www.zdnet.com Open in urlscan Pro
2a04:4e42:1b::444 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://enews.zdnet.com/ct/55241119:W0XM2y-dN:m:1:2218374048:197AFEA6DAF18B83B422300F60AB4370:r
Effective URL:
https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-...
Submission: On May 23 via api (May 23rd 2020, 1:53:53 am UTC) from US

Summary HTTP 148 Redirects Links 33 Behaviour Indicators

Summary

This website contacted 26 IPs in 5 countries across 20 domains to perform 148 HTTP transactions. The main IP is 2a04:4e42:1b::444, located in Ascension Island and belongs to FASTLY, US. The main domain is www.zdnet.com.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on January 24th 2020. Valid for: a year.

This is the only time www.zdnet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	34.213.240.251 34.213.240.251	16509 (AMAZON-02) (AMAZON-02)
31	2a04:4e42:1b:... 2a04:4e42:1b::444	54113 (FASTLY) (FASTLY)
6	2606:2800:233... 2606:2800:233:1cb7:261b:1f9c:2074:3c	15133 (EDGECAST) (EDGECAST)
3	2a02:26f0:eb:... 2a02:26f0:eb:1a3::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700:10:... 2606:4700:10::6814:b944	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	172.217.22.66 172.217.22.66	15169 (GOOGLE) (GOOGLE)
1	34.102.213.242 34.102.213.242	15169 (GOOGLE) (GOOGLE)
27	2.18.235.40 2.18.235.40	16625 (AKAMAI-AS) (AKAMAI-AS)
9	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
1	35.177.118.109 35.177.118.109	16509 (AMAZON-02) (AMAZON-02)
2	3.11.4.3 3.11.4.3	16509 (AMAZON-02) (AMAZON-02)
1 2	95.101.72.201 95.101.72.201	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	2a02:26f0:6c0... 2a02:26f0:6c00::210:ba13	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	2a02:26f0:eb:... 2a02:26f0:eb:187::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a00:1450:400... 2a00:1450:4001:821::2001	15169 (GOOGLE) (GOOGLE)
16	2a00:1450:400... 2a00:1450:4001:809::2001	15169 (GOOGLE) (GOOGLE)
1	151.101.113.194 151.101.113.194	54113 (FASTLY) (FASTLY)
1	2a04:4e42:1b:... 2a04:4e42:1b::645	54113 (FASTLY) (FASTLY)
13	2a00:1450:400... 2a00:1450:4001:820::2002	15169 (GOOGLE) (GOOGLE)
1	104.111.215.35 104.111.215.35	16625 (AKAMAI-AS) (AKAMAI-AS)
2	52.222.149.172 52.222.149.172	16509 (AMAZON-02) (AMAZON-02)
1 1	2a00:1450:400... 2a00:1450:4001:806::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81f::2002	15169 (GOOGLE) (GOOGLE)
1	52.222.149.47 52.222.149.47	16509 (AMAZON-02) (AMAZON-02)
1	52.28.154.93 52.28.154.93	16509 (AMAZON-02) (AMAZON-02)
3	52.7.144.6 52.7.144.6	14618 (AMAZON-AES) (AMAZON-AES)
1	2a04:4e42:3::720 2a04:4e42:3::720	54113 (FASTLY) (FASTLY)
148	26

1 34.213.240.251 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-213-240-251.us-west-2.compute.amazonaws.com

enews.zdnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

31 2a04:4e42:1b::444 (Ascension Island)

ASN54113 (FASTLY, US)

www.zdnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zdnet4.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
production-cmp.isgprivacy.cbsi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zdnet3.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zdnet2.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zdnet1.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:2800:233:1cb7:261b:1f9c:2074:3c (United States)

ASN15133 (EDGECAST, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:eb:1a3::11a6 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

c.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:b944 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 172.217.22.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s17-in-f66.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.213.242 (United States)

ASN15169 (GOOGLE, US)
PTR: 242.213.102.34.bc.googleusercontent.com

urs.zdnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

27 2.18.235.40 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
px.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cbsdfp5832910442.s.moatpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.177.118.109 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-177-118-109.eu-west-2.compute.amazonaws.com

mb.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.11.4.3 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-11-4-3.eu-west-2.compute.amazonaws.com

geo.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 95.101.72.201 (Ascension Island) 1 redirects

ASN20940 (AKAMAI-ASN1, EU)
PTR: a95-101-72-201.deploy.static.akamaitechnologies.com

trial-eum-clientnsv4-s.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
xhoemrc7mvemsxwiqigq-pab5qm-42c1dbaea-clientnsv4-s.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:6c00::210:ba13 (Ascension Island) 1 redirects

ASN20940 (AKAMAI-ASN1, EU)

trial-eum-clienttons-s.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fiaqj6abeejrukqce3ygyaaaabpmraqn-pab5qm-8bfb698a3-clienttons-s.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:26f0:eb:187::11a6 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

6852bd0b.akstat.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:821::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

373439e2f1e9391cffbd0d77c27529f2.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
002e55dadaf6c0af07df6993f3eb5eb6.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:809::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.113.194 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

clarium.global.ssl.fastly.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:1b::645 (Ascension Island)

ASN54113 (FASTLY, US)

vidtech.cbsinteractive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:820::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.215.35 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-35.deploy.static.akamaitechnologies.com

rev.cbsi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.222.149.172 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-149-172.fra53.r.cloudfront.net

native.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.149.47 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-149-47.fra53.r.cloudfront.net

platform-cdn.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.28.154.93 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-154-93.eu-central-1.compute.amazonaws.com

btlr.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.7.144.6 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-7-144-6.compute-1.amazonaws.com

b.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:3::720 (Ascension Island)

ASN54113 (FASTLY, US)

str-assets.imgix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
27	moatads.com z.moatads.com mb.moatads.com geo.moatads.com px.moatads.com	1 MB
26	cbsistatic.com zdnet4.cbsistatic.com zdnet3.cbsistatic.com zdnet2.cbsistatic.com zdnet1.cbsistatic.com	583 KB
17	doubleclick.net securepubads.g.doubleclick.net googleads.g.doubleclick.net	217 KB
16	googlesyndication.com 373439e2f1e9391cffbd0d77c27529f2.safeframe.googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com 002e55dadaf6c0af07df6993f3eb5eb6.safeframe.googlesyndication.com	67 KB
13	googletagservices.com www.googletagservices.com	347 KB
7	sharethrough.com native.sharethrough.com platform-cdn.sharethrough.com btlr.sharethrough.com b.sharethrough.com	144 KB
7	ampproject.org cdn.ampproject.org	173 KB
6	akstat.io 6852bd0b.akstat.io	2 KB
6	cookielaw.org cdn.cookielaw.org	115 KB
6	zdnet.com 1 redirects enews.zdnet.com www.zdnet.com urs.zdnet.com	259 KB
4	akamaihd.net 2 redirects trial-eum-clientnsv4-s.akamaihd.net xhoemrc7mvemsxwiqigq-pab5qm-42c1dbaea-clientnsv4-s.akamaihd.net trial-eum-clienttons-s.akamaihd.net fiaqj6abeejrukqce3ygyaaaabpmraqn-pab5qm-8bfb698a3-clienttons-s.akamaihd.net	1 KB
3	moatpixel.com cbsdfp5832910442.s.moatpixel.com	759 B
3	google.com 1 redirects adservice.google.com www.google.com	1 KB
3	go-mpulse.net c.go-mpulse.net	53 KB
2	google.de adservice.google.de	1 KB
2	cbsi.com production-cmp.isgprivacy.cbsi.com rev.cbsi.com	13 KB
1	imgix.net str-assets.imgix.net	4 KB
1	cbsinteractive.com vidtech.cbsinteractive.com	281 KB
1	fastly.net clarium.global.ssl.fastly.net	30 KB
1	onetrust.com geolocation.onetrust.com	491 B
148	20

	Domain	Requested by
16	securepubads.g.doubleclick.net	zdnet3.cbsistatic.com securepubads.g.doubleclick.net www.zdnet.com www.googletagservices.com
13	www.googletagservices.com	www.zdnet.com securepubads.g.doubleclick.net rev.cbsi.com
13	px.moatads.com
11	z.moatads.com	zdnet3.cbsistatic.com www.zdnet.com securepubads.g.doubleclick.net
9	tpc.googlesyndication.com	securepubads.g.doubleclick.net www.zdnet.com tpc.googlesyndication.com
9	zdnet4.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com zdnet3.cbsistatic.com
8	zdnet3.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com zdnet3.cbsistatic.com
7	cdn.ampproject.org	clarium.global.ssl.fastly.net securepubads.g.doubleclick.net
6	6852bd0b.akstat.io	zdnet1.cbsistatic.com c.go-mpulse.net
6	zdnet1.cbsistatic.com	zdnet2.cbsistatic.com zdnet3.cbsistatic.com
6	cdn.cookielaw.org	www.zdnet.com cdn.cookielaw.org
5	pagead2.googlesyndication.com	securepubads.g.doubleclick.net
4	www.zdnet.com	zdnet3.cbsistatic.com native.sharethrough.com
3	cbsdfp5832910442.s.moatpixel.com
3	b.sharethrough.com
3	c.go-mpulse.net	www.zdnet.com c.go-mpulse.net zdnet1.cbsistatic.com
3	zdnet2.cbsistatic.com	www.zdnet.com
2	native.sharethrough.com	www.zdnet.com clarium.global.ssl.fastly.net
2	geo.moatads.com	z.moatads.com
2	adservice.google.com	securepubads.g.doubleclick.net www.googletagservices.com
2	adservice.google.de	securepubads.g.doubleclick.net www.googletagservices.com
1	str-assets.imgix.net	native.sharethrough.com
1	002e55dadaf6c0af07df6993f3eb5eb6.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	btlr.sharethrough.com	native.sharethrough.com
1	platform-cdn.sharethrough.com	native.sharethrough.com
1	googleads.g.doubleclick.net	www.zdnet.com
1	www.google.com	1 redirects
1	rev.cbsi.com	www.zdnet.com
1	vidtech.cbsinteractive.com	zdnet2.cbsistatic.com
1	clarium.global.ssl.fastly.net	zdnet3.cbsistatic.com
1	373439e2f1e9391cffbd0d77c27529f2.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	fiaqj6abeejrukqce3ygyaaaabpmraqn-pab5qm-8bfb698a3-clienttons-s.akamaihd.net
1	trial-eum-clienttons-s.akamaihd.net	1 redirects
1	xhoemrc7mvemsxwiqigq-pab5qm-42c1dbaea-clientnsv4-s.akamaihd.net
1	trial-eum-clientnsv4-s.akamaihd.net	1 redirects
1	mb.moatads.com	z.moatads.com
1	urs.zdnet.com	zdnet2.cbsistatic.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	production-cmp.isgprivacy.cbsi.com	www.zdnet.com
1	enews.zdnet.com	1 redirects
148	40

This site contains links to these domains. Also see Links.

