaFnAKZxLiudathplrw2tN7gfuyzLaS-L3xLTbodDTXuwAWqSj9AnBcv9xhp5Cupe3C7PrPSd7J92YkSbii3711S22K9fJidlQMnOJ0RB8ST8UN0bQT_s1pZHaupC1SpBqVWrFKWpV5H9mIP03Wi6MvQ&sai=AMfl-YS4Hjka2lLh7aB5Dm9D-vLfQfKTPZopRkG2AGL8uCbi9MLHCYHuuZTzGLXRzgzdbOwApT-i5He2fh1Fmxf5-lKXls20a-lSHZ5iZ399Gw&sig=Cg0ArKJSzI3pNjHTdGtuEAE&urlfix=1&adurl=

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s18-in-f98.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Wed, 25 Mar 2020 16:55:16 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame 1C97 43 KB
14 KB 41ms
39ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032401.js?21065778

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

db6b20027165ee0ce424e1861b94c3b08135d048b40507808e3fb2a9bb14ca70

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "466 / 17 of 1000 / last-modified: 1585081309"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 14452
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:16 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1C97 74 KB
28 KB 42ms
40ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032401.js?21065778

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

78fafec67c64709fd61d0007d64363ec0a489ede573435a04f94c6c113dd59b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1585136320457028"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28257
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:16 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/condenastdfp9588492144/ Frame 1C97 305 KB
102 KB 36ms
34ms Script
application/x-javascript 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/condenastdfp9588492144/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032401.js?21065778
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: e3a3887bf312677ec43a4bdbc7ba772304f62a1f55573e6c55372f1757cb7f42

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
last-modified: Thu, 20 Feb 2020 16:26:37 GMT
server: AmazonS3
x-amz-request-id: E900255BB404E6B3
etag: "2c762a4ad391b25a73e9e0b5e560bfbf"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=45379
accept-ranges: bytes
content-length: 104203
x-amz-id-2: fTFMlX4oxgS0IRYo7c44ll02v0Hl8SxbpBFjLogMv8UmrBC2cLIp8SU18/NX1dpttUO4UCoVkaI=

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 103ms
102ms Image
image/gif 52.202.152.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2020-03-25T16%3A55%3A16.117Z&_t=slot_rendered&cBr=Ars%20Technica&cKe=hacking%7Cmalware%7Cmiddle%20east&cCh=information%20technology&cTi=Never-before-seen%20attackers%20are%20targeting%20Mideast%20industrial%20organizations&cTy=article%7Creport&cTp=ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192&cTpw=0.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495&cEnt=malware%2C%20milum%2C%20kaspersky%20lab%2C%20page%20layout%2C%20middle%20east%2C%20iran%2C%20dan%20goodin%2C%20mideast%2C%20vpn%2C%20utc%2C%20json%2C%20middle%20eastern%2C%2064-bit%2C%20cond%C3%A9%20nast%2C%20denis%20legezo%2C%20ars%20orbital%20transmission%2C%20c%2B%2B%2C%20us%2C%20saudi%20arabian%2C%20ars%20technica%20addendum&cEnw=1%2C%200.6906379545219714%2C%200.6877128322284288%2C%200.6615894629690477%2C%200.5946571427809644%2C%200.4921362430533071%2C%200.4103889677627687%2C%200.4041333983659949%2C%200.3913882334036157%2C%200.38007900317315924%2C%200.37162764148642624%2C%200.3565682437182297%2C%200.3426552132063025%2C%200.33462725081747424%2C%200.30206502850039274%2C%200.2997686267310179%2C%200.2902701446479252%2C%200.2751866283263286%2C%200.26480398171397435%2C%200.2530766852930854&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=881&cId=1663038&cPd=2020-03-25T10%3A45%3A24.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations&pRt=referral&pHp=%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pWw=1600&pWh=1200&pPw=1600&pPh=4900&pSw=1600&pSh=1200&uID=07843961-f9a3-463c-83e3-3b7508dd8927&sID=07ad7b93-856c-42c4-8a7b-dcde40374913&pID=62940348-df41-46b8-9c0c-5f1dbd727e94&uDt=desktop&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.32.6%22%7D&_o=ars-technica&_c=cns_ads&xID=2ab080d4-e824-4f62-a70e-67d18c7e7eb4&dim2=%7B%22adUnitPath%22%3A%223379%2Fconde.ars%2Frail%2Finformation-technology%2Farticle%2F1%22%2C%22advertiserId%22%3A4592559319%2C%22campaignId%22%3A2345665434%2C%22creativeId%22%3A138250089663%2C%22elementId%22%3A%22siderail_0%22%2C%22instance%22%3A%220%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Afalse%2C%22isFirstRequested%22%3Afalse%2C%22isFirstMoneyRequested%22%3Afalse%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22hacking%22%2C%22malware%22%2C%22middle-east%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3A4860183109%2C%22name%22%3A%22siderail_0%22%2C%22outOfPage%22%3Afalse%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%22300x600%22%2C%22slug%22%3A%22never-before-seen-attackers-are-targeting-mideast-industrial-organizations%22%7D&dim3=%7B%22footerStart%22%3A1585155314114%2C%22headerStart%22%3A1585155314091%2C%22navigationStart%22%3A1585155313458%2C%22injected%22%3A1585155316116%2C%22viewable%22%3A%22%22%2C%22viewport%22%3A%22%22%2C%22impression%22%3A%22%22%7D&dim4=%7B%22pos%22%3A%5B%22rail%22%5D%2C%22ctx_slot_type%22%3A%5B%22siderail%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22amznbid%22%3A%5B%222%22%5D%2C%22amznp%22%3A%5B%222%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_instance%22%3A%5B%220%22%5D%2C%22ctx_slot_name%22%3A%5B%22siderail_0%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.32.6%22%5D%2C%22ctx_page_slug%22%3A%5B%22never-before-seen-attackers-are-targeting-mideast-industrial-organizations%22%5D%2C%22cnt_tags%22%3A%5B%22hacking%22%2C%22malware%22%2C%22middle-east%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_sg%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%2C%22vnd_prx_segments%22%3A%5B%22300003%22%2C%22121100%22%2C%22131100%22%2C%22112200%22%2C%22210000%22%2C%22210012%22%2C%22240000%22%2C%22240002%22%2C%22240003%22%2C%22240004%22%2C%22240001%22%2C%22240005%22%2C%22240006%22%2C%22240007%22%2C%22240008%22%2C%22240009%22%2C%22240011%22%2C%22240012%22%2C%22240013%22%2C%22240014%22%2C%22240017%22%2C%22240015%22%2C%22240016%22%2C%22qx7745%22%2C%22xm1ai0%22%2C%22wmhp4i%22%2C%22euwba9%22%2C%22dcxr0c%22%2C%222hkgm5%22%2C%22ap05we%22%2C%22fdf1wd%22%2C%22v8lc56%22%2C%2265f9pd%22%2C%22uas8ja%22%2C%22_FnZJCTv8E0_%22%5D%7D&environment=prod&origin=ars-technica&cKh=malware%2Corganization%2Cnever-before-seen%20attacker%2Cresearcher%2Cmilum%2Ckaspersky%20lab%2Cpage%20layout%2Cwildpressure
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.202.152.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-202-152-193.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 16:55:16 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H2 200 pubads_impl_2020030501.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 4F33 165 KB
60 KB 67ms
67ms Script
text/javascript 172.217.22.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s18-in-f98.1e100.net

Software

sffe /

Resource Hash

8ee04e0441c9e51785d17ac835a93cf4d30d90826f87350b42ba233496a26f55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 05 Mar 2020 14:08:10 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 61481
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:16 GMT

GET
H2 200 integrator.sync.js Show response
adservice.google.de/adsid/ Frame 4F33 113 B
178 B 14ms
14ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.sync.js?domain=arstechnica.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 108
x-xss-protection: 0

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 35ms
35ms Image
image/gif 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=43&t=1585155314422&de=368100489506&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=29bb202-clean&iw=81ef8f7&zMoatDfpSlotId=siderail_0&zMoatRendered=4&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=4&zMoatPageDataTargetingSet=4&zMoatSafetyTargetingSet=4&zMoatEmptySlot=2&zMoatNadoDataLoadTime=242&zMoatAllDataLoadTime=242&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations&ac=1&bq=11&f=0&zn=0&if=242&na=1310068760&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:16 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 25 Mar 2020 16:55:16 GMT

GET
H2 200 pubads_impl_2020030501.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 1C97 165 KB
60 KB 68ms
68ms Script
text/javascript 172.217.22.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s18-in-f98.1e100.net

Software

sffe /

Resource Hash

8ee04e0441c9e51785d17ac835a93cf4d30d90826f87350b42ba233496a26f55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 05 Mar 2020 14:08:10 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 61481
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:16 GMT

GET
H2 200 integrator.sync.js Show response
adservice.google.de/adsid/ Frame 1C97 113 B
175 B 15ms
14ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.sync.js?domain=arstechnica.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 108
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 4F33 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a53dc5e7e71ca30d94076f99d34bc1dc6cf4eccf57440434aeb53a0911d4529d

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 4F33 5 KB
2 KB 215ms
215ms XHR
text/plain 172.217.22.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4300961073496582&correlator=2681288377523821&output=ldjh&impl=fif&adsid=NT&vrg=2020030501&npa=1&guci=1.2.0.0.2.1.0.0&sc=1&sfv=1-0-37&ecs=20200325&iu_parts=5574%2Cuk.n5574.arstechnica%2Cministryofinnovation&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90&eri=2&cookie=ID%3D959fd193d79c45dd%3AT%3D1585155315%3AS%3DALNI_MaoQYvU3KNT8lqDfEBwI6wxjSUsTg&cdm=arstechnica.com&bc=31&abxe=1&lmt=1585155316&dt=1585155316300&dlt=1585155316060&idt=165&ea=0&frm=23&biw=1585&bih=1200&isw=728&ish=90&oid=3&adxs=429&adys=80&adks=4064914268&ucis=9qza09qs1v6&ifi=1&ifk=2488954129&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&top=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&dssz=11&icsg=680&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&ga_vid=505617916.1585155315&ga_sid=1585155316&ga_hid=547878891&fws=256&ohw=0&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s18-in-f98.1e100.net

Software

cafe /

Resource Hash

a57b99c9f7d81a6e987239b680250118df12a579bb65dbbd232ba07db027ece3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 2328
x-xss-protection: 0
google-lineitem-id: 708987677
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 68228449037
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2020030501.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 4F33 69 KB
25 KB 67ms
67ms Script
text/javascript 172.217.22.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s18-in-f98.1e100.net

Software

sffe /

Resource Hash

ffdc18ac8f47bcd50dd9c33532c334e7073717a62b367d95b9cb1561048547dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 05 Mar 2020 14:08:10 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 25689
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:16 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame 4F33 0
0 6ms
6ms Other
text/html 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html?n=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

GET
DATA 200
OK truncated
/ Frame 1C97 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0da0d6827b35c3a92fbd91f3f688ab2ec974bd3249cf113723a5959cd4b84f3f

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 1C97 5 KB
2 KB 453ms
452ms XHR
text/plain 172.217.22.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3925120758455070&correlator=3592945064511462&output=ldjh&impl=fif&adsid=NT&eid=21064712%2C21065402&vrg=2020030501&npa=1&guci=1.2.0.0.2.1.0.0&sc=1&sfv=1-0-37&ecs=20200325&iu_parts=5574%2Cuk.n5574.arstechnica%2Cministryofinnovation&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x600&eri=2&cookie=ID%3D959fd193d79c45dd%3AT%3D1585155315%3AS%3DALNI_MaoQYvU3KNT8lqDfEBwI6wxjSUsTg&cdm=arstechnica.com&bc=31&abxe=1&lmt=1585155316&dt=1585155316355&dlt=1585155316111&idt=203&ea=0&frm=23&biw=1585&bih=1200&isw=300&ish=600&oid=3&adxs=1063&adys=370&adks=3739225199&ucis=fxnv74u4m1s8&ifi=1&ifk=2789653642&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&top=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&dssz=11&icsg=680&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&ga_vid=505617916.1585155315&ga_sid=1585155316&ga_hid=1258719642&fws=256&ohw=0&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s18-in-f98.1e100.net

Software

cafe /

Resource Hash

28b5a75f7339ffebacdb4e85a3b2d68166f71545bee3a7f24492d1756cc08f7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 2331
x-xss-protection: 0
google-lineitem-id: 708987677
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 68228340437
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2020030501.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 1C97 69 KB
25 KB 66ms
66ms Script
text/javascript 172.217.22.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s18-in-f98.1e100.net

Software

sffe /

Resource Hash

ffdc18ac8f47bcd50dd9c33532c334e7073717a62b367d95b9cb1561048547dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 05 Mar 2020 14:08:10 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 25689
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:16 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame 1C97 0
0 6ms
6ms Other
text/html 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html?n=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 0934 0
0 46ms
46ms Fetch
image/gif 172.217.22.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvaPGVXPOfahTRCNuKAoB3UaM9o8_9U4wNiPqRbNvzKNlqQnnU6s3EorN5Kq5qidsLYZrf4wJBP6iQrihiiEowvAYOq1zr0w2goLpGK4xX3aJHYv-CaTXpUKHWeF0gTf0dpyCH_XlKqKGCo8xnyEg8D_xF5j1Z4bRZPaxJBaiVrNYb-44jWjzIz47_vqWGrIpZGaUfovwIjR_i09S4bxAISLkwT62N6G48JW3sxotUQq5rbjm2lzzP74GG9cpeQ1Rsq828WPBvmidVGSSIG9l4MKhEKS5g3-QyCmEU6olY&sig=Cg0ArKJSzObN6-IFfZO1EAE&urlfix=1&adurl=

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s18-in-f98.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Wed, 25 Mar 2020 16:55:16 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK 11644.js Show response
ads.rubiconproject.com/ad/ Frame 0934 30 KB
9 KB 116ms
41ms Script
text/javascript 23.37.55.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.rubiconproject.com/ad/11644.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache / PHP/5.3.3
Resource Hash: b63bb3d84f8bf08742cf309b75b685518d32ab906d540273559bd73b33266458

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 16:55:16 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=10896
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 8853
Expires: Wed, 25 Mar 2020 19:56:52 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0934 74 KB
28 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a1b118736ba9dc41f144f350574bec748a1ba0e8b355a99cbfe570ad236b50e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1584962844677376"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28201
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:16 GMT

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4F33 74 KB
27 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

351e508c1da4f9d1535747086accb41121466a52044aa868eba4a36009fdb101

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1584962844677376"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 27941
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:16 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 4F33 7 KB
6 KB 30ms
18ms XHR
application/json 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020030501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7c1af4a5acd27fde0f79efb70db17ab2a76fc48884901cab4540e644606a5200

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5214
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 4F33 14 KB
5 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5456
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:16 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 7FE0 0
0 6ms
6ms Document
text/html 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Wed, 25 Mar 2020 16:40:47 GMT
expires: Thu, 25 Mar 2021 16:40:47 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 869
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000

GET
H/1.1 200
OK 288724-2.js Show response
optimized-by.rubiconproject.com/a/11644/60522/ Frame 0934 146 B
534 B 167ms
44ms Script
text/javascript 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://optimized-by.rubiconproject.com/a/11644/60522/288724-2.js?&gdpr=1&gdpr_consent=BOw04GOOw04GOAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA&cb=0.6273089867654933&tk_st=1&rf=https%3A//arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=60522_2&rp_secure=1
Requested by: Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/11644.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: f6914cddfb8fcc3e7d99864e104ebdb47934a357ef08d90f9e0acdf48433d6c9

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: no-cache
Date: Wed, 25 Mar 2020 16:55:16 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: Keep-Alive
Content-Type: text/javascript
Keep-Alive: timeout=5, max=321
Content-Length: 146
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4F33 0
219 B 14ms
14ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020030501&jk=4300961073496582&bg=!RUalRl5YIdQAi4wJywYCAAAASlIAAAALmQFhBAmpv44uAZS8XnaDm9Wjqnq-ZmhflwJjkaA8BELeLe4eMMRgLi-eVMHDUmrqgM4nNaxeJM1LGclydIRGL_veQaJpfEQiRQsI0d_ytguelLTn8TFKS1TyY5ddqF8yp2OyDouBz_x-7l9LDkp9PGKhw8fvwHq8sq2xKrI-4vcWQWVVft8s2FblmiDS2MqGL4n9Q-UFxpCBY6Rvcn6asAkmuAH_ZWrdm1vHe_Z2I4NBoYs9bC-pCzHTrHolljpgQOfdauy_63VjTGvJKTGK2c_ZsuLw5H3uqWgLrRz-phZn44SB3Xq5ryPSV6wqEL2oHMl0fWzDz4CLh-_KczkwnJFLipYFjEr6h0AXOk5x8hwjt_8VRVpehhxyOHwQ0Twk2Z_fd9xkcg3Tcx87SAHYEMHcq5lh5iWiaFSQto7Xzx1Er5kA5toTOJF0Yp6U7yGIHu99ZV_pf9r4nSQbgyqqKISwIJQ

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:16 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame A354 0
0 44ms
43ms Fetch
image/gif 172.217.22.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvh_MI_6-eo19s9o8gRqRLex1GEAQvRO-H_xUO_FnR7IyTaSOHjO4-IQJvVuaImaUhYfmn5mLIdtobA1Ay_2KQqHGXz4OTwyAnDLGOx9o7MAws4xutXOYAalxuWOupzKiWf87j9g4BSjQJ_nMwLOz-Pdtt82B6EtpACzmVXUf2eWbGi2rdJnSby2vdh7ozH-GSZtmJFGY5GD2f6Fary_8G2P32nNxzIS1GVdIfkHWjK778Pqbzv3R9OZM92wlZYr9TBkji3lxeVwxK6qx0ubNpebpP_TVhzb6CH5_Vp7TM&sig=Cg0ArKJSzAU_ZRdrgOUhEAE&urlfix=1&adurl=

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s18-in-f98.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Wed, 25 Mar 2020 16:55:16 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK 11644.js Show response
ads.rubiconproject.com/ad/ Frame A354 30 KB
9 KB 40ms
39ms Script
text/javascript 23.37.55.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.rubiconproject.com/ad/11644.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache / PHP/5.3.3
Resource Hash: b63bb3d84f8bf08742cf309b75b685518d32ab906d540273559bd73b33266458

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 25 Mar 2020 16:55:16 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=10896
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 8853
Expires: Wed, 25 Mar 2020 19:56:52 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame A354 74 KB
28 KB 45ms
44ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a1b118736ba9dc41f144f350574bec748a1ba0e8b355a99cbfe570ad236b50e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1584962844677376"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28201
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:16 GMT

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1C97 74 KB
27 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

351e508c1da4f9d1535747086accb41121466a52044aa868eba4a36009fdb101

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1584962844677376"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 27941
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:16 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 1C97 7 KB
5 KB 17ms
17ms XHR
application/json 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020030501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d196f488c9d906c6c12f43bb514a659cc0b9e0ef586f072645eb47313529a65c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5110
x-xss-protection: 0

GET
H/1.1 200
OK 1x1.png
secure-assets.rubiconproject.com/static/psa/blank/ Frame 0934 156 B
484 B 110ms
37ms Image
image/png 23.37.55.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-assets.rubiconproject.com/static/psa/blank/1x1.png
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 58a617d2c88d378bfd267e2817e2228e82ef0c3f28d8ac3458b18af77335c39e

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Wed, 25 Mar 2020 16:55:16 GMT
Content-Encoding: gzip
Last-Modified: Tue, 01 Oct 2019 16:53:58 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 155

GET
DATA 200
OK truncated
/ Frame 0934 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ Frame 0934 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f70b407b853dd729ed56f834640435a56e2a7d69fb0ea6342edeccc2a82f51be

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 moatad.js Show response
z.moatads.com/arstechnicaukdfp314402068565/ Frame 0934 277 KB
94 KB 37ms
37ms Script
application/x-javascript 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/arstechnicaukdfp314402068565/moatad.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 4bf5b1275a106cdf837f2053be09f6fa57d473bb7ca029f456c7a31ffa0c19ac

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
last-modified: Thu, 20 Feb 2020 16:25:40 GMT
server: AmazonS3
x-amz-request-id: E610DFE6FD2035D2
etag: "e85e3caa445d84c671fe3f1b4edb6d33"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=52755
accept-ranges: bytes
content-length: 95781
x-amz-id-2: decniN7RUswFK3j77Dm/CY5pq30khuF0g0Lbs8pvEhO1DaUziB9xGLkSaXAx0OQ4U26mp4LE5Os=

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 1C97 14 KB
5 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5456
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:16 GMT

GET
H/1.1 200
OK 288724-10.js Show response
optimized-by.rubiconproject.com/a/11644/60522/ Frame A354 147 B
535 B 53ms
51ms Script
text/javascript 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://optimized-by.rubiconproject.com/a/11644/60522/288724-10.js?&gdpr=1&gdpr_consent=BOw04GROw04GRAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA&cb=0.2717113577166399&tk_st=1&rf=https%3A//arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=60522_10&rp_secure=1
Requested by: Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/11644.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 83ea4cc1abe0489b72d792344ff8e08c2749d8bd6933a61ab0bdbd7e07c447ca

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: no-cache
Date: Wed, 25 Mar 2020 16:55:16 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: Keep-Alive
Content-Type: text/javascript
Keep-Alive: timeout=5, max=269
Content-Length: 147
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame D78C 0
0 9ms
8ms Document
text/html 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Wed, 25 Mar 2020 16:40:47 GMT
expires: Thu, 25 Mar 2021 16:40:47 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 869
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 35ms
35ms Image
image/gif 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=ARSTECHNICA1&hp=1&wf=1&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1585155316986&de=302387679150&m=0&ar=b63606d9a9-clean&iw=f7ab499&q=9&cb=0&ym=0&cu=1585155316986&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=37412957%3A225649757%3A708987677%3A68228449037&gu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&id=1&bo=99440717&bd=99519557&gw=arstechnicaukdfp314402068565&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A686%3A686%3A0%3A909&fs=177454&na=1323584790&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:17 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 25 Mar 2020 16:55:17 GMT

GET
H/1.1 200
OK 1x1.png
secure-assets.rubiconproject.com/static/psa/blank/ Frame A354 156 B
484 B 39ms
38ms Image
image/png 23.37.55.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-assets.rubiconproject.com/static/psa/blank/1x1.png
Requested by: Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/11644/60522/288724-10.js?&gdpr=1&gdpr_consent=BOw04GROw04GRAcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA&cb=0.2717113577166399&tk_st=1&rf=https%3A//arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=60522_10&rp_secure=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 58a617d2c88d378bfd267e2817e2228e82ef0c3f28d8ac3458b18af77335c39e

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Wed, 25 Mar 2020 16:55:17 GMT
Content-Encoding: gzip
Last-Modified: Tue, 01 Oct 2019 16:53:58 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 155

GET
DATA 200
OK truncated
/ Frame A354 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ Frame A354 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 351983692b8afc693537c1bc9cb395e8f2598ac80b12ae965ac1b6c49827ef73

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 moatad.js Show response
z.moatads.com/arstechnicaukdfp314402068565/ Frame A354 277 KB
94 KB 35ms
35ms Script
application/x-javascript 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/arstechnicaukdfp314402068565/moatad.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 4bf5b1275a106cdf837f2053be09f6fa57d473bb7ca029f456c7a31ffa0c19ac

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:17 GMT
content-encoding: gzip
last-modified: Thu, 20 Feb 2020 16:25:40 GMT
server: AmazonS3
x-amz-request-id: E610DFE6FD2035D2
etag: "e85e3caa445d84c671fe3f1b4edb6d33"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=52754
accept-ranges: bytes
content-length: 95781
x-amz-id-2: decniN7RUswFK3j77Dm/CY5pq30khuF0g0Lbs8pvEhO1DaUziB9xGLkSaXAx0OQ4U26mp4LE5Os=