Domain
www.zdnet.com.cn
www.zdnet.fr
www.zdnet.de
www.zdnet.co.kr
japan.zdnet.com
www.techrepublic.com
downloads.zdnet.com
news.sophos.com
www.youtube.com
www.cnet.com
cbsi.force.com
www.cbsinteractive.com
www.facebook.com
twitter.com
www.linkedin.com
legalterms.cbsinteractive.com
narratives.zdnet.com
ca.privacy.cbs
cbsi.secure.force.com
academy.zdnet.com
privacy.cbs
onetrust.com

Subject Issuer	Validity	Valid
*.zdnet.com DigiCert SHA2 High Assurance Server CA	`2020-01-24` - `2021-06-18`	a year	crt.sh
*.cbsistatic.com DigiCert SHA2 High Assurance Server CA	`2019-02-22` - `2021-02-26`	2 years	crt.sh
sni9451gl.wpc.edgecastcdn.net DigiCert SHA2 Secure Server CA	`2020-05-07` - `2021-05-12`	a year	crt.sh
*.isgprivacy.cbsi.com DigiCert SHA2 High Assurance Server CA	`2019-10-07` - `2021-10-14`	2 years	crt.sh
akstat.io DigiCert Secure Site ECC CA-1	`2020-05-06` - `2021-08-05`	a year	crt.sh
*.onetrust.com DigiCert SHA2 Secure Server CA	`2020-05-21` - `2022-07-27`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-05-05` - `2020-07-28`	3 months	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
*.google.de GTS CA 1O1	`2020-05-05` - `2020-07-28`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-05-05` - `2020-07-28`	3 months	crt.sh
*.moatads.com DigiCert SHA2 Secure Server CA	`2019-03-12` - `2021-06-10`	2 years	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2019-08-13` - `2020-08-12`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-05-05` - `2020-07-28`	3 months	crt.sh
*.freetls.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-04-21` - `2021-04-22`	a year	crt.sh
vidtech.cbsinteractive.com DigiCert SHA2 High Assurance Server CA	`2018-12-13` - `2020-12-17`	2 years	crt.sh
misc-sni.google.com GTS CA 1O1	`2020-05-05` - `2020-07-28`	3 months	crt.sh
www.cbs.com GeoTrust RSA CA 2018	`2019-04-23` - `2020-07-22`	a year	crt.sh
*.sharethrough.com Amazon	`2019-10-07` - `2020-11-07`	a year	crt.sh
imgix.map.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-08-20` - `2020-08-20`	a year	crt.sh

This page contains 15 frames:

Primary Page: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
Frame ID: 3B353F6634BC0D87FA91FC1DDA9C16F8
Requests: 96 HTTP requests in this frame

Frame: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Frame ID: 4F0DC1FC5967CB828D4BC739592FEEE1
Requests: 4 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstzmg02zIOnjAXtVjhkPGy7wd91G2-fR85eAD6Xa4dzdXcQQdHc_CQfmBBrgoPgJc9Lhx12WvxkWOgPMmwlZzmJTiHBo6bPudj0chRMOTjKBtRUs3OvhwJPY0toI-1RagrKQWhZf-TK9DWZJlg8TXOUHPv30hnr4uz0K7Cb_P0k5y7sI30EBq6pIOhxPkuWWzkAO83mQQQAv3PsmNHpKpxVZD6j54Z66iyJUI3iw6RLmaVacFzvYiISOmchMFtdHYobRNNDIK2-&sai=AMfl-YT8Tgn6naYL0ejs4KJBAlpMczMnwdydDkIY9aQTIo1z3yjMnj4ndn4b3jMfOHH7K3WNKmt0lp3pz1TFggEbVjq-yJJpJ45SuYuLfxqkUQ&sig=Cg0ArKJSzPhLuzBRT11IEAE&urlfix=1&adurl=
Frame ID: A785D99902466958371513AA0E0E2B6E
Requests: 3 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js
Frame ID: F3F73F8915027DE39E731EDA39C4E0CF
Requests: 13 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstXWpLA-vKItG_tUKccCEK26MXtCNXc29ZaMqTSQQuwkov6jGo35Tz0o_UI83XYmc2v5emxH0D8xQLp9N0wZRfIRwtUaVw0o5ccgl8KrA3fRrXyOBAsja4zHpJnlQ4bQczD4oJaqKSdbMcDkZ57YhrViJSjKlcOqJilbkQAgnm7dacjRboPG7I6njbRxS9Vju64teC9Xb8fRjUJbl9sG_PAIjUjxzxUS6HluYoiUjuZuXe2h-w2T5hUIFe4k-FV4fzJQLqxn_SM&sai=AMfl-YT80BypJ10uoWldFeS_mf5UY7WggVEEVAB2sf6Kyi8SscsNgWpEi9HRxEycv0JgXqRiBAMClman6Kln70N0T4lwXD4aCKe1D5os_vSv_g&sig=Cg0ArKJSzFMrREuyvzMYEAE&urlfix=1&adurl=
Frame ID: 7FCCFC6EA307D47DE9AD3A12CF13E05C
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuySOTqma6jZ2ZAlD6qMyTiYfZ88C7Ij80HKYeY8ck7EDbCoG5cC0jXRuDuWIc53oH9BRorJ4o-cQdDOmKJ5VjYE1Ewccp2mj8ZZ2taZTX_IBPBQ1h6yV5CFrup7JbG0AGP7DE6cT9cue0Fky_ZhpsOVFqFn0C-UkpioS4F1Fik8efbFoFQdwspWtPgFrdkpRRHXmHma8NnDWkcn6L4poHHZepG6VuTXYiTReC7C3613eCfTgOOm3LXPNxsplzdYA-XcbOFqERN&sai=AMfl-YQj41WQTNSi5SX71GTrwL4C8zDp5athvPr4m9EaR8Akwho-HVlIyXBGf5b-WgFrIiMtu2ASDq_LCgW7HNMiVxC10ygBt0qIkV8tVqMXSA&sig=Cg0ArKJSzPRDQEZ6oJwoEAE&urlfix=1&adurl=
Frame ID: 4D8BD85AB6E235EA3F46B5E8246B8D57
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsui49XhDhZoWlB0H1xcUTRULrWFwojEymK32Gx4XMMuFjg-y5qNP_8Cl2T9gbGDxRFtSsE9e_u0B2_1o9BlLPFRzG8RP8cPqizAboCSYipByPPQfZhjH_gpjB10YZvQfudfgQrFvXd7JXCTufoZTih96uhWqMYYD5Ol-Jc0tawAg9tPiIrbWCCbt8NBFaC-lzIxqPd6gWzfgUt8AX-ccSIFzsttw4KDQLfXB63VqTtjunmX9o4p-8cu8U4if4xyaqnV1lfS7cXU&sai=AMfl-YREG1rlstd87hQMjNRFYQmo7VItNJEaQM172lnKqqabMnPBk8lUT5MNJfZ-N6zRSreRsMX3dH1bQIfv4E46Av-voM1nz0RNLnAowkxt6Q&sig=Cg0ArKJSzLaVAPYdtK0rEAE&urlfix=1&adurl=
Frame ID: A9E1EF365F1588057B8D08CE13D76B21
Requests: 15 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuQdI0NyksfqWnl3_m5LiBgcMgpOPS5Oqe6v6v48A1apxSXbxmEsYHZBTgiLII9dESOl0iRw94YFRsR2lA6Q1fuzO0ucOGcBzgyGpHXzmR5lqttkahntt-uINH1lTjjj4VtbXGcsYAD-cFR6nH9Rnk-ctjpLnbz_jfdZ-bcljs4xsmuIYGX2vL-FaYuiAMN7YMkgZExGeBNqylUCG2AhTctItVI81gwiAVTjoVJ4B3zus7NLr5amO2FcaA4lwOXUfzIq9VQ4btx&sai=AMfl-YTnzl2JiqbVqn3ddtXhbvLQOe1GHNNFWCn8TWM_64lU3G5PvLFRq0vkTjh7owzidYKKLiCBs1vbBhcm52YJz9vLMUq8ddA4SjNOxKJwaA&sig=Cg0ArKJSzNy8vMKz7zAGEAE&urlfix=1&adurl=
Frame ID: A602172D878064420CD77C1403CA8C46
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsscCfhafkFmRXmK2BKn_PAFGLPr6n_0Ssb1UgA9PgGeHkII86dEcMYS55alASfkN3GUhCs3DDjlREGB5yNz5Vfi5MEIG5wZBm92nq9B8rjR0jgNOdZSrRcUjrM6deZwKNSQiMtTLuhzPx_32RfKymPjg61xUSvBHRHACRJzPPpn4wXF9BcYwzUAZulSVjxe9wKp8iYT1vqiSoX9_AHKYq_PP5SNIYRX4UJ_r7m4fu0qvRGe1Il3HrGTFpgJ4RUyhPAl39XcxNuMWzPbDQ&sai=AMfl-YQtMKcUP_4wYtdyaJHeSFijEb8TA8AhsEJaeh9Mi4f2LjrnROYssKo9PGcg0VZojSMEd30ADyt5hfZ9sEnYzWabQSJKIr5exzg362Sk7g&sig=Cg0ArKJSzDwTlYEHkbwpEAE&urlfix=1&adurl=
Frame ID: 5D91DB72FB62457A91F61F33CCC18FEE
Requests: 5 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstatx6csPVh-1zZAdeLBdkrOdM709_qcEPfrNBMiDqiaD3Pbw3k_JFALv_vk8G9lq8hIynhsNQ3tdzBk4jgR2hr9ADgZjR3hDkszS5A6ZNgpd6Sh_1pzXYHbMI7RIsPUkpPHgLm9X6h0Fd5UsWgCBs_8Khap1EB-3-RqcGi_BPcBHfQaJiSRVPOb75mD_O0oIXxIkBTnxKJcmRl6DDXd2QRSbArL5tVzBq_58ZxoLyl2r8EO03Giu6kXhvUv6HPDpjyJMdpSiIj&sai=AMfl-YSP6xpkoSszNz9pck5hvQiB5OocbcRKrp3Bw06fxVC8c9BrbpwZZD1NKgoG7eawaXUZrbI8y3X3eivSKBZGq4eQDaoN5Pgcbo9cguARYw&sig=Cg0ArKJSzOcYb41UiTDpEAE&urlfix=1&adurl=
Frame ID: 47BF2D60796CE99ACAE682247A4B028A
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstlxE43hkQHsb4DBZmSB4Akc2u8OoBqG6FtqILOx52R49lFJ7JPa07oZTDJPxf4wPSP8OEaCI0La1GJj3RJ9GMlJxnInylsxUdcrly9R6huEH7pckmXw-CdBkYhy8owY_1Sbcn0uNJYEJLXVshgPQC22jqQhvqU4GCHsQvnIzhhWOg40tr5UyEA-TUGzLxj78FrDuY4vwpTdpItiljnu3pcNsDtJpxJc5dthpElQj7bbF9zg1UzUmVEUNpdr3CEt2uY4oSBBTqc&sai=AMfl-YR82lHDe7DP88LeyEnm7o-PW_3Awq10QUlMU2GVQKshlx_4DBD0N1XfuKbNLMBZhirBmULtfWHXa1MaL-kQI2Ns3q18JNLQauaFeP_1dg&sig=Cg0ArKJSzNF_ZVNdYw53EAE&urlfix=1&adurl=
Frame ID: DDDC3B933767CFBA2AB3C4355EA1D08B
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: FE5FEEEE061FFE3CA1A415BE565B9FAB
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvY7nVcaJ3c5WkHFNIgMTAtxQo-26fU1-8soYXd__s3XC16Fn0FTIgY_yMLlS5SFga5ZOOG5_dwLzZGPPvZC6ZIGWACQ_2aEmFBCgsiqncoWJYU91D33X0QzVXPXPyFBJJgN6s8Ft-De_zNXsbKnl7icDuyPDCqn1rXqpDmE_c9B02iyVj30j10RihgZy7FzsrKe4YP2VhxD_qKUGtgWCKrqbvki7H677C-BjLE1pfLDpWXzTWCfj2jxZ5fLHiOgLXz0MKry7Xy&sai=AMfl-YRsAN_uAEJZH9EYHzp4GfkDn7KyKxHqr5wpLXk5vAF4pTzKdmdvq45m7jRQuhI5aXqfXP8M5qtn3wYjG5S9BdhUr4LP7V4fUVx8Tt3W&sig=Cg0ArKJSzOJbXr-S64CMEAE&urlfix=1&adurl=
Frame ID: 7FC5EB90ADCF79AA9710D6854599C564
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsun73d6Gg9tEPAh4G_wLVhO3lJhbUb_dj5WjXwI3XU0nI_nb_RVUvTBmJmoUbq7SvN_sjqs3hJbjVvESjPzUcCRTXoaN3-kEFN_-7QWcBs2ukfAkN3SFP10avQ8jrxNxJSKzmz8b5SWQ9bNqqWXviyBwYL3D4GrqorTrzhCRjthiDQwWSu2hGzgwpIjJcen222lEkPOfyWUONoFcoN5J7iIAT-QwTP3cdyA7fglnAPyLFi38PxXc1P8qsIdbC8bnGZxkUEciYG7&sai=AMfl-YSkSEJaSPpo4C53PMePo86Dwa3rpHaa6T0oWm23GMP7853-y80vL9_s_ochIHkP3UTn0TLjov1NcbLErqvIA-p8e2vQeAb5J_MsNI-o&sig=Cg0ArKJSzJ_fEJ02abmxEAE&urlfix=1&adurl=
Frame ID: 77C22ED09F1E406E1EF58252F724ED34
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 136A33D85744A311F8A933A70DD84BF2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://enews.zdnet.com/ct/55241119:W0XM2y-dN:m:1:2218374048:197AFEA6DAF18B83B422300F60AB4370:r HTTP 302
https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-so... Page URL