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 35ms
35ms Image
image/gif 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=ARSTECHNICA1&hp=1&wf=1&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1585155317065&de=634258109663&m=0&ar=b63606d9a9-clean&iw=f7ab499&q=12&cb=0&ym=0&cu=1585155317065&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=37412957%3A225649757%3A708987677%3A68228340437&gu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&id=1&bo=99440717&bd=99519557&gw=arstechnicaukdfp314402068565&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A686%3A686%3A0%3A909&fs=177454&na=1461156900&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:17 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 25 Mar 2020 16:55:17 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1C97 0
58 B 42ms
41ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020030501&jk=3925120758455070&bg=!9vWl9e1YNAVbFxSbIzICAAAAP1IAAAALmQFhVcJ35jmCRRF8muQXEcPneuaDZ21x64LZHyWx7vH-qUn90_eJMJc5pGIzzhxR3BO8qeZKhm1T0r1TQyuttbNZTyq6Zmn39P4NyD1iqZixtg-BbfVyI7CaiCYu5bdxpnbQ_SaegzgPsaWKzAOiAtPVdmsznor35QzHd7ak58hDvG3kEyeur64f-f3fSJ-q_vEcRfn7meuAPBgNUV3oZpfORrTVS6FwQb_iXNvOEAlNlTLAlRYVuC6YR3tqhRFFsw2gp-NeNltEtuYjYnuzAJkk7tGT9e48YnSWFuNDVJM31z5jmMdqHZq58gn_Bo0i6H_Chv7UIS5ySwHujwhI9RRDXtrIQJn8tSlyzJi8KXWmZs3XvQgWneXYnCAUwD0iZWwgQCaNUdszi0Db9U_bzdB82IlImas5dN46hmjCshW8SOsYlaf3N8C1c4fSJrJp-2Xowh-iHjKSwNKjd9PUIoOw7QI

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:17 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 7 KB
5 KB 18ms
18ms XHR
application/json 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020032401&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032401.js?21065778

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7d43b579d6c5211f4bd6a78cd2b7cd726cc226307eab8f37aede3a55ebb3150e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 25 Mar 2020 16:55:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5159
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 14 KB
5 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032401.js?21065778

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5456
x-xss-protection: 0
expires: Wed, 25 Mar 2020 16:55:17 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 1559 0
0 6ms
6ms Document
text/html 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Wed, 25 Mar 2020 16:40:47 GMT
expires: Thu, 25 Mar 2021 16:40:47 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 870
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
58 B 39ms
39ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020032401&jk=909767448522644&bg=!Li2lLTVYjakZaE3bmdgCAAAAQlIAAAALmQFbXq8pu3R6KNzamMzresqEUU9GBZvfDDUVL90sFB3jbook2FjY0Ot356sCCSM_hA6njYK6pfDNH8QJvfOcFDzmqhd-1_yf_8AMgNp4uxtaZdxot_ic_QIaRLiVngTEnA27j8hQcJzR6PBhbv3pv_bNBvd0YbpERn9rpiyFCRJfGriTR1qDsOn3tm7pqftloVg96Am9l-iA23RzfF3SVepVHIAOmKmUIeHrGKd07otQlpkSBYM8nEQa8fbWMuS33JEN5tngfpKcM-zT7h3hOEMzrc8aWdjo91fKAl47DdDIzPK5LjckGT6qDz8dJrPAnFtQmTx9_ESE1z_PPxeuljXzyPxPs-EiOnaJ_LdVmfqFTS3X7zHhRLMP42rvc9XdL8kvCMYACGNjY2KCzkhCCPcByyqtedpmjeENUjw95N8oQBKb8I0m0WqxkffI37-_Koh1QH7h5sJeSnPNk2w

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:17 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 101ms
100ms Image
image/gif 52.202.152.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2020-03-25T16%3A55%3A17.343Z&_t=slot_impression_viewable&cBr=Ars%20Technica&cKe=hacking%7Cmalware%7Cmiddle%20east&cCh=information%20technology&cTi=Never-before-seen%20attackers%20are%20targeting%20Mideast%20industrial%20organizations&cTy=article%7Creport&cTp=ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192&cTpw=0.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495&cEnt=malware%2C%20milum%2C%20kaspersky%20lab%2C%20page%20layout%2C%20middle%20east%2C%20iran%2C%20dan%20goodin%2C%20mideast%2C%20vpn%2C%20utc%2C%20json%2C%20middle%20eastern%2C%2064-bit%2C%20cond%C3%A9%20nast%2C%20denis%20legezo%2C%20ars%20orbital%20transmission%2C%20c%2B%2B%2C%20us%2C%20saudi%20arabian%2C%20ars%20technica%20addendum&cEnw=1%2C%200.6906379545219714%2C%200.6877128322284288%2C%200.6615894629690477%2C%200.5946571427809644%2C%200.4921362430533071%2C%200.4103889677627687%2C%200.4041333983659949%2C%200.3913882334036157%2C%200.38007900317315924%2C%200.37162764148642624%2C%200.3565682437182297%2C%200.3426552132063025%2C%200.33462725081747424%2C%200.30206502850039274%2C%200.2997686267310179%2C%200.2902701446479252%2C%200.2751866283263286%2C%200.26480398171397435%2C%200.2530766852930854&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=881&cId=1663038&cPd=2020-03-25T10%3A45%3A24.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations&pRt=referral&pHp=%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pWw=1600&pWh=1200&pPw=1600&pPh=5000&pSw=1600&pSh=1200&uID=07843961-f9a3-463c-83e3-3b7508dd8927&sID=07ad7b93-856c-42c4-8a7b-dcde40374913&pID=62940348-df41-46b8-9c0c-5f1dbd727e94&uDt=desktop&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.32.6%22%7D&_o=ars-technica&_c=cns_ads&xID=2ab080d4-e824-4f62-a70e-67d18c7e7eb4&dim2=%7B%22adUnitPath%22%3A%223379%2Fconde.ars%2Fhero%2Finformation-technology%2Farticle%2F1%22%2C%22advertiserId%22%3A4592559319%2C%22campaignId%22%3A2345665434%2C%22creativeId%22%3A138250144973%2C%22elementId%22%3A%22post_nav_0%22%2C%22instance%22%3A%220%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Afalse%2C%22isFirstImpression%22%3Atrue%2C%22isFirstImpressionViewable%22%3Atrue%2C%22isFirstRequested%22%3Afalse%2C%22isFirstMoneyImpression%22%3Atrue%2C%22isFirstMoneyImpressionViewable%22%3Atrue%2C%22isFirstMoneyRequested%22%3Atrue%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22hacking%22%2C%22malware%22%2C%22middle-east%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3A4860183109%2C%22name%22%3A%22post_nav_0%22%2C%22outOfPage%22%3Afalse%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%22728x90%22%2C%22slug%22%3A%22never-before-seen-attackers-are-targeting-mideast-industrial-organizations%22%7D&dim3=%7B%22footerStart%22%3A1585155314114%2C%22headerStart%22%3A1585155314091%2C%22navigationStart%22%3A1585155313458%2C%22injected%22%3A1585155316067%2C%22viewable%22%3A1585155317343%2C%22viewport%22%3A%22%22%2C%22impression%22%3A1585155316281%7D&dim4=%7B%22pos%22%3A%5B%22hero%22%5D%2C%22ctx_slot_type%22%3A%5B%22post_nav%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22amznbid%22%3A%5B%222%22%5D%2C%22amznp%22%3A%5B%222%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_instance%22%3A%5B%220%22%5D%2C%22ctx_slot_name%22%3A%5B%22post_nav_0%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.32.6%22%5D%2C%22ctx_page_slug%22%3A%5B%22never-before-seen-attackers-are-targeting-mideast-industrial-organizations%22%5D%2C%22cnt_tags%22%3A%5B%22hacking%22%2C%22malware%22%2C%22middle-east%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_sg%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%2C%22vnd_prx_segments%22%3A%5B%22300003%22%2C%22121100%22%2C%22131100%22%2C%22112200%22%2C%22210000%22%2C%22210012%22%2C%22240000%22%2C%22240002%22%2C%22240003%22%2C%22240004%22%2C%22240001%22%2C%22240005%22%2C%22240006%22%2C%22240007%22%2C%22240008%22%2C%22240009%22%2C%22240011%22%2C%22240012%22%2C%22240013%22%2C%22240014%22%2C%22240017%22%2C%22240015%22%2C%22240016%22%2C%22qx7745%22%2C%22xm1ai0%22%2C%22wmhp4i%22%2C%22euwba9%22%2C%22dcxr0c%22%2C%222hkgm5%22%2C%22ap05we%22%2C%22fdf1wd%22%2C%22v8lc56%22%2C%2265f9pd%22%2C%22uas8ja%22%2C%22_FnZJCTv8E0_%22%5D%7D&environment=prod&origin=ars-technica&cKh=malware%2Corganization%2Cnever-before-seen%20attacker%2Cresearcher%2Cmilum%2Ckaspersky%20lab%2Cpage%20layout%2Cwildpressure
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.202.152.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-202-152-193.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 16:55:17 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 4F33 42 B
115 B 44ms
44ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstwm_Ej8Mm_lgBpZZYvV88592-tQmh-7MwGzdjwx1q9H141TMeqoolsA3E6Ime9HbJuLNa2kxNxB6SHdsLLf4FmU-t4fkDKFELLaCHcg_Y&sig=Cg0ArKJSzKaE3091zRQ0EAE&adk=2385402828&tt=-1&bs=1585%2C1200&mtos=1044,1044,1044,1044,1044&tos=1044,0,0,0,0&p=80,429,170,1157&mcvt=1044&rs=0&ht=0&tfs=124&tls=1168&mc=1&lte=0&bas=0&bac=0&met=ce&avms=nio&exg=1&md=2&btr=0&lm=2&rst=1585155316063&dlt&rpt=218&isd=0&msd=0&ext&xdi=0&ps=1585%2C5035&ss=1600%2C1200&pt=-1&bin=4&deb=1-0-0-12-5-11-11-0-0-0&tvt=1164&is=728%2C90&iframe_loc=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&r=v&id=osdim&vs=4&uc=12&upc=1&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20200323

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:17 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 107ms
106ms Image
image/gif 52.202.152.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2020-03-25T16%3A55%3A17.444Z&_t=slot_impression_viewable&cBr=Ars%20Technica&cKe=hacking%7Cmalware%7Cmiddle%20east&cCh=information%20technology&cTi=Never-before-seen%20attackers%20are%20targeting%20Mideast%20industrial%20organizations&cTy=article%7Creport&cTp=ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192&cTpw=0.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495&cEnt=malware%2C%20milum%2C%20kaspersky%20lab%2C%20page%20layout%2C%20middle%20east%2C%20iran%2C%20dan%20goodin%2C%20mideast%2C%20vpn%2C%20utc%2C%20json%2C%20middle%20eastern%2C%2064-bit%2C%20cond%C3%A9%20nast%2C%20denis%20legezo%2C%20ars%20orbital%20transmission%2C%20c%2B%2B%2C%20us%2C%20saudi%20arabian%2C%20ars%20technica%20addendum&cEnw=1%2C%200.6906379545219714%2C%200.6877128322284288%2C%200.6615894629690477%2C%200.5946571427809644%2C%200.4921362430533071%2C%200.4103889677627687%2C%200.4041333983659949%2C%200.3913882334036157%2C%200.38007900317315924%2C%200.37162764148642624%2C%200.3565682437182297%2C%200.3426552132063025%2C%200.33462725081747424%2C%200.30206502850039274%2C%200.2997686267310179%2C%200.2902701446479252%2C%200.2751866283263286%2C%200.26480398171397435%2C%200.2530766852930854&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=881&cId=1663038&cPd=2020-03-25T10%3A45%3A24.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations&pRt=referral&pHp=%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pWw=1600&pWh=1200&pPw=1600&pPh=5000&pSw=1600&pSh=1200&uID=07843961-f9a3-463c-83e3-3b7508dd8927&sID=07ad7b93-856c-42c4-8a7b-dcde40374913&pID=62940348-df41-46b8-9c0c-5f1dbd727e94&uDt=desktop&dim1=%7B%22channel%22%3A%22information-technology%22%2C%22device%22%3A%22desktop%22%2C%22server%22%3A%22production%22%2C%22template%22%3A%22article%22%2C%22version%22%3A%226.32.6%22%7D&_o=ars-technica&_c=cns_ads&xID=2ab080d4-e824-4f62-a70e-67d18c7e7eb4&dim2=%7B%22adUnitPath%22%3A%223379%2Fconde.ars%2Frail%2Finformation-technology%2Farticle%2F1%22%2C%22advertiserId%22%3A4592559319%2C%22campaignId%22%3A2345665434%2C%22creativeId%22%3A138250089663%2C%22elementId%22%3A%22siderail_0%22%2C%22instance%22%3A%220%22%2C%22isBackfill%22%3Afalse%2C%22isEmpty%22%3Afalse%2C%22isFirstImpression%22%3Afalse%2C%22isFirstImpressionViewable%22%3Afalse%2C%22isFirstRequested%22%3Afalse%2C%22isFirstMoneyImpression%22%3Afalse%2C%22isFirstMoneyImpressionViewable%22%3Afalse%2C%22isFirstMoneyRequested%22%3Afalse%2C%22isRefresh%22%3Afalse%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22hacking%22%2C%22malware%22%2C%22middle-east%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22lineItemId%22%3A4860183109%2C%22name%22%3A%22siderail_0%22%2C%22outOfPage%22%3Afalse%2C%22requestNumber%22%3A%220%22%2C%22sizes%22%3A%22300x600%22%2C%22slug%22%3A%22never-before-seen-attackers-are-targeting-mideast-industrial-organizations%22%7D&dim3=%7B%22footerStart%22%3A1585155314114%2C%22headerStart%22%3A1585155314091%2C%22navigationStart%22%3A1585155313458%2C%22injected%22%3A1585155316116%2C%22viewable%22%3A1585155317444%2C%22viewport%22%3A%22%22%2C%22impression%22%3A1585155316340%7D&dim4=%7B%22pos%22%3A%5B%22rail%22%5D%2C%22ctx_slot_type%22%3A%5B%22siderail%22%5D%2C%22ctx_slot_rn%22%3A%5B%220%22%5D%2C%22m_mv%22%3A%5B%22noHistData%22%5D%2C%22m_gv%22%3A%5B%22noHistData%22%5D%2C%22amznbid%22%3A%5B%222%22%5D%2C%22amznp%22%3A%5B%222%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22ctx_slot_instance%22%3A%5B%220%22%5D%2C%22ctx_slot_name%22%3A%5B%22siderail_0%22%5D%2C%22m_data%22%3A%5B%221%22%5D%2C%22m_safety%22%3A%5B%22safe%22%5D%2C%22m_categories%22%3A%5B%5D%2C%22env_device_type%22%3A%5B%22desktop%22%5D%2C%22ctx_template%22%3A%5B%22article%22%5D%2C%22ctx_page_channel%22%3A%5B%22information-technology%22%5D%2C%22env_server%22%3A%5B%22production%22%5D%2C%22ctx_cns_version%22%3A%5B%226.32.6%22%5D%2C%22ctx_page_slug%22%3A%5B%22never-before-seen-attackers-are-targeting-mideast-industrial-organizations%22%5D%2C%22cnt_tags%22%3A%5B%22hacking%22%2C%22malware%22%2C%22middle-east%22%5D%2C%22cnt_platform%22%3A%5B%22wordpress%22%5D%2C%22cnt_copilotid%22%3A%5B%22%22%5D%2C%22vnd_4d_cached%22%3A%5B%220%22%5D%2C%22vnd_4d_ctx_sg%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_topics%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_entities%22%3A%5B%22%22%5D%2C%22vnd_4d_ctx_keywords%22%3A%5B%22%22%5D%2C%22vnd_4d_usr_topics%22%3A%5B%22%22%5D%2C%22vnd_prx_segments%22%3A%5B%22300003%22%2C%22121100%22%2C%22131100%22%2C%22112200%22%2C%22210000%22%2C%22210012%22%2C%22240000%22%2C%22240002%22%2C%22240003%22%2C%22240004%22%2C%22240001%22%2C%22240005%22%2C%22240006%22%2C%22240007%22%2C%22240008%22%2C%22240009%22%2C%22240011%22%2C%22240012%22%2C%22240013%22%2C%22240014%22%2C%22240017%22%2C%22240015%22%2C%22240016%22%2C%22qx7745%22%2C%22xm1ai0%22%2C%22wmhp4i%22%2C%22euwba9%22%2C%22dcxr0c%22%2C%222hkgm5%22%2C%22ap05we%22%2C%22fdf1wd%22%2C%22v8lc56%22%2C%2265f9pd%22%2C%22uas8ja%22%2C%22_FnZJCTv8E0_%22%5D%7D&environment=prod&origin=ars-technica&cKh=malware%2Corganization%2Cnever-before-seen%20attacker%2Cresearcher%2Cmilum%2Ckaspersky%20lab%2Cpage%20layout%2Cwildpressure
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.202.152.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-202-152-193.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 16:55:17 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 1C97 42 B
110 B 74ms
74ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstQlVKmn0D6RAv9paRxbcXO1nfIvjoC5T9deGvrEzmFxCdkMxV0CpZsh4ZuIp07r8NKIwg-lxaQ6Yhi19yCumqD9iLOpaWWOU2-No9t8bg&sig=Cg0ArKJSzExZtPGnf9nbEAE&adk=1483574547&tt=-1&bs=1585%2C1200&mtos=1026,1026,1026,1026,1026&tos=1026,0,0,0,0&p=370,1063,970,1363&mcvt=1026&rs=0&ht=0&tfs=111&tls=1137&mc=1&lte=0&bas=0&bac=0&met=ce&avms=nio&exg=1&md=2&btr=0&lm=2&rst=1585155316114&dlt&rpt=226&isd=0&msd=0&ext&xdi=0&ps=1585%2C5035&ss=1600%2C1200&pt=-1&bin=4&deb=1-0-0-12-5-11-11-0-0-0&tvt=1133&is=300%2C600&iframe_loc=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&r=v&id=osdim&vs=4&uc=12&upc=1&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20200325

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:17 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 0934 42 B
110 B 40ms
40ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss5N84n3l0C-iNkPsG7eDgOT_ponIiBSJi_nszMWcAGaA6OgVfgbxLN8YWQ-OHQvO7GTZBPZIyM3y74gxAI9fu_bcU98kztQ8yNwNhobSQ&sig=Cg0ArKJSzC2CIdj3wNuiEAE&adk=4064914268&tt=-1&bs=1585%2C1200&mtos=1019,1019,1019,1019,1019&tos=1019,0,0,0,0&p=0,0,90,728&mcvt=1019&rs=3&ht=0&tfs=111&tls=1130&mc=1&lte=1&bas=0&bac=0&met=ie&avms=nio&exg=1&md=2&btr=0&lm=2&rst=1585155316535&dlt&rpt=299&isd=0&msd&ext&xdi=0&ps=1585%2C5035&ss=1600%2C1200&pt=-1&bin=4&deb=1-0-0-11-3-10-10-0-0-0&tvt=1129&is=728%2C90&iframe_loc=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&r=v&id=osdim&vs=4&uc=11&upc=1&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20200323

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:17 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame A354 42 B
110 B 40ms
39ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuRdEiJjcbeZpISb0JtwqWCFjt7hXNL0f4aoGHw7RHe32UpqRPQP9Qy45enIB3t0_X4Y6_Vkq_hw12vxue2H_nlg0pVf0HF6ge1kOKR8I0&sig=Cg0ArKJSzCPE9F5Z-gHwEAE&adk=3739225199&tt=-1&bs=1585%2C1200&mtos=1016,1016,1016,1016,1016&tos=1016,0,0,0,0&p=0,0,600,300&mcvt=1016&rs=3&ht=0&tfs=140&tls=1156&mc=1&lte=0&bas=0&bac=0&met=ie&avms=nio&exg=1&md=2&btr=0&lm=2&rst=1585155316821&dlt&rpt=189&isd=0&msd&ext&xdi=0&ps=1585%2C5035&ss=1600%2C1200&pt=-1&bin=4&deb=1-0-0-12-2-11-11-0-0-0&tvt=1156&is=300%2C600&iframe_loc=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&r=v&id=osdim&vs=4&uc=12&upc=1&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20200323

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:18 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 204
No Content events
wren.condenastdigital.com/1.0/conde/ 0
732 B 101ms
101ms Other
image/gif 52.0.16.6
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wren.condenastdigital.com/1.0/conde/events?topic=wren.events.ads&api_key=d3Jlbg

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/ars-technica.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.0.16.6 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-0-16-6.compute-1.amazonaws.com

Software

nginx/1.15.8 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Wed, 25 Mar 2020 16:55:18 GMT
strict-transport-security: max-age=15768000; preload
x-content-type-options: nosniff
Server: nginx/1.15.8
x-download-options: noopen
x-frame-options: DENY
Content-Type: image/gif
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
access-control-allow-credentials: true
Connection: keep-alive
vary: origin
x-xss-protection: 1; mode=block

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame A8BC 6 KB
2 KB 169ms
90ms XHR
text/xml 172.217.22.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?sz=640x480|480x70&iu=/3379/conde.ars/player/information-technology/article&ciu_szs=300x60&gdfp_req=1&env=vp&output=vmap&unviewed_position_start=1&cust_params=m_data%3D1%26m_safety%3Dsafe%26m_categories%3D%26m_mv%3DnoHistData%26m_gv%3DnoHistData%26env_device_type%3Ddesktop%26ctx_template%3Darticle%26ctx_page_channel%3Dinformation-technology%26env_server%3Dproduction%26ctx_cns_version%3D6.32.6%26ctx_page_slug%3Dnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%26cnt_tags%3Dhacking%252Cmalware%252Cmiddle-east%26cnt_platform%3Dwordpress%26cnt_copilotid%3D%26vnd_4d_cached%3D0%26vnd_4d_ctx_sg%3D%26vnd_4d_ctx_topics%3D%26vnd_4d_ctx_entities%3D%26vnd_4d_ctx_keywords%3D%26vnd_4d_usr_topics%3D%26vnd_prx_segments%3D300003%252C121100%252C131100%252C112200%252C210000%252C210012%252C240000%252C240002%252C240003%252C240004%252C240001%252C240005%252C240006%252C240007%252C240008%252C240009%252C240011%252C240012%252C240013%252C240014%252C240017%252C240015%252C240016%252Cqx7745%252Cxm1ai0%252Cwmhp4i%252Ceuwba9%252Cdcxr0c%252C2hkgm5%252Cap05we%252Cfdf1wd%252Cv8lc56%252C65f9pd%252Cuas8ja%252C_FnZJCTv8E0_%26ctx_line_items%3D%26height%3D304%26muted%3D0%26right_rail%3D0%26sensitive%3D0%26series%3D5c82bd18bcdfff6f1f2fc5e7%26width%3D540&correlator=877859042265284&description_url=https%3A%2F%2Fthescene.com%2Fwatch%2Farstechnica%2Fwar-stories-how-prince-of-persia-defeated-apple-ii-s-memory-limitations&vid=5e5822b938d0690743f48b68&cmsid=1495&ppid=83b301b44865443eb582ebcfcdcf77ed

Requested by

Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-8acd27185b78ea8d8dde.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s18-in-f98.1e100.net

Software

cafe /

Resource Hash

379132c4208354e068f4a748b2126380dbca4a94f8c744fb6b02ca7f1f30e8f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 25 Mar 2020 16:55:18 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 1182
x-xss-protection: 0
google-lineitem-id: 0
pragma: no-cache
server: cafe
google-creative-id: 0
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK track
capture.condenastdigital.com/ Frame A8BC 48 B
48 B 98ms
98ms Image
image/gif 52.202.152.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&_ts=2020-03-25T16%3A55%3A18.535Z&_c=timedOut&_t=gptData&sID=07ad7b93-856c-42c4-8a7b-dcde40374913&pID=62940348-df41-46b8-9c0c-5f1dbd727e94&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&dim1=%7B%22adBlocked%22%3Afalse%2C%22adUnits%22%3A%5B%223379%2Fconde.ars%2Finterstitial%2Finformation-technology%2Farticle%2F1%22%2C%223379%2Fconde.ars%2Fhero%2Finformation-technology%2Farticle%2F1%22%2C%223379%2Fconde.ars%2Frail%2Finformation-technology%2Farticle%2F1%22%2C%223379%2Fconde.ars%2Frail%2Finformation-technology%2Farticle%2F2%22%2C%223379%2Fconde.ars%2Fmid-content%2Finformation-technology%2Farticle%2F1%22%2C%223379%2Fconde.ars.native%2Flegacy%2Finformation-technology%2Farticle%2F1%22%5D%2C%22embedLocation%22%3A%22arstechnica%22%2C%22error%22%3A%22%22%2C%22lineItems%22%3A%5B%5D%2C%22publicaEnabled%22%3Afalse%2C%22videoId%22%3A%225e5822b938d0690743f48b68%22%7D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.202.152.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-202-152-193.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 16:55:18 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

POST
H2 200 collect
www.google-analytics.com/r/ 35 B
102 B 15ms
15ms Other
image/gif 2a00:1450:4001:817::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/r/collect