Page Statistics

148
Requests

100 %
HTTPS

52 %
IPv6

20
Domains

40
Subdomains

26
IPs

5
Countries

3429 kB
Transfer

10263 kB
Size

12
Cookies

33 Outgoing links

These are links going to different origins than the main page.

URL: http://www.zdnet.com.cn/
Title: ZDNet China

Search URL Search Domain Scan URL

URL: http://www.zdnet.fr/
Title: ZDNet France

Search URL Search Domain Scan URL

URL: http://www.zdnet.de/
Title: ZDNet Germany

Search URL Search Domain Scan URL

URL: http://www.zdnet.co.kr/
Title: ZDNet Korea

Search URL Search Domain Scan URL

URL: http://japan.zdnet.com/
Title: ZDNet Japan

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/resource-library/whitepapers/
Title: White Papers

Search URL Search Domain Scan URL

URL: https://downloads.zdnet.com/
Title: Downloads

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/forums/
Title: TechRepublic Forums

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/resource-library/whitepapers/10-dangerous-app-vulnerabilities-to-watch-out-for-free-pdf/?ftag=CMG-01-10aaa1b
Title: 10 dangerous app vulnerabilities to watch out for (free PDF)

Search URL Search Domain Scan URL

URL: https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/
Title: in Sophos' recent report

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=0bBS6KOWRA0
Title: How to protect smart factories and networks from cyber attacks (ZDNet YouTube)

Search URL Search Domain Scan URL

URL: https://www.cnet.com/how-to/top-cheap-home-security-devices-in-2020-amazon-echo-smart-cam-wyze/?ftag=CMG-01-10aaa1b
Title: Top 6 cheap home security devices in 2020 (CNET)

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/article/why-organizations-shouldnt-automatically-give-in-to-ransomware-demands/?ftag=CMG-01-10aaa1b
Title: Why organizations shouldn't automatically give in to ransomware demands (TechRepublic)

Search URL Search Domain Scan URL

URL: http://cbsi.force.com/CBSi/zdnetcommunityfaq
Title: Community Guidelines

Search URL Search Domain Scan URL

URL: http://www.cbsinteractive.com/legal/cbsi/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.cbsinteractive.com/legal/cbsi/privacy-policy/highlights
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.facebook.com/pages/ZDNet/5953112932
Title:

Search URL Search Domain Scan URL

URL: http://twitter.com/zdnet
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/zdnet-com
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCr9QWb5RKLfaunjKHJZAdQQ
Title:

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/cookies
Title: Cookies

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/adchoice
Title: Ad Choice

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/eula
Title: Mobile User Agreement

Search URL Search Domain Scan URL

URL: http://narratives.zdnet.com/
Title: Sponsored Narratives

Search URL Search Domain Scan URL

URL: https://ca.privacy.cbs/
Title: CA Privacy/Info We Collect

Search URL Search Domain Scan URL

URL: https://ca.privacy.cbs/donotsell
Title: CA Do Not Sell My Info

Search URL Search Domain Scan URL

URL: https://cbsi.secure.force.com/CBSi/knowledgehome?referer=zdnet.com
Title: Site Assistance

Search URL Search Domain Scan URL

URL: https://academy.zdnet.com/
Title: ZDNet Academy

Search URL Search Domain Scan URL

URL: https://www.cbsinteractive.com/legal/cbsi/privacy-policy/cookies-and-beacons
Title: Cookie Policy

Search URL Search Domain Scan URL

URL: https://privacy.cbs/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://enews.zdnet.com/ct/55241119:W0XM2y-dN:m:1:2218374048:197AFEA6DAF18B83B422300F60AB4370:r HTTP 302
https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 39

https://trial-eum-clientnsv4-s.akamaihd.net/eum/getdns.txt?c=pab5qmuwr HTTP 302
https://xhoemrc7mvemsxwiqigq-pab5qm-42c1dbaea-clientnsv4-s.akamaihd.net/eum/results.txt

Request Chain 40

https://trial-eum-clienttons-s.akamaihd.net/eum/getdns.txt?c=pab5qmuwr HTTP 302
https://fiaqj6abeejrukqce3ygyaaaabpmraqn-pab5qm-8bfb698a3-clienttons-s.akamaihd.net/eum/results.txt

Request Chain 114

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

148 HTTP transactions
11 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/
Redirect Chain

http://enews.zdnet.com/ct/55241119:W0XM2y-dN:m:1:2218374048:197AFEA6DAF18B83B422300F60AB4370:r
https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048

498 KB
143 KB

1147ms
1132ms

Document
text/html

2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

92fc2d3a18374bd7c240c58e3dceade8cfc0a4665a98595babfcf9d253850fa5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.zdnet.com
:scheme: https
:path: /article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
content-type: text/html; charset=UTF-8
x-tx-id: b44a7ded-9823-490e-bd0d-0676fbb5bbf4
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
last-modified: Sat, 23 May 2020 01:53:16 GMT
content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
x-frame-options: SAMEORIGIN
access-control-allow-origin: https://www.zdnet.com
content-encoding: gzip
date: Sat, 23 May 2020 01:53:16 GMT
cache-control: max-age=5400, private
expires: Sat, 23 May 2020 03:23:16 GMT
set-cookie: fly_geo={"countryCode": "de"}; max-age=604800; path=/; domain=.zdnet.com; Secure; fly_device=desktop; max-age=604800; path=/; domain=.zdnet.com; Secure; fly_preferred_edition=eu; path=/; domain=.zdnet.com; Secure; fly_default_edition=eu; path=/; domain=.zdnet.com; Secure;
vary: Accept-Encoding, User-Agent
strict-transport-security: max-age=63072000; includeSubDomains; preload
accept-ranges: bytes
content-length: 145028

Redirect headers

Date: Sat, 23 May 2020 01:53:15 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 290
Connection: keep-alive
Set-Cookie: AWSALB=75kkohdmaXHCYxB4VggzoNUib0MIeZwzryxHM6lHyMtMcGJWhH+Uh3kQcuxD2v6U1j0qtZShdVMI/QtypaL8RXZzvA9jpSIkvEVEqhHAEkvZAEamTUWyHh0BEovM; Expires=Sat, 30 May 2020 01:53:15 GMT; Path=/ AWSALBCORS=75kkohdmaXHCYxB4VggzoNUib0MIeZwzryxHM6lHyMtMcGJWhH+Uh3kQcuxD2v6U1j0qtZShdVMI/QtypaL8RXZzvA9jpSIkvEVEqhHAEkvZAEamTUWyHh0BEovM; Expires=Sat, 30 May 2020 01:53:15 GMT; Path=/; SameSite=None
Server: Apache
Vary: X-Forwarded-Proto,Accept-Encoding
AMFplus-Ver: 1.4.0.0
Cache-Control: no-cache
Pragma: no-cache
Location: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
Content-Encoding: gzip

GET
H2 200 main-9e24e995f0-rev.css
zdnet4.cbsistatic.com/fly/2080-fly/css/core/ 352 KB
64 KB 31ms
6ms Stylesheet
text/css 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/2080-fly/css/core/main-9e24e995f0-rev.css

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

cbd4067b9b23b6dbb1c93b29e486b63c29519a18c109709dcac8b403f2aaef43

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 106147
status: 200
vary: Accept-Encoding
content-length: 64830
x-xss-protection: 1; mode=block
last-modified: Thu, 21 May 2020 20:14:24 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5ec6e120-580b4"
strict-transport-security: max-age=31536000
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 28 May 2020 20:24:07 GMT

GET
H2 200 controls-c211933315-rev.css
zdnet4.cbsistatic.com/fly/css/video/htmlPlayerControls/ 19 KB
4 KB 31ms
7ms Stylesheet
text/css 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-c211933315-rev.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

5f58ad72f5ad3047a55809c3211e4309fa7f0d1d2ecf2adde35ccd1355718237

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 106147
status: 200
vary: Accept-Encoding
content-length: 4104
x-xss-protection: 1; mode=block
last-modified: Thu, 21 May 2020 20:14:36 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5ec6e12c-4b71"
strict-transport-security: max-age=31536000
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 28 May 2020 20:24:08 GMT

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 11 KB
4 KB 25ms
6ms Script
application/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FE8) /
Resource Hash: 3964d65266975abb7c3bacd4b4f1c55655ce97900a52d07ebaae9e502de19cd7

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 23 May 2020 01:53:16 GMT
content-encoding: gzip
content-md5: fYXzI9midUK36U6D+i3Smw==
age: 13335
x-cache: HIT
status: 200
content-length: 3720
x-ms-lease-status: unlocked
last-modified: Thu, 21 May 2020 14:44:10 GMT
server: ECAcc (frc/8FE8)
etag: 0x8D7FD956C7AD41C
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: b033046b-e01e-003a-4f85-309b45000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Sat, 23 May 2020 05:53:16 GMT

GET
H2 200 optanon.js Show response
production-cmp.isgprivacy.cbsi.com/dist/ 35 KB
10 KB 19ms
6ms Script
application/x-javascript 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://production-cmp.isgprivacy.cbsi.com/dist/optanon.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

1d93d85e9887c861e43962220f8ae363c16197932c5ffa3620eb42bb3c216a99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 951
x-cache: HIT
status: 200
x-cache-hits: 31
vary: Accept-Encoding
content-length: 10074
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4056-HHN
access-control-allow-origin: *
last-modified: Mon, 11 May 2020 16:23:55 GMT
x-timer: S1590198797.824941,VS0,VE0
x-frame-options: SAMEORIGIN
etag: "b7a27fff8da8a3fc715c5003c0e1ea15"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
via: 1.1 varnish
access-control-expose-headers: X-CDN
accept-ranges: bytes
x-amz-id-2: /9L4wnsdUCwh/Zqklma2P9d9kpCkDC5sxb6mroQ9Kd0vY61FPr6Eow0aVFB7W2Da7raLcOeOnm4=

GET
H2 200 catalin-cimpanu.jpg
zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/ 907 B
1 KB 8ms
6ms Image
image/jpeg 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/catalin-cimpanu.jpg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

70d1b63641ae86512ee80c400ae1c15c7b5d723d2c9517a75f7637b22707e13f

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7893919
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 865
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"621461af90cadfdaf0e8d4cc25129f91"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 ragnarlocker.jpg
zdnet2.cbsistatic.com/hub/i/2020/05/21/2fd972cf-3cea-437f-b133-f667b5aea58f/ 34 KB
33 KB 31ms
8ms Image
image/jpeg 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/2020/05/21/2fd972cf-3cea-437f-b133-f667b5aea58f/ragnarlocker.jpg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

6588b5f8796b1a393ab1866fa04b36e49a8cc45af863ee2a4168de17d3f93049

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 87938
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 33667
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"98f67d0c03e88f22c2d9f2930848b8fa"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 require-2.1.2.js Show response
zdnet2.cbsistatic.com/fly/js/libs/ 16 KB
6 KB 30ms
7ms Script
application/javascript 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

a70d5b9ad136255942779acf94da5cc72316fde5c10c5e7707d6f1888f43dcb8

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 398297
status: 200
vary: Accept-Encoding
content-length: 6288
x-xss-protection: 1; mode=block
last-modified: Wed, 13 May 2020 18:22:29 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5ebc3ae5-3f88"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 25 May 2020 11:14:58 GMT

GET
H/1.1 200
OK YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Show response
c.go-mpulse.net/boomerang/ Frame 4F0D 202 KB
51 KB 26ms
8ms Script
application/javascript 2a02:26f0:eb:1a3::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:eb:1a3::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: Akamai Resource Optimizer /
Resource Hash: 95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 23 May 2020 01:53:16 GMT
Content-Encoding: br
Last-Modified: Mon, 13 Apr 2020 07:30:35 GMT
Server: Akamai Resource Optimizer
Vary: Accept-Encoding
Content-Type: application/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800, s-maxage=604800
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 51580

GET
DATA 200
OK truncated
/ 31 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f3e2e0f12c5badfe408d69bf6c0fa9ce6247f9a45c849851a53b8647637cfcd0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfd272053c730cd470302af475eb401d9be41c81f0081c20d7910f6c12732c9d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 95783bf43b78701a92daf5ec7268db97c7144599c774821126b8cc5396724bfa

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 917 B
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 mag-white01.png
zdnet2.cbsistatic.com/fly/1590091889-asset/bundles/zdnetcss/images/core/ 1 KB
1000 B 21ms
7ms Image
image/png 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/fly/1590091889-asset/bundles/zdnetcss/images/core/mag-white01.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://zdnet4.cbsistatic.com/fly/2080-fly/css/core/main-9e24e995f0-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 106147
status: 200
vary: Accept-Encoding
content-length: 936
x-xss-protection: 1; mode=block
last-modified: Thu, 21 May 2020 20:11:29 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5ec6e071-4f1"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 28 May 2020 20:24:09 GMT

GET
H2 200 logo.png
zdnet3.cbsistatic.com/fly/1590091889-asset/bundles/zdnetcss/images/core/ 4 KB
4 KB 6ms
5ms Image
image/png 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/fly/1590091889-asset/bundles/zdnetcss/images/core/logo.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://zdnet4.cbsistatic.com/fly/2080-fly/css/core/main-9e24e995f0-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 106147
status: 200
vary: Accept-Encoding
content-length: 4128
x-xss-protection: 1; mode=block
last-modified: Thu, 21 May 2020 20:11:29 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5ec6e071-1009"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 28 May 2020 20:24:09 GMT

GET
H2 200 Semibold.woff2
zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/ 20 KB
20 KB 19ms
7ms Font
font/woff2 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/Semibold.woff2

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

21c9c7889404394d4e4c780022b56b5fa39e83b19c34eb0508561a115a1dcc6a

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://zdnet4.cbsistatic.com/fly/2080-fly/css/core/main-9e24e995f0-rev.css
Origin: https://www.zdnet.com

Response headers

date: Sat, 23 May 2020 01:53:16 GMT
x-content-type-options: nosniff
age: 7386795
status: 200
vary: Accept-Encoding
content-length: 20344
x-xss-protection: 1; mode=block
last-modified: Thu, 27 Feb 2020 13:35:38 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5e57c5aa-4f78"
strict-transport-security: max-age=31536000
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Feb 2021 13:59:59 GMT

GET
H2 200 Regular.woff2
zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/ 20 KB
20 KB 19ms
7ms Font
font/woff2 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/Regular.woff2

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

7fa1c7b1686f9f116183456c39f7b3ed9cce063cfb428e575fe4a29ae05c4fa6

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://zdnet4.cbsistatic.com/fly/2080-fly/css/core/main-9e24e995f0-rev.css
Origin: https://www.zdnet.com

Response headers

date: Sat, 23 May 2020 01:53:16 GMT
x-content-type-options: nosniff
age: 7386797
status: 200
vary: Accept-Encoding
content-length: 20256
x-xss-protection: 1; mode=block
last-modified: Thu, 27 Feb 2020 13:35:38 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5e57c5aa-4f20"
strict-transport-security: max-age=31536000
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Feb 2021 13:59:59 GMT