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:18 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: https://arstechnica.com
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 moatvideo.js Show response
z.moatads.com/condenastjsvideocontent160527792519/ Frame A8BC 295 KB
99 KB 35ms
35ms Script
application/x-javascript 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/condenastjsvideocontent160527792519/moatvideo.js
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-8acd27185b78ea8d8dde.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: eb3a4648bbf1eebdfefd7e8716059f1bd319dd2e3dcff586692b7cca4500e8e0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 25 Mar 2020 16:55:18 GMT
content-encoding: gzip
last-modified: Thu, 20 Feb 2020 16:26:33 GMT
server: AmazonS3
x-amz-request-id: BF9E79EB036EF581
etag: "4477f89d074c0a31b948cf7467bd06e3"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=53941
accept-ranges: bytes
content-length: 100581
x-amz-id-2: GFjEB+HtUAfGSRr5s69bds6lqZfTydPM4J4AVtKmwf6w+hUa3fFeniiYfAz+coUJwhPGzQGF+f8=

GET
H/1.1 200
OK track
capture.condenastdigital.com/ Frame A8BC 48 B
48 B 97ms
97ms Image
image/gif 52.202.152.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&_ts=2020-03-25T16%3A55%3A18.720Z&_c=Video%20Ad&_t=Ad%20Call%20Made&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fwww.arstechnica.com%2Fvideo%2Fwatch%2Fwar-stories-how-prince-of-persia-defeated-apple-ii-s-memory-limitations&cId=5e5822b938d0690743f48b68&cKe=video%20games%2Cprince%20of%20persia%2Cprince%20of%20persia%20apple%20ii%2Capple%20ii%20games%2Cars%20technica%20war%20stories%2Cclassic%20video%20games%2Cretro%20gaming%2Crotoscope%2Crotoscoping%2Crotoscope%20animation%2Cinterview%2Cgame%20development%2Cvideo%20game%20development%2Cgame%20developer%2Cvideo%20game%20developer&cPd=2020-03-17T15%3A00%3A00%2B00%3A00&cTi=How%20Prince%20of%20Persia%20Defeated%20Apple%20II%27s%20Memory%20Limitations&cTy=%2F3379%2Fconde.ars%2Fplayer%2Finformation-technology%2Farticle&mDu=1248&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pID=62940348-df41-46b8-9c0c-5f1dbd727e94&pWw=540&pWh=303.75&sID=07ad7b93-856c-42c4-8a7b-dcde40374913&uId=07843961-f9a3-463c-83e3-3b7508dd8927&xid=83b301b4-4865-443e-b582-ebcfcdcf77ed&dim1=%7B%22contentStartType%22%3A%22manual%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22gitBranch%22%3A%22master%22%2C%22gitSha%22%3A%227a2672b%22%2C%22guid%22%3A%22b273a256-c272-94c2-daf0-dfde2be1b974%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22manual%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A3529.8125%2C%22playerType%22%3A%22video-continuous%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3Anull%2C%22recStrategy%22%3Anull%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22versoPageType%22%3A%22article%7Creport%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3A%22OUT_OF_VIEWPORT%22%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&videoViews=1&adId=&pageType=article%7Creport
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.202.152.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-202-152-193.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 16:55:18 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 37ms
37ms Image
image/gif 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CONDEVIDEOCONTENT1&hp=1&wf=1&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=8&f=0&j=&t=1585155318777&de=933855060378&m=0&ar=b63606d9a9-clean&iw=d95b431&q=15&cb=0&ym=0&cu=1585155318777&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=How%20Prince%20of%20Persia%20Defeated%20Apple%20II%27s%20Memory%20Limitations%3A%2F3379%2Fconde.ars%2Fplayer%2Finformation-technology%2Farticle%3Aundefined%3Aundefined&zMoatVideoId=5e5822b938d0690743f48b68&zMoatAP=-&gu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&id=1&zMoatDomain=arstechnica.com&zMoatSubdomain=arstechnica.com&gw=condenastjsvideocontent160527792519&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A686%3A686%3A3708%3A909&fs=177454&na=119795414&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:18 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 25 Mar 2020 16:55:18 GMT

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 98ms
97ms Image
image/gif 52.202.152.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2020-03-25T16%3A55%3A20.868Z&_t=timespent&cBr=Ars%20Technica&cKe=hacking%7Cmalware%7Cmiddle%20east&cCh=information%20technology&cTi=Never-before-seen%20attackers%20are%20targeting%20Mideast%20industrial%20organizations&cTy=article%7Creport&cTp=ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192&cTpw=0.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.5772331518751108%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495%2C%200.14705437666757495&cEnt=malware%2C%20milum%2C%20kaspersky%20lab%2C%20page%20layout%2C%20middle%20east%2C%20iran%2C%20dan%20goodin%2C%20mideast%2C%20vpn%2C%20utc%2C%20json%2C%20middle%20eastern%2C%2064-bit%2C%20cond%C3%A9%20nast%2C%20denis%20legezo%2C%20ars%20orbital%20transmission%2C%20c%2B%2B%2C%20us%2C%20saudi%20arabian%2C%20ars%20technica%20addendum&cEnw=1%2C%200.6906379545219714%2C%200.6877128322284288%2C%200.6615894629690477%2C%200.5946571427809644%2C%200.4921362430533071%2C%200.4103889677627687%2C%200.4041333983659949%2C%200.3913882334036157%2C%200.38007900317315924%2C%200.37162764148642624%2C%200.3565682437182297%2C%200.3426552132063025%2C%200.33462725081747424%2C%200.30206502850039274%2C%200.2997686267310179%2C%200.2902701446479252%2C%200.2751866283263286%2C%200.26480398171397435%2C%200.2530766852930854&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=881&cId=1663038&cPd=2020-03-25T10%3A45%3A24.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations&pRt=referral&pHp=%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&pWw=1600&pWh=1200&pPw=1600&pPh=5000&pSw=1600&pSh=1200&uID=add3e802-9987-4924-985c-48d0c781f67b&uNw=1&uUq=1&pID=daba7c59-f2d9-424c-8786-8e077cb86278&uDt=desktop&dim1=v1.0.25_iframe_query&_o=ars-technica&_c=general&xID=2ab080d4-e824-4f62-a70e-67d18c7e7eb4&_v=5000&environment=prod&origin=ars-technica&cKh=malware%2Corganization%2Cnever-before-seen%20attacker%2Cresearcher%2Cmilum%2Ckaspersky%20lab%2Cpage%20layout%2Cwildpressure
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.202.152.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-202-152-193.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 25 Mar 2020 16:55:20 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

POST
H/1.1 204
No Content events
wren.condenastdigital.com/1.0/conde/ 0
732 B 102ms
102ms Other
image/gif 52.0.16.6
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wren.condenastdigital.com/1.0/conde/events?topic=wren.events.ads&api_key=d3Jlbg

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/ars-technica.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.0.16.6 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-0-16-6.compute-1.amazonaws.com

Software

nginx/1.15.8 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Wed, 25 Mar 2020 16:55:22 GMT
strict-transport-security: max-age=15768000; preload
x-content-type-options: nosniff
Server: nginx/1.15.8
x-download-options: noopen
x-frame-options: DENY
Content-Type: image/gif
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
access-control-allow-credentials: true
Connection: keep-alive
vary: origin
x-xss-protection: 1; mode=block

GET
H2 204 identity Show response
api.rlcdn.com/api/ 0
203 B 80ms
32ms XHR
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.rlcdn.com/api/identity?pid=2&rt=envelope&cv=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA&ct=1
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.244.174.68 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Wed, 25 Mar 2020 16:55:23 GMT
via: 1.1 google
alt-svc: clear
status: 204
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://arstechnica.com
access-control-allow-credentials: true
access-control-allow-headers: Cookie, Accept, Origin, Authorization, Content-Type

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 66 B
478 B 263ms
188ms XHR
text/javascript 95.101.185.51
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?v=7.2&s=321388&fn=headertag.IndexExchangeHtb.adResponseCallback&r=%7B%22id%22%3A94786568%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F%22%7D%2C%22imp%22%3A%5B%7B%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%227%22%2C%22siteID%22%3A%22375847%22%7D%2C%22id%22%3A%221%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%228%22%2C%22siteID%22%3A%22375847%22%7D%2C%22id%22%3A%222%22%7D%5D%2C%22ext%22%3A%7B%22source%22%3A%22ixwrapper%22%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22adserver.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22e3eda055-7125-4b21-a4b3-0b72ee98a8da%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID%22%7D%7D%2C%7B%22id%22%3A%22FALSE%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_LOOKUP%22%7D%7D%2C%7B%22id%22%3A%222020-03-25T16%3A55%3A14%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_CREATED_AT%22%7D%7D%5D%7D%5D%2C%22ext%22%3A%7B%22consent%22%3A%22BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA%22%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A1%7D%7D%7D
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 9b6cce3def0e05937c556763f13b1ca760dd84724666e4b1ee96d39d12df2095

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 25 Mar 2020 16:55:23 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 86
Expires: Wed, 25 Mar 2020 16:55:23 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 260 B
743 B 1548ms
158ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11850&size_id=2&rp_floor=0.01&rf=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&p_screen_res=1600x1200&site_id=217438&zone_id=1537752&kw=rp.fastlane&tk_flint=index&rand=0.111060406033475&gdpr=1&gdpr_consent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA&alt_size_ids=57
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 1ac5da3617c6ccb517dade95622e1bccd6d7a8ab728c4643af97f2451eeb4ec3

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 25 Mar 2020 16:55:24 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=172
Content-Length: 260
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2

302

ADTECH;cfp=1;rndc=1585155324;cmd=bid;cors=yes;v=2;misc=1585155323006;callback=window.headertag.AolHtb.adResponseCallbacks._JHF7sFtL;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1585155323006;callback=window.headertag.AolHtb.adResponseCallbacks._JHF7sFtL;gdpr=1;eucon...
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cfp=1;rndc=1585155324;cmd=bid;cors=yes;v=2;misc=1585155323006;callback=window.headertag.AolHtb.adResponseCallbacks....

0
-1 B

1435ms
99ms

XHR

152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cfp=1;rndc=1585155324;cmd=bid;cors=yes;v=2;misc=1585155323006;callback=window.headertag.AolHtb.adResponseCallbacks._JHF7sFtL;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:24 GMT
server: nginx
access-control-allow-origin: https://arstechnica.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cfp=1;rndc=1585155324;cmd=bid;cors=yes;v=2;misc=1585155323006;callback=window.headertag.AolHtb.adResponseCallbacks._JHF7sFtL;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:24 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cfp=1;rndc=1585155324;cmd=bid;cors=yes;v=2;misc=1585155323006;callback=window.headertag.AolHtb.adResponseCallbacks._JHF7sFtL;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

302

ADTECH;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323007;callback=window.headertag.AolHtb.adResponseCallbacks._qiLU08sE;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1585155323007;callback=window.headertag.AolHtb.adResponseCallbacks._qiLU08sE;gdpr=1;eucon...
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323007;callback=window.headertag.AolHtb.adResponseCallbacks....