GET
H2 200 bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c.json Show response
cdn.cookielaw.org/consent/bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c/ 3 KB
2 KB 26ms
9ms XHR
application/x-javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/consent/bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c/bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c.json
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8EA3) /
Resource Hash: 6dfd67b5caf5008673dccf714c3004096995e270d0ce7b2eb7660fabb23882b1

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 23 May 2020 01:53:16 GMT
content-encoding: gzip
content-md5: FPP1gGWWYAUISgNGO+bdYg==
age: 13299
x-cache: HIT
status: 200
content-length: 1139
x-ms-lease-status: unlocked
last-modified: Mon, 11 May 2020 21:51:59 GMT
server: ECAcc (frc/8EA3)
etag: 0x8D7F5F58852B20E
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 2e2dc8de-301e-0151-4585-308046000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Sat, 23 May 2020 05:53:16 GMT

GET
H2 200 main.default.js Show response
zdnet3.cbsistatic.com/fly/2080-fly/js/ 658 KB
209 KB 9ms
9ms Script
application/javascript 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/2080-fly/js/main.default.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

2fa22d861597ee6a998776dd0db0cbadcb62a1dc7ac4f8f57ab4c5d5f5f30e3d

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 106147
status: 200
vary: Accept-Encoding
content-length: 214198
x-xss-protection: 1; mode=block
last-modified: Thu, 21 May 2020 20:14:41 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5ec6e131-a474c"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 28 May 2020 20:24:09 GMT

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/ Frame 4F0D 2 KB
1 KB 26ms
12ms XHR
application/json 2a02:26f0:eb:1a3::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5300663&v=1.632.0&if=&sl=0&si=wynib1q2h6c-qarh8t&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,LOGN&acao=
Requested by: Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:eb:1a3::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: 885e5e2eb1e6d9ddac93bd213b44b176ed3bf4054c236157b14442024245cfe2

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 23 May 2020 01:53:16 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 822

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 115 B
491 B 37ms
22ms Script
text/javascript 2606:4700:10::6814:b944
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:b944 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6109d5731632d64df9eb483fcde4fb912fbe0e95eab63b7db6739f7a3f6ee757

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:16 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 597b24711e06d725-FRA
cf-request-id: 02e0d51ab00000d725a9128200000001

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 43 KB
14 KB 65ms
41ms Script
text/javascript 172.217.22.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2080-fly/js/main.default.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

sffe /

Resource Hash

70484d6450dacdea0cc8d8461da8765c8b212eb25e323d7f5cc82e63dbc6fc77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "523 / 290 of 1000 / last-modified: 1590083614"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14368
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:17 GMT

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.0.0/ 310 KB
68 KB 7ms
6ms Script
application/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/6.0.0/otBannerSdk.js
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8E9E) /
Resource Hash: 139cc4ad53b8f5a98945419b1574ec312878cdd2e5082146bbf26d47b67d32e6

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
content-md5: USgIRL5p1n4UIfGM/ezU7A==
age: 7534
x-cache: HIT
status: 200
content-length: 69509
x-ms-lease-status: unlocked
last-modified: Thu, 07 May 2020 17:15:11 GMT
server: ECAcc (frc/8E9E)
etag: 0x8D7F2AA3358BA1B
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: cd281db0-b01e-0044-4693-30048a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Sat, 23 May 2020 05:53:17 GMT

GET
H2 200 urs.js Show response
urs.zdnet.com/sdk/ 50 KB
50 KB 256ms
115ms Script
application/javascript 34.102.213.242
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://urs.zdnet.com/sdk/urs.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.213.242 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 242.213.102.34.bc.googleusercontent.com
Software: /
Resource Hash: fb7a86f12d2f0ac2f4111c147415ab30f9c7d84c5e15faba3875fce7ce590127

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
via: 1.1 google
last-modified: Mon, 13 Apr 2020 17:57:02 GMT
etag: "5e94a7ee-c803"
content-type: application/javascript
status: 200
accept-ranges: bytes
alt-svc: clear
content-length: 51203

GET
H2 200 moatheader.js Show response
z.moatads.com/cbsprebidheader506831276743/ 200 KB
71 KB 27ms
7ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsprebidheader506831276743/moatheader.js
Requested by: Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2080-fly/js/main.default.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 3e739d0fcd6811c6f2c97393b66431eda17c61ebbdd01b88344e90a7a7a90c0b

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
last-modified: Wed, 11 Mar 2020 17:17:53 GMT
server: AmazonS3
x-amz-request-id: A95962625AD6FA63
etag: "6d1c9d5f2e90a2e13a74e809a3b63438"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=8041
accept-ranges: bytes
content-length: 72041
x-amz-id-2: lcqrTBtk0dQkZvGlHmYLv6hDqSbce36T9QjzhHojHNqdyxQY+p4hdhTnzEzoUzqZ75NuuGVY7Q8=

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c/bac19328-3673-4434-b575-5b669b4d361d/ 99 KB
18 KB 8ms
8ms Fetch
application/x-javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/consent/bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c/bac19328-3673-4434-b575-5b669b4d361d/en.json
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.0.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FE1) /
Resource Hash: 9f92f7c796f6c52f9ba3a79df0f8348e076bf5d066f5d35f5c2ccd7da3d9ed1d

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
content-md5: XoJSJA2FFHP2kCuvD83Dxw==
age: 13280
x-cache: HIT
status: 200
content-length: 17904
x-ms-lease-status: unlocked
last-modified: Mon, 11 May 2020 21:52:03 GMT
server: ECAcc (frc/8FE1)
etag: 0x8D7F5F58A3451D2
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 20b3127e-201e-0123-5d86-30f178000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Sat, 23 May 2020 05:53:17 GMT

GET
H2 200 mpulse-1.0.2.js Show response
zdnet1.cbsistatic.com/fly/js/libs/ 61 KB
13 KB 14ms
6ms Script
application/javascript 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

ea7373d7059ab32d4304249b48a91311f91d2dce5e1ebf10450f33f9a8c5f5ec

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 31621
status: 200
vary: Accept-Encoding
content-length: 13447
x-xss-protection: 1; mode=block
last-modified: Thu, 21 May 2020 20:14:41 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5ec6e131-f278"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 May 2020 17:06:15 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
952 B 30ms
16ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
952 B 29ms
15ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2020050602.js Show response
securepubads.g.doubleclick.net/gpt/ 243 KB
87 KB 48ms
46ms Script
text/javascript 172.217.22.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js?21066225

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

sffe /

Resource Hash

c4b5c1f949f059e3abb05ddcb7cc9944f8c16811e0eb1db9003bc5f8a4eb0634

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 06 May 2020 17:23:28 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 89224
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:17 GMT

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.0.0/assets/ 17 KB
3 KB 7ms
6ms Fetch
application/json 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/6.0.0/assets/otFlat.json
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.0.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F3B) /
Resource Hash: 9252479eed19b6733fe0abaacfd95873a5ac1699c1f6af25c809b719d249252b

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
content-md5: n9m+V3mtM0Zol1ZFiJylpg==
age: 7529
x-cache: HIT
status: 200
content-length: 3170
x-ms-lease-status: unlocked
last-modified: Thu, 07 May 2020 17:15:07 GMT
server: ECAcc (frc/8F3B)
etag: 0x8D7F2AA30E7E566
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: ef3dac69-f01e-00e9-7693-3024e0000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Sat, 23 May 2020 05:53:17 GMT

GET
H2 200 otPcPanel.json Show response
cdn.cookielaw.org/scripttemplates/6.0.0/assets/ 96 KB
20 KB 9ms
9ms Fetch
application/json 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookielaw.org/scripttemplates/6.0.0/assets/otPcPanel.json
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.0.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FF4) /
Resource Hash: bd9756d5946b8e5f1224df3ba63f85ab124c487102e45925a04eba1a3db0998d

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
content-md5: srck0UmwC0ZicbZc2ahUjA==
age: 7524
x-cache: HIT
status: 200
content-length: 20384
x-ms-lease-status: unlocked
last-modified: Thu, 07 May 2020 17:15:08 GMT
server: ECAcc (frc/8FF4)
etag: 0x8D7F2AA3147A2EB
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 347b24ce-701e-001d-6c93-30010c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
expires: Sat, 23 May 2020 05:53:17 GMT

GET
H2 200 yi.js Show response
mb.moatads.com/ 2 KB
2 KB 142ms
92ms Script
text/html 35.177.118.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mb.moatads.com/yi.js?ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=341666498&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbjBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&confidence=2&pcode=cbsprebidheader506831276743&callback=MoatNadoAllJsonpRequest_5505394
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsprebidheader506831276743/moatheader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.177.118.109 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-177-118-109.eu-west-2.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: 99e89ba1e4cbaf340356db070c1cb94ba45d4117852c4099bdf12982067b0e5a

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
server: TornadoServer/4.5.3
etag: "69deadda0b3c6ddb03ee489c606db1a3ef157e84"
content-type: text/html; charset=UTF-8
status: 200
cache-control: max-age=900
timing-allow-origin: *
content-length: 1749

GET
H2 200 n.js Show response
geo.moatads.com/ 139 B
313 B 103ms
25ms Script
text/html 3.11.4.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=341666498&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbjBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&i=CBS_PREBID_HEADER1&hp=1&wf=1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=11&f=0&j=&t=1590198797153&de=500754888112&rx=764077057255&m=0&ar=6ba875f-clean&iw=2ec19fd&q=1&cb=0&cu=1590198797153&ll=2&lm=0&ln=0&em=0&en=0&d=undefined%3Aundefined%3Aundefined%3Aundefined&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&id=1&bo=undefined&bd=undefined&gw=cbsprebidheader506831276743&fd=1&ac=1&it=500&pe=1%3A1865%3A1865%3A1896%3A1857&fs=178191&na=1814765756&cs=0&callback=MoatDataJsonpRequest_5505394
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsprebidheader506831276743/moatheader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.11.4.3 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-11-4-3.eu-west-2.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: 003bb3b204b1f78c55c6e8df4613470ec246dadfdd5d08bd688ce6796d65cac3

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
server: TornadoServer/4.5.3
etag: "cc6fda9154678aa991e4fbda85f263479ca127c0"
content-type: text/html; charset=UTF-8
status: 200
cache-control: max-age=900
timing-allow-origin: *
content-length: 139

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 9ms
7ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&t=1590198797153&de=25713701540&d=CBS_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=6ba875f-clean&iw=2ec19fd&zMoatRendered=0&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=0&zMoatPageDataTargetingSet=0&zMoatSafetyTargetingSet=0&zMoatEmptySlot=0&zMoatNadoDataLoadTime=Not%20Loaded&zMoatAllDataLoadTime=Not%20Loaded&bo=zdnet.com&bd=zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software&ac=1&bq=11&f=0&na=1784675135&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 May 2020 01:53:17 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 23 May 2020 01:53:17 GMT

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/v2/ 2 KB
1 KB 14ms
14ms XHR
application/json 2a02:26f0:eb:1a3::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1590198797200&s=3cc30c5b8cbc668ec21c738687a417656838c84e56bbdfd88dd277e16dc6e00a
Requested by: Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:eb:1a3::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: 773334b5d68cce0ffc7c70380c09429392ffd66187da6fca2c5f94b26435b760

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 23 May 2020 01:53:17 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 849

GET
H/1.1

200
OK

results.txt Show response
xhoemrc7mvemsxwiqigq-pab5qm-42c1dbaea-clientnsv4-s.akamaihd.net/eum/ Frame 4F0D
Redirect Chain

https://trial-eum-clientnsv4-s.akamaihd.net/eum/getdns.txt?c=pab5qmuwr
https://xhoemrc7mvemsxwiqigq-pab5qm-42c1dbaea-clientnsv4-s.akamaihd.net/eum/results.txt

8 B
302 B

76ms
7ms

XHR
text/plain

95.101.72.201
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://xhoemrc7mvemsxwiqigq-pab5qm-42c1dbaea-clientnsv4-s.akamaihd.net/eum/results.txt
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 95.101.72.201 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a95-101-72-201.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 23 May 2020 01:53:17 GMT
Last-Modified: Wed, 08 May 2013 07:51:12 GMT
Server: Apache
ETag: "402e7a087747cb56c718bde84651f96a:1367999472"
Content-Type: text/plain
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 8

Redirect headers

Location: https://xhoemrc7mvemsxwiqigq-pab5qm-42c1dbaea-clientnsv4-s.akamaihd.net/eum/results.txt
Date: Sat, 23 May 2020 01:53:17 GMT
Server: AkamaiGHost
Connection: keep-alive
Access-Control-Allow-Origin: *
Content-Length: 0

GET
H/1.1

200
OK

results.txt Show response
fiaqj6abeejrukqce3ygyaaaabpmraqn-pab5qm-8bfb698a3-clienttons-s.akamaihd.net/eum/ Frame 4F0D
Redirect Chain

https://trial-eum-clienttons-s.akamaihd.net/eum/getdns.txt?c=pab5qmuwr
https://fiaqj6abeejrukqce3ygyaaaabpmraqn-pab5qm-8bfb698a3-clienttons-s.akamaihd.net/eum/results.txt

8 B
302 B

41ms
6ms

XHR
text/plain

2a02:26f0:6c00::210:ba13
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://fiaqj6abeejrukqce3ygyaaaabpmraqn-pab5qm-8bfb698a3-clienttons-s.akamaihd.net/eum/results.txt
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2a02:26f0:6c00::210:ba13 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: Apache /
Resource Hash: 662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 23 May 2020 01:53:17 GMT
Last-Modified: Wed, 08 May 2013 07:51:12 GMT
Server: Apache
ETag: "402e7a087747cb56c718bde84651f96a:1367999472"
Content-Type: text/plain
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 8

Redirect headers

Location: https://fiaqj6abeejrukqce3ygyaaaabpmraqn-pab5qm-8bfb698a3-clienttons-s.akamaihd.net/eum/results.txt
Date: Sat, 23 May 2020 01:53:17 GMT
Server: AkamaiGHost
Connection: keep-alive
Access-Control-Allow-Origin: *
Content-Length: 0

GET
H/1.1 204
No Content / Show response
6852bd0b.akstat.io/ 0
354 B 29ms
15ms XHR
image/gif 2a02:26f0:eb:187::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://6852bd0b.akstat.io/?h.pg=article&when=1590198797202&cdim.Site_View=desktop&t_other=custom0%7C2052&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=457090c2ca4a67e67e2c74baf8465c5193400bed&h.t=1590198797210&http.initiator=api&rt.start=api&rt.si=e2b6b6c8-ac51-4f4b-a051-051caa52ed74&rt.ss=1590198799350&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1

Requested by

Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:eb:187::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 23 May 2020 01:53:17 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Sat, 23 May 2020 01:53:17 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 109 KB
23 KB 365ms
364ms XHR
text/plain 172.217.22.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3983514342715402&correlator=2407622743444631&output=ldjh&impl=fifs&adsid=NT&eid=21066225%2C21064170%2C21066163&vrg=2020050602&npa=1&guci=1.2.0.0.2.1.0.0&sc=1&sfv=1-0-37&ecs=20200523&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=5x5%7C7x7%2C728x90%7C970x250%7C970x66%2C300x250%7C300x600%7C300x1050%2C300x250%2C371x771%2C641x321%2C320x50%7C11x11%2C300x250%2C728x90%7C970x250%7C970x66&fluid=0%2C0%2C0%2C0%2C0%2C0%2Cheight%2C0%2C0&prev_scp=pos%3Dnav%26sl%3Dnav-ad%253FT-1000%7Cpos%3Dtop%26sl%3Dleader-plus-top%253FT-1000%7Cpos%3Dtop%26sl%3Dmpu-plus-top%253FT-1000%7Cpos%3Dmiddle%26sl%3Dmpu-middle%253FT-1000%7Cpos%3Dtop%26sl%3Ddynamic-showcase-top%253FT-1000%7Cpos%3Dtop%26sl%3Dinpage-video-top%253FT-1000%7Cpos%3Dtop%26strnativekey%3D8ec3a4f3%26sl%3Dsharethrough-top%253FT-1000%7Cpos%3Dbottom%26sl%3Dmpu-bottom%253FT-1000%7Cpos%3Dbottom%26sl%3Dleader-plus-bottom%253FT-1000&eri=1&cust_params=buyingcycle%3Ddiscover%26topic%3Dsecurity%252Cstorage%252Csoftware%26tag%3Dransomware%252Coracle%26mfr%3Dsophos-inc%252Coracle%26prodtype%3Dsoftware%252Cantivirus-and-security-software%252Ccomputer%252Ccomputers%26pid%3Dmicrosoft-windows-xp%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Duk%26subses%3D1%26session%3Dd%26pv%3D1%26ftag%3DTRE-03-10aaa6b%26vguid%3D4e843674-dc03-4919-8d35-dcfc47e6f657&cookie_enabled=1&bc=31&abxe=1&lmt=1590198796&dt=1590198797316&dlt=1590198796762&idt=507&frm=20&biw=1600&bih=1200&oid=3&adxs=0%2C-20%2C1050%2C1050%2C1015%2C215%2C215%2C1050%2C436&adys=0%2C312%2C432%2C2451%2C1650%2C1551%2C2099%2C3333%2C3701&adks=1512325694%2C3581870410%2C1925781520%2C3289239044%2C3970605601%2C2450494987%2C2484431570%2C3509234736%2C519614694&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&dssz=28&icsg=134220416&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x4161%7C1600x90%7C370x250%7C370x250%7C370x771%7C770x2876%7C770x11%7C370x250%7C1210x90&msz=1600x5%7C1600x90%7C370x250%7C370x250%7C370x771%7C770x321%7C770x11%7C370x250%7C1210x90&ga_vid=798584800.1590198797&ga_sid=1590198797&ga_hid=184149559&fws=4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4&ohw=1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js?21066225

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

cafe /

Resource Hash

9f74002b1e8d715457ea06a1a6393401882e15304ebbb0865b6ebf2e60ab3154

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23296
x-xss-protection: 0
google-lineitem-id: 4745699004,-1,4745571990,4745571990,4825966980,4745327422,5245653073,4745571990,4745696286
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138239468890,-1,138247985735,138247985738,138247024569,138239368367,138301161526,138239321496,138239338545
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.zdnet.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
373439e2f1e9391cffbd0d77c27529f2.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 0
0 48ms
14ms Other
text/html 2a00:1450:4001:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://373439e2f1e9391cffbd0d77c27529f2.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js?21066225
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:821::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 17ms
5ms Other
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js?21066225
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H/1.1 200
OK wrap.js Show response
clarium.global.ssl.fastly.net/gpt/a/ 91 KB
30 KB 25ms
7ms Script
text/javascript 151.101.113.194
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://clarium.global.ssl.fastly.net/gpt/a/wrap.js?v2_1
Requested by: Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2080-fly/js/main.default.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: aebb2932852e7283bf07ea2422e79959291fc10b21ee277fbe74efab5dbf1cbe

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 23 May 2020 01:53:17 GMT
Via: 1.1 varnish
Server: nginx
Age: 13
X-Served-By: cache-hhn4059-HHN
Vary: Accept-Encoding
X-Cache: HIT
Content-Type: text/javascript;charset=UTF-8
Content-Encoding: gzip
Cache-Control: private, max-age=900, stale-while-revalidate=3600
Connection: keep-alive
Accept-Ranges: bytes
X-Timer: S1590198797.371454,VS0,VE0
Content-Length: 30735
X-Cache-Hits: 4

GET
H/1.1 204
No Content / Show response
6852bd0b.akstat.io/ 0
354 B 14ms
13ms XHR
image/gif 2a02:26f0:eb:187::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://6852bd0b.akstat.io/?h.pg=article&when=1590198797202&cdim.Site_View=desktop&t_other=custom1%7C2053&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=457090c2ca4a67e67e2c74baf8465c5193400bed&h.t=1590198797210&http.initiator=api&rt.start=api&rt.si=e2b6b6c8-ac51-4f4b-a051-051caa52ed74&rt.ss=1590198799350&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1