0
-1 B

1433ms
98ms

XHR

152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323007;callback=window.headertag.AolHtb.adResponseCallbacks._qiLU08sE;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:24 GMT
server: nginx
access-control-allow-origin: https://arstechnica.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323007;callback=window.headertag.AolHtb.adResponseCallbacks._qiLU08sE;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:24 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323007;callback=window.headertag.AolHtb.adResponseCallbacks._qiLU08sE;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
145 B 1093ms
27ms XHR
text/plain 178.250.0.165
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?ptv=87&profileId=154&cb=55039958393
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.0.165 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Finatra /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

status: 204
date: Wed, 25 Mar 2020 16:55:23 GMT
access-control-allow-credentials: true
server: Finatra
access-control-allow-origin: https://arstechnica.com
timing-allow-origin: *
vary: Origin

POST
H2 200 cdb Show response
bidder.criteo.com/ 249 B
377 B 1091ms
31ms XHR
application/json 178.250.0.165
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?ptv=87&profileId=154&cb=78252257014
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.0.165 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Finatra /
Resource Hash: df70c7e9f881bc2f657f38428a4b594ce371d6eee52d86172b20a45b6242710f

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Wed, 25 Mar 2020 16:55:23 GMT
content-encoding: gzip
server: Finatra
status: 200
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://arstechnica.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 170

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
744 B 1812ms
278ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11850&size_id=15&rp_floor=0.01&rf=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&p_screen_res=1600x1200&site_id=217438&zone_id=1537754&kw=rp.fastlane&tk_flint=index&rand=0.6796635043761119&gdpr=1&gdpr_consent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA&alt_size_ids=10
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: ead682b185ed77c02aaf968f56b7bd699b76680256de2e7b7d235d86fd96bf14

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 25 Mar 2020 16:55:24 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=374
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 66 B
478 B 409ms
162ms XHR
text/javascript 95.101.185.51
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?v=7.2&s=321388&fn=headertag.IndexExchangeHtb.adResponseCallback&r=%7B%22id%22%3A56244154%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F%22%7D%2C%22imp%22%3A%5B%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%2233%22%2C%22siteID%22%3A%22375863%22%7D%2C%22id%22%3A%221%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%2231%22%2C%22siteID%22%3A%22375863%22%7D%2C%22id%22%3A%222%22%7D%5D%2C%22ext%22%3A%7B%22source%22%3A%22ixwrapper%22%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22adserver.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22e3eda055-7125-4b21-a4b3-0b72ee98a8da%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID%22%7D%7D%2C%7B%22id%22%3A%22FALSE%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_LOOKUP%22%7D%7D%2C%7B%22id%22%3A%222020-03-25T16%3A55%3A14%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_CREATED_AT%22%7D%7D%5D%7D%5D%2C%22ext%22%3A%7B%22consent%22%3A%22BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA%22%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A1%7D%7D%7D
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 2ce03e3bdeca58a8832b858702a266445555ba994c4f94df36751e219ffe1c8f

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 25 Mar 2020 16:55:23 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 86
Expires: Wed, 25 Mar 2020 16:55:23 GMT

GET
H2 200 placementbid.json Show response
an.facebook.com/v2/ 96 B
1 KB 79ms
64ms XHR
text/javascript 2a03:2880:f01c:800e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://an.facebook.com/v2/placementbid.json?sdk=5.5.web&placementids%5B%5D=2038188213062675_2473096466238512&adformats%5B%5D=300x250&cachebuster=iQQuFgqUzncfRPDBg5cC94VpKaqGuiwsIGhmZsc1uWdFyWwmP6VixddK&platform=2061185240785516&adapterver=2.1.0

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

05b23935e63631985a07af280120a80f53107f4e5f95e7be200eb12d3d7342cd

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
x-content-type-options: nosniff
x-fb-an-errors
access-control-expose-headers: X-FB-AN-Request-ID, X-FB-AN-Errors, X-FB-AN-Bid-Count
x-fb-an-request-id: 2217411584617759507
status: 200
alt-svc: h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: no-cache
x-fb-debug: 2VvNFdOTn5uai9MTXAJ3OWHV0PdRL84eb1jggloeTo2TRjAaDjR7t05PY7LQMK2bxdlb4GmBvnRRYyl+72kPIA==
x-frame-options: DENY
date: Wed, 25 Mar 2020 16:55:23 GMT, Wed, 25 Mar 2020 16:55:23 GMT
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: https://arstechnica.com
x-fb-an-bid-count: 0
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

302

ADTECH;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._rgbWB57p;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._rgbWB57p;gdpr=1;eucon...
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks....

0
-1 B

1422ms
102ms

XHR

152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._rgbWB57p;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:24 GMT
server: nginx
access-control-allow-origin: https://arstechnica.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._rgbWB57p;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:24 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._rgbWB57p;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

302

ADTECH;cfp=1;rndc=1585155324;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._8jUsosbk;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._8jUsosbk;gdpr=1;eucon...
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cfp=1;rndc=1585155324;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks....

0
-1 B

1417ms
98ms

XHR

152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cfp=1;rndc=1585155324;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._8jUsosbk;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:24 GMT
server: nginx
access-control-allow-origin: https://arstechnica.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cfp=1;rndc=1585155324;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._8jUsosbk;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:24 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cfp=1;rndc=1585155324;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._8jUsosbk;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

POST
H/1.1 200
OK headerstats Show response
as-sec.casalemedia.com/ 0
339 B 126ms
54ms XHR
text/plain 95.101.185.51
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/headerstats?s=321388&u=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&v=3
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 25 Mar 2020 16:55:24 GMT
Server: Apache
Content-Type: text/plain
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Wed, 25 Mar 2020 16:55:24 GMT

POST
H/1.1 200
OK headerstats Show response
as-sec.casalemedia.com/ 0
339 B 121ms
49ms XHR
text/plain 95.101.185.51
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/headerstats?s=321388&u=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&v=3
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-1558632223658.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 25 Mar 2020 16:55:24 GMT
Server: Apache
Content-Type: text/plain
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Wed, 25 Mar 2020 16:55:24 GMT

GET
H2

302

ADTECH;apid=1A6bcde0c2-6eb9-11ea-9ac9-128a639db496;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._8jUsosbk;gdpr=1;euconsent=BOw0... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;cfp=1;rndc=1585155324;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks....
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;apid=1A6bcde0c2-6eb9-11ea-9ac9-128a639db496;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=...

0
-1 B

96ms
96ms

XHR

152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;apid=1A6bcde0c2-6eb9-11ea-9ac9-128a639db496;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._8jUsosbk;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:24 GMT
server: nginx
access-control-allow-origin: https://arstechnica.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;apid=1A6bcde0c2-6eb9-11ea-9ac9-128a639db496;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._8jUsosbk;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:24 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;apid=1A6bcde0c2-6eb9-11ea-9ac9-128a639db496;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._8jUsosbk;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

302

ADTECH;apid=1A6bcdf684-6eb9-11ea-82c9-1201d05c7be8;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323007;callback=window.headertag.AolHtb.adResponseCallbacks._qiLU08sE;gdpr=1;euconsent=BOw0... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323007;callback=window.headertag.AolHtb.adResponseCallbacks....
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;apid=1A6bcdf684-6eb9-11ea-82c9-1201d05c7be8;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323007;callback=...

0
-1 B

99ms
98ms

XHR

152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;apid=1A6bcdf684-6eb9-11ea-82c9-1201d05c7be8;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323007;callback=window.headertag.AolHtb.adResponseCallbacks._qiLU08sE;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:24 GMT
server: nginx
access-control-allow-origin: https://arstechnica.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;apid=1A6bcdf684-6eb9-11ea-82c9-1201d05c7be8;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323007;callback=window.headertag.AolHtb.adResponseCallbacks._qiLU08sE;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:24 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;apid=1A6bcdf684-6eb9-11ea-82c9-1201d05c7be8;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323007;callback=window.headertag.AolHtb.adResponseCallbacks._qiLU08sE;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

302

ADTECH;apid=1A6bcff542-6eb9-11ea-87e1-126145921f52;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323006;callback=window.headertag.AolHtb.adResponseCallbacks._JHF7sFtL;gdpr=1;euconsent=BOw0... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;cfp=1;rndc=1585155324;cmd=bid;cors=yes;v=2;misc=1585155323006;callback=window.headertag.AolHtb.adResponseCallbacks....
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;apid=1A6bcff542-6eb9-11ea-87e1-126145921f52;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323006;callback=...

0
-1 B

107ms
107ms

XHR

152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;apid=1A6bcff542-6eb9-11ea-87e1-126145921f52;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323006;callback=window.headertag.AolHtb.adResponseCallbacks._JHF7sFtL;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:24 GMT
server: nginx
access-control-allow-origin: https://arstechnica.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;apid=1A6bcff542-6eb9-11ea-87e1-126145921f52;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323006;callback=window.headertag.AolHtb.adResponseCallbacks._JHF7sFtL;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:24 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;apid=1A6bcff542-6eb9-11ea-87e1-126145921f52;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323006;callback=window.headertag.AolHtb.adResponseCallbacks._JHF7sFtL;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

302

ADTECH;apid=1A6bcf308a-6eb9-11ea-bba4-12c791b7f306;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._rgbWB57p;gdpr=1;euconsent=BOw0... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks....
https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;apid=1A6bcf308a-6eb9-11ea-bba4-12c791b7f306;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=...

0
-1 B

96ms
95ms

XHR

152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;apid=1A6bcf308a-6eb9-11ea-bba4-12c791b7f306;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._rgbWB57p;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:24 GMT
server: nginx
access-control-allow-origin: https://arstechnica.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;apid=1A6bcf308a-6eb9-11ea-bba4-12c791b7f306;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._rgbWB57p;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:24 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;apid=1A6bcf308a-6eb9-11ea-bba4-12c791b7f306;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._rgbWB57p;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;apid=1A6bcde0c2-6eb9-11ea-9ac9-128a639db496;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._8jUsosbk;gdpr=1;euconsent=BOw0... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ 2 KB
2 KB 221ms
221ms XHR
text/javascript 152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090783/0/-1/ADTECH;apid=1A6bcde0c2-6eb9-11ea-9ac9-128a639db496;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._8jUsosbk;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: cf2f2feb30abd07fe96a016a50f07bd6ace1565b14c0c77097012644a3f123a5

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:24 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: text/javascript
content-length: 1771
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;apid=1A6bcdf684-6eb9-11ea-82c9-1201d05c7be8;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323007;callback=window.headertag.AolHtb.adResponseCallbacks._qiLU08sE;gdpr=1;euconsent=BOw0... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ 2 KB
2 KB 407ms
406ms XHR
text/javascript 152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090757/0/-1/ADTECH;apid=1A6bcdf684-6eb9-11ea-82c9-1201d05c7be8;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323007;callback=window.headertag.AolHtb.adResponseCallbacks._qiLU08sE;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 103a3912faf6641260bacd7a693854be9ff47dd5c06aaba04222225704d0a2fb

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:24 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: text/javascript
content-length: 1771
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;apid=1A6bcf308a-6eb9-11ea-bba4-12c791b7f306;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._rgbWB57p;gdpr=1;euconsent=BOw0... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ 2 KB
2 KB 414ms
413ms XHR
text/javascript 152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090778/0/-1/ADTECH;apid=1A6bcf308a-6eb9-11ea-bba4-12c791b7f306;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323022;callback=window.headertag.AolHtb.adResponseCallbacks._rgbWB57p;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 32e259fcf07036fb5f684a5de4b40bd9b74beb935b12cba472e4e3afb3b56b08

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:24 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: text/javascript
content-length: 1770
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;apid=1A6bcff542-6eb9-11ea-87e1-126145921f52;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323006;callback=window.headertag.AolHtb.adResponseCallbacks._JHF7sFtL;gdpr=1;euconsent=BOw0... Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ 2 KB
2 KB 449ms
448ms XHR
text/javascript 152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10920.1/5090770/0/-1/ADTECH;apid=1A6bcff542-6eb9-11ea-87e1-126145921f52;cfp=1;rndc=1585155323;cmd=bid;cors=yes;v=2;misc=1585155323006;callback=window.headertag.AolHtb.adResponseCallbacks._JHF7sFtL;gdpr=1;euconsent=BOw04F_Ow04F_AcABBENDBAAAAAuh7_______9______9uz_Ov_v_f__33e8__9v_l_7_-___u_-33d4u_1vf99yfm1-7etr3tp_87ues2_Xur__79__3z3_9pxP78k89r7337Ew_v-_v-b7BCPN_Y3lyA
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 9456ef29bdcd9e5f4cf7e96f01703c134fc56b2a990a5c6e0592488bc03db5e0

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:24 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: text/javascript
content-length: 1771
expires: Mon, 15 Jun 1998 00:00:00 GMT

POST
H/1.1 204
No Content events
wren.condenastdigital.com/1.0/conde/ 0
732 B 101ms
101ms Other
image/gif 52.0.16.6
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wren.condenastdigital.com/1.0/conde/events?topic=wren.events.ads&api_key=d3Jlbg

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/ars-technica.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.0.16.6 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-0-16-6.compute-1.amazonaws.com

Software

nginx/1.15.8 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
Origin: https://arstechnica.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Wed, 25 Mar 2020 16:55:25 GMT
strict-transport-security: max-age=15768000; preload
x-content-type-options: nosniff
Server: nginx/1.15.8
x-download-options: noopen
x-frame-options: DENY
Content-Type: image/gif
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
access-control-allow-credentials: true
Connection: keep-alive
vary: origin
x-xss-protection: 1; mode=block