Requested by

Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:eb:187::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 23 May 2020 01:53:17 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Sat, 23 May 2020 01:53:17 GMT

GET
H/1.1 204
No Content / Show response
6852bd0b.akstat.io/ 0
354 B 21ms
11ms XHR
image/gif 2a02:26f0:eb:187::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://6852bd0b.akstat.io/?h.pg=article&when=1590198797304&cdim.Site_View=desktop&t_other=custom5%7C2255&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=457090c2ca4a67e67e2c74baf8465c5193400bed&h.t=1590198797210&http.initiator=api&rt.start=api&rt.si=e2b6b6c8-ac51-4f4b-a051-051caa52ed74&rt.ss=1590198799350&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1

Requested by

Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:eb:187::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 23 May 2020 01:53:17 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Sat, 23 May 2020 01:53:17 GMT

GET
H/1.1 204
No Content / Show response
6852bd0b.akstat.io/ 0
354 B 24ms
13ms XHR
image/gif 2a02:26f0:eb:187::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://6852bd0b.akstat.io/?h.pg=article&when=1590198797349&cdim.Site_View=desktop&t_other=custom3%7C2300&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=457090c2ca4a67e67e2c74baf8465c5193400bed&h.t=1590198797210&http.initiator=api&rt.start=api&rt.si=e2b6b6c8-ac51-4f4b-a051-051caa52ed74&rt.ss=1590198799350&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1

Requested by

Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:eb:187::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 23 May 2020 01:53:17 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Sat, 23 May 2020 01:53:17 GMT

GET
H2 200 article-2b092f842c-rev.js Show response
zdnet4.cbsistatic.com/fly/js/pages/ 146 KB
40 KB 8ms
7ms Script
application/javascript 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/js/pages/article-2b092f842c-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

131b2b26438658798ce7fdddb00a3d5c29ab2677d16039c0dfe2941c87c230fe

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 200778
status: 200
vary: Accept-Encoding
content-length: 41235
x-xss-protection: 1; mode=block
last-modified: Wed, 20 May 2020 14:55:56 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5ec544fc-2474e"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 May 2020 18:07:00 GMT

GET
H2 200 CBSI-PLAYER.js Show response
vidtech.cbsinteractive.com/uvpjs/0.42.297/ 1 MB
281 KB 21ms
6ms Script
application/javascript 2a04:4e42:1b::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:1b::645 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
age: 1524955
x-cache: HIT, HIT
status: 200
content-length: 286838
x-amz-id-2: Oj+ugiLNsVfwMeCehlFLiuyNlEAh1GvflZKDM5/dpJLgZJ4IX0TwFPkn++V2J81QXNYTQvolT7k=
x-served-by: cache-dca17732-DCA, cache-hhn4061-HHN
last-modified: Fri, 01 Feb 2019 18:20:56 GMT
server: AmazonS3
x-timer: S1590198797.419251,VS0,VE1
etag: "eb5dd4ed3dcb7641ebbcb604d7ddb038"
vary: Accept-Encoding
x-amz-request-id: 846DEB6DF7F987E6
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=2592000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1, 1

GET
H2 200 / Show response
www.zdnet.com/components/breaking-news/xhr/ 1 KB
676 B 156ms
156ms XHR
application/json 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2080-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

8dff736a1096b3c8398b61122dd3b36b30b39ff947a0e8c855845dadb2c129a4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-length: 525
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sat, 23 May 2020 01:40:24 GMT
x-frame-options: SAMEORIGIN
date: Sat, 23 May 2020 01:53:17 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
vary: Accept-Encoding, User-Agent
x-tx-id: fa935ff9-7b04-4e1a-ae9d-a25dfedd746c
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=5400, private
accept-ranges: bytes
expires: Sat, 23 May 2020 03:10:24 GMT

GET
H2 200 image-gallery-modal-426b98fe1d-rev.js Show response
zdnet1.cbsistatic.com/fly/js/components/ 5 KB
2 KB 12ms
6ms Script
application/javascript 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/js/components/image-gallery-modal-426b98fe1d-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

744ae87db00be85a6a482a3e8036f81aafaa7754be29b05a2330d0fbc8fea803

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 111284
status: 200
vary: Accept-Encoding
content-length: 1866
x-xss-protection: 1; mode=block
last-modified: Wed, 20 May 2020 18:16:43 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5ec5740b-1328"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 28 May 2020 18:58:32 GMT

GET
H2 200 screenshot-2019-06-05-at-13-39-10.png
zdnet3.cbsistatic.com/hub/i/r/2019/06/05/7a1f359d-13f2-4409-bfe9-cc2d8f752f23/thumbnail/170x128/3131d0e3112492e37821163f0f0292b8/ 46 KB
46 KB 9ms
7ms Image
image/png 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/06/05/7a1f359d-13f2-4409-bfe9-cc2d8f752f23/thumbnail/170x128/3131d0e3112492e37821163f0f0292b8/screenshot-2019-06-05-at-13-39-10.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

a3686d9864c83969274e37c3b68596e2bdc3f2d1ec8e45b3cbc31fdd4aae230a

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2591721
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 46977
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"28eb72beb39c803322c843071024b921"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screenshot-2019-06-05-at-13-40-33.png
zdnet1.cbsistatic.com/hub/i/r/2019/06/05/be5a4878-0da9-4682-a256-20516e123752/thumbnail/170x128/a7def579f1487a50cce886ec9f934e57/ 36 KB
36 KB 7ms
7ms Image
image/png 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/06/05/be5a4878-0da9-4682-a256-20516e123752/thumbnail/170x128/a7def579f1487a50cce886ec9f934e57/screenshot-2019-06-05-at-13-40-33.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

b219466e31feca9974841093620d143cf37e557aed960a35b1f02c6a096479df

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 157679
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 36525
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"9a8ff1144e336325f8d0d7e868d3a895"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 disqus-loader-ba8cc73646-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 1 KB
762 B 7ms
7ms Script
application/javascript 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/disqus-loader-ba8cc73646-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

824e2ec0553bc582c02673a30139ac8fe4a6485943d64d32dfb7ae5a83efbe92

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 152455
status: 200
vary: Accept-Encoding
content-length: 640
x-xss-protection: 1; mode=block
last-modified: Wed, 20 May 2020 18:16:43 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5ec5740b-57e"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 28 May 2020 07:32:22 GMT

GET
H2 200 mathway.jpg
zdnet1.cbsistatic.com/hub/i/r/2020/05/22/fc7593d7-2ff9-4cd7-ab87-2af52957e337/thumbnail/170x128/31122d100e913a1945afbdedb62c851f/ 9 KB
9 KB 13ms
8ms Image
image/jpeg 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2020/05/22/fc7593d7-2ff9-4cd7-ab87-2af52957e337/thumbnail/170x128/31122d100e913a1945afbdedb62c851f/mathway.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

8718b067d2962104e03c7a3b3b541002d3613cb7a837733a1c84b53221891da2

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 32617
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 8992
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"123650dd0560587918b3d771cf0c0171"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 rdp.png
zdnet3.cbsistatic.com/hub/i/r/2020/04/29/822f85f8-f618-46f6-bd03-090d77c87faf/thumbnail/170x128/a643c3b11015acd81fafdf91617a82cd/ 21 KB
21 KB 12ms
7ms Image
image/png 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2020/04/29/822f85f8-f618-46f6-bd03-090d77c87faf/thumbnail/170x128/a643c3b11015acd81fafdf91617a82cd/rdp.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

7640f30762fd8a67cef63f3c622236562a7703281b9b14b09121ff1894fafdcc

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39621
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 21235
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"4537a9e98e90f416dadaedd65c416843"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 spectra.jpg
zdnet4.cbsistatic.com/hub/i/r/2020/05/21/968a6df3-a0bf-4ff7-af01-1dbeb2ae570d/thumbnail/170x128/a2183ea6f3fa4398d81f2edf391b8f69/ 3 KB
3 KB 13ms
8ms Image
image/jpeg 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2020/05/21/968a6df3-a0bf-4ff7-af01-1dbeb2ae570d/thumbnail/170x128/a2183ea6f3fa4398d81f2edf391b8f69/spectra.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

22b8ea8e6162b9769eff235d8b5997e17565f1bb0fea7db4b937c8458d65cf2f

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 102519
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 2696
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"b5b03f06271f8917685d14cea7c6c50a"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 rsa2019.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/03/08/3498bcc7-b6f9-4c53-a3bd-5d60b7e0a29a/thumbnail/170x128/8098fc11952f9533e18ee61ae726330c/ 7 KB
7 KB 13ms
8ms Image
image/jpeg 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/03/08/3498bcc7-b6f9-4c53-a3bd-5d60b7e0a29a/thumbnail/170x128/8098fc11952f9533e18ee61ae726330c/rsa2019.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

7b14f2a568927389e98f431d56487846c0f8fc7f3ea20e0c0954ebdc59c99456

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6993
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 7360
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"ad2972cf612acdeec0f99338a768aa05"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 / Show response
www.zdnet.com/newsletter/xhr/widget-login/ 2 KB
919 B 827ms
823ms XHR
application/json 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/newsletter/xhr/widget-login/?topic=security

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2080-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

8749204866447a691066e10ab0c81c72e4a22051c7e9b7aeed3d901ebed3cfe2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-length: 758
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-frame-options: SAMEORIGIN
date: Sat, 23 May 2020 01:53:18 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
vary: Accept-Encoding, User-Agent
x-tx-id: 092bc65e-70f9-47ba-a83a-8f8006dc17aa
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 front-door-carousel-d989216481-rev.js Show response
zdnet1.cbsistatic.com/fly/js/components/ 5 KB
2 KB 7ms
6ms Script
application/javascript 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/js/components/front-door-carousel-d989216481-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

a0aa48808ddef7604ba969db62e4af3a2ba001b7a8751823cf0ab2d430308ea5

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 111290
status: 200
vary: Accept-Encoding
content-length: 1552
x-xss-protection: 1; mode=block
last-modified: Wed, 20 May 2020 18:16:43 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5ec5740b-1251"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 28 May 2020 18:58:27 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2020/04/29/822f85f8-f618-46f6-bd03-090d77c87faf/thumbnail/170x128/a643c3b11015acd81fafdf91617a82cd/rdp.png