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 36ms
35ms Image
image/gif 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=11&i=ARSTECHNICA1&hp=1&wf=1&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&k=&bq=0&f=0&j=&t=1585155316986&de=302387679150&m=0&ar=b63606d9a9-clean&iw=f7ab499&q=17&cb=0&ym=0&cu=1585155316986&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=37412957%3A225649757%3A708987677%3A68228449037&gu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&id=1&bo=99440717&bd=99519557&gw=arstechnicaukdfp314402068565&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A686%3A686%3A0%3A909&fs=177454&na=908070909&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:27 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 25 Mar 2020 16:55:27 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 35ms
35ms Image
image/gif 95.101.185.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=11&i=ARSTECHNICA1&hp=1&wf=1&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&k=&bq=0&f=0&j=&t=1585155317065&de=634258109663&m=0&ar=b63606d9a9-clean&iw=f7ab499&q=18&cb=0&ym=0&cu=1585155317065&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=37412957%3A225649757%3A708987677%3A68228340437&gu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2020%2F03%2Fnever-before-seen-attackers-are-targeting-mideast-industrial-organizations%2F&id=1&bo=99440717&bd=99519557&gw=arstechnicaukdfp314402068565&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A686%3A686%3A0%3A909&fs=177454&na=312218582&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2020/03/never-before-seen-attackers-are-targeting-mideast-industrial-organizations/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 25 Mar 2020 16:55:27 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 25 Mar 2020 16:55:27 GMT

Verdicts & Comments Add Verdict or Comment

148 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

14 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.outbrain.com/	1970-01-19 09:02:27	Name: ttd Value: c135e55e-1625-441a-bd81-0854e76e507f
.outbrain.com/	1970-01-19 08:19:15	Name: recs_d37bc2689ca0ed750ea991f603e76006 Value: 0B1925901673A2304348158A2395459944A2337984879A2523717943A2198356354ACD1
.arstechnica.com/	1970-01-20 01:50:27	Name: _ga Value: GA1.2.505617916.1585155315
.arstechnica.com/	1970-01-19 08:19:17	Name: sID Value: 07ad7b93-856c-42c4-8a7b-dcde40374913
widgets.outbrain.com/	1970-01-19 08:23:34	Name: OB-SYNC Value: 1585414516056
.arstechnica.com/	1970-01-19 08:19:15	Name: _gat_UA-31997-1 Value: 1
arstechnica.com/	1969-12-31 23:59:59	Name: GED_PLAYLIST_ACTIVITY Value: W3sidSI6Im4xQlIiLCJ0c2wiOjE1ODUxNTUzMTcsIm52IjoxLCJ1cHQiOjE1ODUxNTUzMTUsImx0IjoxNTg1MTU1MzE1fV0.
.arstechnica.com/	1970-01-19 08:20:41	Name: _gid Value: GA1.2.833508083.1585155316
arstechnica.com/	1969-12-31 23:59:59	Name: pID Value: 62940348-df41-46b8-9c0c-5f1dbd727e94
.arstechnica.com/	1970-01-20 01:50:27	Name: __gads Value: ID=959fd193d79c45dd:T=1585155315:S=ALNI_MaoQYvU3KNT8lqDfEBwI6wxjSUsTg
arstechnica.com/	1969-12-31 23:59:59	Name: CN_sp Value: 07843961-f9a3-463c-83e3-3b7508dd8927
.outbrain.com/	1970-01-19 10:28:51	Name: obuid Value: 9b700ffe-b076-4746-b200-8bbb874cd1b8
arstechnica.com/	1970-01-19 10:43:15	Name: cneplayercount Value: 1
arstechnica.com/	1970-01-19 09:02:27	Name: CN_su Value: 980ba689-1cfa-490b-8e36-e25ce590abae

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://cdn.cookielaw.org/opt-out/otCCPAiab.js(Line 96) Message: received a request for uspapi
console-api	log	URL: https://cdn.cookielaw.org/opt-out/otCCPAiab.js(Line 96) Message: received a request for uspapi
console-api	log	URL: https://cdn.cookielaw.org/opt-out/otCCPAiab.js(Line 96) Message: received a request for uspapi
console-api	log	URL: https://static.criteo.net/js/ld/publishertag.js(Line 1) Message: %cPubTag color: #fff; background: #ff8f1c; display: inline-block; padding: 1px 4px; border-radius: 3px; ERROR: Error onError: TypeError: Cannot read property 'getItem' of null
console-api	log	URL: https://static.criteo.net/js/ld/publishertag.js(Line 1) Message: %cPubTag color: #fff; background: #ff8f1c; display: inline-block; padding: 1px 4px; border-radius: 3px; ERROR: Error onSuccess: TypeError: Cannot read property 'getItem' of null

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4d.condenastdigital.com
ads.rubiconproject.com
adserver-us.adtech.advertising.com
adservice.google.com
adservice.google.de
ampcid.google.com
ampcid.google.de
an.facebook.com
api.cnevids.com
api.rlcdn.com
api.skimlinks.mgr.consensu.org
arstechnica.com
as-sec.casalemedia.com
bidder.criteo.com
c.amazon-adsystem.com
capture.condenastdigital.com
cdn.arstechnica.net
cdn.cookielaw.org
cdn.mediavoice.com
connect.facebook.net
d1z2jf7jlzjs58.cloudfront.net
d2c8v52ll5s99u.cloudfront.net
dp8hsntg6do36.cloudfront.net
dwgyu36up6iuz.cloudfront.net
embed.actionbutton.co
fastlane.rubiconproject.com
geolocation.1trust.app
geolocation.onetrust.com
images.outbrainimg.com
imasdk.googleapis.com
infinityid.condenastdigital.com
js-sec.indexww.com
log.outbrainimg.com
match.adsrvr.org
mb.moatads.com
mcdp-nydc1.outbrain.com
mid.rkdms.com
odb.outbrain.com
optimized-by.rubiconproject.com
p.skimresources.com
pagead2.googlesyndication.com
pixel.condenastdigital.com
player.cnevids.com
plugin.mediavoice.com
polarcdn-terrax.com
pubads.g.doubleclick.net
px.moatads.com
r.skimresources.com
s.skimresources.com
s0.2mdn.net
secure-assets.rubiconproject.com
securepubads.g.doubleclick.net
segment-data.zqtk.net
srv-2020-03-25-16.config.parsely.com
srv-2020-03-25-16.pixel.parsely.com
static.criteo.net
stats.g.doubleclick.net
t.skimresources.com
tcheck.outbrainimg.com
tpc.googlesyndication.com
widgets.outbrain.com
wren.condenastdigital.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
z.moatads.com
13.227.157.149
13.227.157.224
13.32.2.59
143.204.202.100
143.204.202.115
143.204.208.228
151.101.12.239
151.101.14.2
151.139.128.10
152.195.132.202
152.199.21.89
172.217.22.98
178.250.0.165
18.211.127.174
205.234.175.175
23.37.55.184
2606:4700:10::6814:b844
2606:4700::6811:4032
2606:4700::6812:da5d
2606:4700::6813:da83
2a00:1450:4001:800::2002
2a00:1450:4001:800::2008
2a00:1450:4001:806::2004
2a00:1450:4001:809::2006
2a00:1450:4001:80b::200a
2a00:1450:4001:817::200e
2a00:1450:4001:81b::2001
2a00:1450:4001:81b::200e
2a00:1450:4001:81d::200e
2a00:1450:4001:81e::2003
2a00:1450:400c:c00::9b
2a02:2638::3
2a03:2880:f01c:800e:face:b00c:0:2
2a03:2880:f01c:8012:face:b00c:0:3
3.20.147.38
34.231.184.25
35.190.40.172
35.190.59.101
35.201.67.47
35.244.174.68
52.0.16.6
52.0.203.166
52.19.1.241
52.202.152.193
52.213.78.12
52.3.43.18
52.73.54.41
54.77.139.233
64.202.112.127
69.173.144.143
70.42.32.127
95.101.185.159
95.101.185.246
95.101.185.51
95.101.186.38
99.84.89.112
99.86.0.120
00bd8c0d8620137ed2914b1958e62e894392f208c2f989e158565d9bb508e2fb
015045182758a421636084e2a2e43027e6ba1dd7005a2ec231b08d63c72d0fd7
0186840386391fa2c0750ff7450a78e066498ba3274546a6fcf0fa9c55cd457c
0290a012deb1b25451f5211d8cb8b40d8fa6f3942d23ecc12d96670e4c0ed7a5
02a9db289d960e3196e2269632ee772bbcb51333e9ab3503105ae7f3b1665062
030e91b7512dbb40e9b9057f20bcf54c296a7f28c04bbcde0f2d2706dd2a3a06
032027ea92b8b014594b64b514f922a12029c27c3dc27e5c11b09eabfaf810c3
039f13cdf684666dd973e2385f773385adb074039e8a832ec48e1ae35fb20c15
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
05a2975ca40e7d714018e9704c2d82812a8735f335f78a5f8d274203bc2976da
05b23935e63631985a07af280120a80f53107f4e5f95e7be200eb12d3d7342cd
069e870b6e87f44740da86df09060fc20ea42bf7517d33c5900e08b00e899599
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
075fb4374a67c8d8950af7094b704e4d7d660a85e3a9b96c3a98c0830b27be70
08ed3bf6e73a999bafb422b878fb05b87269b00a65230c9457ce75aee10b873e
0da0d6827b35c3a92fbd91f3f688ab2ec974bd3249cf113723a5959cd4b84f3f
0df18872a7d32620388cdc4df1e18acaa761a157830bbf8e258599352fa933fb
0eb438ad4233f9cdadd2cf6e5e3544a29b1e693a03f45b0b9fa25e70f2675917
103a3912faf6641260bacd7a693854be9ff47dd5c06aaba04222225704d0a2fb
1097abb6f0992cccc79428374463e7f23b99dae5eb85d7317b20bd57c96031bb
10c75f7c6402ea3c15ba35494f299a73e62877fca5786e50f18983243fa16873
1193e934b76ed372f47e23f78f8a13e99d9588e564aff866e8f700e7a0650a83
123d4b411f97e36f72e2f44be0b18944489e908ff159f59ab8aba984c69517fe
16f86804dd013db340fee4020a539d3e9d6e5a03d6841e431e50c428e99c26e8
17cfd03c7324bff29a75eed9529fb31764b922489e32030d4acabea1cc5a216f
1aba8822e3f693e42c79877d0ec6d34e7066e69e0cac0c4565683e45b1021505
1ac5da3617c6ccb517dade95622e1bccd6d7a8ab728c4643af97f2451eeb4ec3
1bf55bc00dbf13180884211c3d301729e67b81f3456225c1fbf97d271d636509
1c7dcc8216c6f82da2998ceeac2523632c7f9bffe510824b6d082621201f2012
1c89250469c4a6df401abf15a6bafed900638d24b7e497b9327124a59b80c0ed
1defb6bc54a7ee9c066136908360e8455c23ee9ad0dec9924e7255d7948cd4be
1f9cd4a445ba85172da6090dd7b95edf55fd9e81ddb193e0b78093c1afa84378
20660a9ef7ec454c15b2dc62b3db084e0cc9f74c5bb6de71a96fb1a54aef00f8
256b712bc8b7729e9ab23a024cfa5241ce2d3461d6261865a89f4b87e91ebe7f
27348ba4b98bd80f1038496ec5dea6ad865680540058fb085b8ca199b8aaf4c5
28b5a75f7339ffebacdb4e85a3b2d68166f71545bee3a7f24492d1756cc08f7c
2ad6f11aca9703e03bfe4c7bfc653ed76c80da9ead9eb8fbd4c4f883e967caba
2bd6c30a523ce8b33d96dc79b1d759b5d5634740ae76aa6557e2d3741082e067
2ce03e3bdeca58a8832b858702a266445555ba994c4f94df36751e219ffe1c8f
2db34386505467cf0982cbdecdc8303c7b2ac8feee1519487168834d4536c60a
2f17ab3ac118eeddb8ac29b08b41a35c0a5f6cdb4a94097c69a36569c5e4d87e
32e259fcf07036fb5f684a5de4b40bd9b74beb935b12cba472e4e3afb3b56b08
351983692b8afc693537c1bc9cb395e8f2598ac80b12ae965ac1b6c49827ef73
351e508c1da4f9d1535747086accb41121466a52044aa868eba4a36009fdb101
379132c4208354e068f4a748b2126380dbca4a94f8c744fb6b02ca7f1f30e8f6
3c113d157ed4ce3b4f80767998fba3f8dc9900f3945f619329afe5e386f02660
3ce7e824185893264ab44fbf8370a8f1262831c4c6c367b15f7d4f1e88fadc8c
461e49b8fa83529ed9a7ebafcf200213d78d38d545083fe8de902ea25d2d5d37
46a9ddb1f206a46900872e0a832750ae06925528f81883a3d3517fdb42aefb6d
4898c2b9f8c2f931ef6a819d36e0019867931d9519af933ab4bd5edce724b2a8
49222defe350690c02c86315654351fdc2dda500c5c20c64fa72321cc564a267
49282a74c6ced31e99f808232188ade8d82652004df4d664dcdb98c32563dd39
4980853759711c8e9e2779239acd62e9e802fba38371763c65ecdd016a83fdbd
4b188a568fa90fa61d4bbe76dd6cf523abe65787e0ac3dc6b5c44db5e823685b
4bf5b1275a106cdf837f2053be09f6fa57d473bb7ca029f456c7a31ffa0c19ac
4db16433a1f26ff7f90e3525190e9debe2ac5545309ab47e5a06133e06f9f128
4ec4b6769730ca98db1f40b152c52bd5bec01f61f559fb92709c307750388ac8
50ef3043544193fed57957cde3087cb24a4af2a605c37a6ddc4c11105ac7bbe0
50f762386cb9f2b1f96aa93356b1e3d7a5063bc1bd5a4bc62d849fc52a971b07
5315cf641e62ac7de4a82e6003cc1bd1ff09218400d8ff5286c951e25aee966b
543503d624bea2b1bf99cebc7728bf03a5a0d820f9db140a3dab3044c1f77632
55953987d8104311838ce0414adb751e86b32a69a9cbb441381ef67f1c4bbbb2
56f8838a24cb0cc47dc34a19d6b84d6ce8bf8086b1682bbb990abc13b1e2da65
577d41cdf575c24619ed9f4609d74905e67b4afe20b50ecbda5ed2b7311f169d
5840907b4c9bf2f9a2ff4a6ce7f4087fef8dcaf67c8e2b4ccabad6a3b50d18c9
58a617d2c88d378bfd267e2817e2228e82ef0c3f28d8ac3458b18af77335c39e
59201950b83489808587827b4050ffe0597992825daa88c227476cdbbf8ca282
596b76b93c7801ba85fb53f2f6e2281d4dbffc96ddc18bb056e8cb0e94be34fd
5a1b118736ba9dc41f144f350574bec748a1ba0e8b355a99cbfe570ad236b50e
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685
5ab499494548829e507e9b6cd57247a6cd565e7f1bc6eb55e3da445af76f1f0c
5ad2dd79dd70a3e9c03fcb2644b3dec3852424e0c5010a9054012304efe35b82
5c57a0f6d257ca6be9e6bcb6039fea214962c35b7b30fee3dcc112b8cec18d59
5c6c066d45fcff5eb73d9f8c6e7b2d756d46229d4c05a7b776054c71c05c70b4
5e5adf6f3067a94181543155e349c4b4059feca0670da7be23f539f9c08ea34f
5ecbfb541946a9a9437190a21d98e1c7ab7d863837d7d038a9a1e053c649c8ba
605e8b796740ef943e0e6be4215488c0da90f32d46255d31589fbb7c9c13c015
6109d5731632d64df9eb483fcde4fb912fbe0e95eab63b7db6739f7a3f6ee757
62c7d2da9a5942053f17c9756e53b7cda414541619bd35c2b1441cd88c77f235
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
6971adb7fc147ab4028012f8c0afa86bfad4101212c5881d1aab7c2fa6977b39
6bd131d59efb6aa6a2d98ce4af498a811c84f74148129e140ff5a76904ca9f74
6f261533d4b74ae931965cf3609bf47bb55001e39eb7029502d96cec73c4749a
72ff898f6d799030f097fb900d4a78a7ab005254a02e8f76f0455c1cfcc43497
7364fcbb6c5d775f07816712af8a6419db99268f72c337a4977f706dc3423bb3
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
759cbd9881e14214af52dfb585ccf70ea59037598b67cc9cf6df7d3fea7abfd0
7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d
78c8c364b438f0be81f1c51627902fda95b7aebdd2c04aee28c2f72cd4390207
78fafec67c64709fd61d0007d64363ec0a489ede573435a04f94c6c113dd59b4
7c1af4a5acd27fde0f79efb70db17ab2a76fc48884901cab4540e644606a5200
7c7e293df2bbe2936e847fa708aebca6f9818ea17e9584bc46459576a3a80648
7d43b579d6c5211f4bd6a78cd2b7cd726cc226307eab8f37aede3a55ebb3150e
7fc88c65d46e83b3f3e9f098f05fd639480332fc3718cd714725e2e4633af4e8
807271433f80bb33654a84ec904035be3d2b34e505a051e3469a47fe39ccb752
8252f276dd50d6f69c8aed7feb6be52863cf6cfc2348b9ab89814c713e4b556d
82cd1a97f81e5b63a621311be2993916eea0907b5eadd53bb6b280f4bb0f8391
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
833a86642252016b29f08dd45ffd27f9e00ca237f28d8c5f0147a6e15d009377
8379daabd87751a7da8f1ed0c4b558d62f7d19a01b72a7f50153c1ec95f4ac9a
83a366075eb2387c6d9f848f42b08df0546027333eccf5813edf95ba45709be2
83ea4cc1abe0489b72d792344ff8e08c2749d8bd6933a61ab0bdbd7e07c447ca
86096831a70c72ac0c08f5e65ae92d98330d9fd2b7511dde65ff50b8a16bfd9a
875a11a56b643b49e30cb7137449c2ff9b3e47e47eed68e4a024bc17d7286bcd
87bb7b8c0a5fb93a2caca3df4756904b8ff76303f6d3d12085ca0cbf23699b62
8b72952d3fd656ee6594f0d9735d928113ad1d590705b14f77abf75f1d4d5d69
8e00ebebe053ff93e139bab1a80ced2517b33572ab374ae641e0e1cfed58d8e0
8ee04e0441c9e51785d17ac835a93cf4d30d90826f87350b42ba233496a26f55
8fd89c4e7593e7e15a1ecdf7141192ba9751023d1fbfa77ba998df510306b4b5
929701ed632814943e3df803ddd9e3f179ccf889c0ad7b7f3392bd8d109b174f
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
9456ef29bdcd9e5f4cf7e96f01703c134fc56b2a990a5c6e0592488bc03db5e0
981898ccfc444d54beb452d380c685515410830fb12494784729fd1eaa68167f
991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10
9933997608e86beaf1e7f7188a5c657cdad8ccd9d20eb7b1a46adaa83fa850ab
9a4ba60ec6263a87283ed290b98ab1b4447973d91fe47404af49ee70c4165ff3
9b6cce3def0e05937c556763f13b1ca760dd84724666e4b1ee96d39d12df2095
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
a4a43521cee4006a9d54ffc1e769752ea89ea213e5474e886a32a5b7613163c3
a53dc5e7e71ca30d94076f99d34bc1dc6cf4eccf57440434aeb53a0911d4529d
a57b99c9f7d81a6e987239b680250118df12a579bb65dbbd232ba07db027ece3
a91d62b47f02a7e638d1749e3791ac328b2dd89dac630578f76e65b1ed91ed89
a972b7850e0da6563764f0a628cf86e0fcb2a7984abaca122b85e2726d375a7f
ac2a58f9d55c4642121cfb6f7e213cbc882bbdd75ef171ca8a07ed982ef693ce
aef1677736f291276889ef8546a8f0af8af086e120d3cf9adc0ec255418810b3
b2dc46e53b06954bd2df39c8b2a78f75e4589aad0086c7b9cf42e53ec097baeb
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b
b63bb3d84f8bf08742cf309b75b685518d32ab906d540273559bd73b33266458
b76cf3219c684e87a2e9bd78f75467d0b9f89dd9becfcf9d0f2ff1a47f3fb795
c14a030b0b5ef06f710d9bbff164662d4b43c037e62f254aa6280504013caa34
c21029f21dc145723d40362da85504ee5a5bd33f5db6636beae3a01c7aba1fa2
c48b5b1a9776c84602de2306d7903a7241158a5077e7a8519af75c33441b8334
c7f2558d7005dc61e343b6abb61a63da8ace760a0fdd45cb0cc124b0de5b4c2f
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
caa3854f28740fa98125ded826446ee4456379e8ad7c4ff46643347d1901506a
cb332c513481e682f5a087a5be5f3956277cc4f940568a872ab87c14ad536443
cf0bd1da56c1ce18f78560b5bf4fb33dbc214a4254d25c42b92b21cca2f1380d
cf2f2feb30abd07fe96a016a50f07bd6ace1565b14c0c77097012644a3f123a5
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d1506f0e7eddcc25fa7a9a701118490c8d482e65b118489144f5ccee722db516
d196f488c9d906c6c12f43bb514a659cc0b9e0ef586f072645eb47313529a65c
d281c9d6bae645f3da6d2f0769a2cf0668709fd28e2021ce74821cdd8c7117b3
d5f3418a3fa657175d5341b5e032be036cb4d5818de5d1497f2175be5a7e3701
d6f350f62fc19bfd7091e3841649be70e806fb94c00a1f777dbed2ea8ecc9daa
d8435911753d7e931e1dda44b3ec12ce5158d6389131eadb584f0097a809c901
d864616d46389ea4c823da0b356a8d7ab36f38133de303ec8adb884a1f76981a
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
db6b20027165ee0ce424e1861b94c3b08135d048b40507808e3fb2a9bb14ca70
dbc8fb765b93c91460eb006d8c4a1f3332c78fdf0da2a04e357ecc2b0ffedb12
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd02f59e7c35e2164392b968738edf79b7ef3f2ea81879942e50789baa41026a
de24551bd4396fc8579b2d87ce01944553dd48fb52775d14373725a50efa0c37
df70c7e9f881bc2f657f38428a4b594ce371d6eee52d86172b20a45b6242710f
dfefbe3a90043a7d341cbcc2156afc74c658f9eb70e693c79da7ec66bb1e5d76
e336ff50623cff960c2396944be4392139f63dcc032e5f3428d81489fdfe697a
e3a3887bf312677ec43a4bdbc7ba772304f62a1f55573e6c55372f1757cb7f42
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e820c158e61e2d49d32db6151062d7f01fd8f79a1eaacbec311509d584d796e1
ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742
ea4101dd4137f8a8eee9a6f243d17a5cde9db3ea3013a4e16c34418de335a552
ead682b185ed77c02aaf968f56b7bd699b76680256de2e7b7d235d86fd96bf14
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
eb3a4648bbf1eebdfefd7e8716059f1bd319dd2e3dcff586692b7cca4500e8e0
ec4f9cb92382a86382d7d8be4447c7c97bcec7e8136cdbf4d88a11b2f64e9e30
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0edd652f0fc3395f47fda8c616c0a82eef9ea479ebb9897e93370c0f8a122d7
f52e4e999a441c151183d77efd6dad3915e650409ea65b94b7e0fc067dcd0abd
f6914cddfb8fcc3e7d99864e104ebdb47934a357ef08d90f9e0acdf48433d6c9
f70b407b853dd729ed56f834640435a56e2a7d69fb0ea6342edeccc2a82f51be
f95836cdd8c1af1d8261e8e198a4c1dd306e2b50ddc389fe820b56212a9cb17d
f9d9e96c4439beeca49a1a10f9dffe6f5cd0b604d13aa13af170d0bc62d8ca1b
fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf
fd9c4ff9e4c840fd5a0de9b08d276d0c6b21c7810dcc4c829365809082019a48
fd9ee23548e148a3798e79ae0553689b81675afe6791f53d5e8af20973e6a7b0
ffdc18ac8f47bcd50dd9c33532c334e7073717a62b367d95b9cb1561048547dc

arstechnica.com Open in urlscan Pro 3.20.147.38 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

249 Requests

99 %HTTPS

32 %IPv6

39 Domains

68 Subdomains

56 IPs

7 Countries

4249 kBTransfer

10492 kBSize

14 Cookies

46 Outgoing links

Page URL History

Redirected requests

249 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 20 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

arstechnica.com Open in urlscan Pro
3.20.147.38 Public Scan

Screenshot
Live screenshot

Full Image

249
Requests

99 %
HTTPS

32 %
IPv6

39
Domains

68
Subdomains

56
IPs

7
Countries

4249 kB
Transfer

10492 kB
Size

14
Cookies

249 HTTP transactions
20 data transactions