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2080-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

7640f30762fd8a67cef63f3c622236562a7703281b9b14b09121ff1894fafdcc

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39621
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 21235
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"4537a9e98e90f416dadaedd65c416843"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2020/05/22/fc7593d7-2ff9-4cd7-ab87-2af52957e337/thumbnail/170x128/31122d100e913a1945afbdedb62c851f/mathway.jpg

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2080-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

8718b067d2962104e03c7a3b3b541002d3613cb7a837733a1c84b53221891da2

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 32617
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 8992
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"123650dd0560587918b3d771cf0c0171"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2020/05/21/968a6df3-a0bf-4ff7-af01-1dbeb2ae570d/thumbnail/170x128/a2183ea6f3fa4398d81f2edf391b8f69/spectra.jpg

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2080-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

22b8ea8e6162b9769eff235d8b5997e17565f1bb0fea7db4b937c8458d65cf2f

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 102519
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 2696
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"b5b03f06271f8917685d14cea7c6c50a"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/03/08/3498bcc7-b6f9-4c53-a3bd-5d60b7e0a29a/thumbnail/170x128/8098fc11952f9533e18ee61ae726330c/rsa2019.jpg

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2080-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

7b14f2a568927389e98f431d56487846c0f8fc7f3ea20e0c0954ebdc59c99456

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6993
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 7360
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"ad2972cf612acdeec0f99338a768aa05"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 show-hide-1.0-7bf562809f-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 2 KB
822 B 6ms
6ms Script
application/javascript 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/show-hide-1.0-7bf562809f-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

ContentServer /

Resource Hash

cd715c0fa7d69e85432e8b08d0a02b9613edf40212cca2040bde31670167638e

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 111289
status: 200
vary: Accept-Encoding
content-length: 673
x-xss-protection: 1; mode=block
last-modified: Wed, 20 May 2020 18:16:43 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5ec5740b-71c"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
gcstest: false
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 28 May 2020 18:58:27 GMT

GET
H/1.1 204
No Content / Show response
6852bd0b.akstat.io/ 0
354 B 296ms
295ms XHR
image/gif 2a02:26f0:eb:187::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://6852bd0b.akstat.io/?h.pg=article&when=1590198797578&cdim.Site_View=desktop&t_other=custom4%7C1715&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=457090c2ca4a67e67e2c74baf8465c5193400bed&h.t=1590198797210&http.initiator=api&rt.start=api&rt.si=e2b6b6c8-ac51-4f4b-a051-051caa52ed74&rt.ss=1590198799350&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1

Requested by

Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:eb:187::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 23 May 2020 01:53:17 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Sat, 23 May 2020 01:53:17 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame A785 0
0 44ms
43ms Fetch
image/gif 172.217.22.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstzmg02zIOnjAXtVjhkPGy7wd91G2-fR85eAD6Xa4dzdXcQQdHc_CQfmBBrgoPgJc9Lhx12WvxkWOgPMmwlZzmJTiHBo6bPudj0chRMOTjKBtRUs3OvhwJPY0toI-1RagrKQWhZf-TK9DWZJlg8TXOUHPv30hnr4uz0K7Cb_P0k5y7sI30EBq6pIOhxPkuWWzkAO83mQQQAv3PsmNHpKpxVZD6j54Z66iyJUI3iw6RLmaVacFzvYiISOmchMFtdHYobRNNDIK2-&sai=AMfl-YT8Tgn6naYL0ejs4KJBAlpMczMnwdydDkIY9aQTIo1z3yjMnj4ndn4b3jMfOHH7K3WNKmt0lp3pz1TFggEbVjq-yJJpJ45SuYuLfxqkUQ&sig=Cg0ArKJSzPhLuzBRT11IEAE&urlfix=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 23 May 2020 01:53:17 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:17 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame A785 74 KB
28 KB 68ms
53ms Script
text/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

124220f530266be8497184bf5b9adc70961a8021bfae7e70136fe862a35d17d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1589974910160429"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28390
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:17 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame A785 318 KB
106 KB 8ms
8ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: a8718bdc84c6cdc20dad43a50a131765e4f01c9507d2bddcf9ce91fd6860fbd8

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
last-modified: Mon, 04 May 2020 18:04:48 GMT
server: AmazonS3
x-amz-request-id: B9DD4D03B0B033BC
etag: "0ded5d19456110e4d188b2d3d8f2bb4d"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=9241
accept-ranges: bytes
content-length: 108120
x-amz-id-2: yNIorjjEuO1cTl34qLBSStQG5gZXuU90sxbogIohxeskU0uLM5CezcOBOS038HOewkSFLmUQZ7w=

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 61ms
49ms Script
text/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js?21066225

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

656716137d4e28b0da293f471affb65b1beb1a6c2d9fe2fa9c3640a592754b1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1589974910160429"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27764
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:17 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012005012256000/ Frame F3F7 204 KB
57 KB 46ms
12ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js

Requested by

Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/gpt/a/wrap.js?v2_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d2b891e379840927eaf16ac1147b0e270c409d7a9e2655dd866a175b996dea9c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.zdnet.com/
Origin: https://www.zdnet.com

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 33066
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57019
x-xss-protection: 0
server: sffe
date: Fri, 22 May 2020 16:42:11 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "bf14143de8659308"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 22 May 2021 16:42:11 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012005012256000/ Frame F3F7 204 KB
57 KB 45ms
11ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js

Requested by

Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/gpt/a/wrap.js?v2_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d2b891e379840927eaf16ac1147b0e270c409d7a9e2655dd866a175b996dea9c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 33066
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57019
x-xss-protection: 0
server: sffe
date: Fri, 22 May 2020 16:42:11 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "bf14143de8659308"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 22 May 2021 16:42:11 GMT

GET
H2 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/012005012256000/v0/ Frame F3F7 16 KB
6 KB 59ms
25ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012005012256000/v0/amp-ad-exit-0.1.js

Requested by

Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/gpt/a/wrap.js?v2_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6911cdf8bbf72eff1b6ae5fa039c42f4ca431e578f4f657dd29c55a65f85fd22

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 5211
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5877
x-xss-protection: 0
server: sffe
date: Sat, 23 May 2020 00:26:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "cf1fef681ae7494f"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 23 May 2021 00:26:26 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012005012256000/v0/ Frame F3F7 98 KB
30 KB 56ms
23ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012005012256000/v0/amp-analytics-0.1.js

Requested by

Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/gpt/a/wrap.js?v2_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd0c4ff5bc4e85bcd1ff717afc9d15b8274efe8e644542489bc31fae0346541b

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 33073
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30100
x-xss-protection: 0
server: sffe
date: Fri, 22 May 2020 16:42:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "023298bf906f9a2c"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 22 May 2021 16:42:04 GMT

GET
H2 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/012005012256000/v0/ Frame F3F7 4 KB
2 KB 55ms
21ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012005012256000/v0/amp-fit-text-0.1.js

Requested by

Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/gpt/a/wrap.js?v2_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f9ff4042daa13aa0766bc4854140f7a2942e4deae37d352a617b95000fa54ba

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 105313
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1637
x-xss-protection: 0
server: sffe
date: Thu, 21 May 2020 20:38:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "eed6b15e1dd2165d"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 21 May 2021 20:38:04 GMT

GET
H2 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/012005012256000/v0/ Frame F3F7 48 KB
15 KB 52ms
19ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012005012256000/v0/amp-form-0.1.js

Requested by

Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/gpt/a/wrap.js?v2_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a2c5d4e6a74355f147e25b3ced1d4a66288eab711d0bd3d449ef056fa777c184

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 105309
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15361
x-xss-protection: 0
server: sffe
date: Thu, 21 May 2020 20:38:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "d0b45204c403cb94"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 21 May 2021 20:38:08 GMT

GET
DATA 200
OK truncated
/ Frame F3F7 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c58de4f73ced3633300d50631c8319baba0be5e5d59eaace386332d020f39de8

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 amp4ads-host-v0.js Show response
cdn.ampproject.org/rtv/012005012256000/ 21 KB
7 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012005012256000/amp4ads-host-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js?21066225

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0517f76184f899b738515a124efe8f335f585847387b8889dfa7c0fb132f75a

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 32398
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7437
x-xss-protection: 0
server: sffe
date: Fri, 22 May 2020 16:53:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "1b9b229ae83eaa45"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 22 May 2021 16:53:19 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7FCC 0
0 43ms
42ms Fetch
image/gif 172.217.22.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstXWpLA-vKItG_tUKccCEK26MXtCNXc29ZaMqTSQQuwkov6jGo35Tz0o_UI83XYmc2v5emxH0D8xQLp9N0wZRfIRwtUaVw0o5ccgl8KrA3fRrXyOBAsja4zHpJnlQ4bQczD4oJaqKSdbMcDkZ57YhrViJSjKlcOqJilbkQAgnm7dacjRboPG7I6njbRxS9Vju64teC9Xb8fRjUJbl9sG_PAIjUjxzxUS6HluYoiUjuZuXe2h-w2T5hUIFe4k-FV4fzJQLqxn_SM&sai=AMfl-YT80BypJ10uoWldFeS_mf5UY7WggVEEVAB2sf6Kyi8SscsNgWpEi9HRxEycv0JgXqRiBAMClman6Kln70N0T4lwXD4aCKe1D5os_vSv_g&sig=Cg0ArKJSzFMrREuyvzMYEAE&urlfix=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 23 May 2020 01:53:17 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:17 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7FCC 74 KB
28 KB 45ms
45ms Script
text/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

124220f530266be8497184bf5b9adc70961a8021bfae7e70136fe862a35d17d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1589974910160429"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28390
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:17 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 7FCC 318 KB
106 KB 7ms
7ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: a8718bdc84c6cdc20dad43a50a131765e4f01c9507d2bddcf9ce91fd6860fbd8

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
last-modified: Fri, 15 May 2020 19:08:39 GMT
server: AmazonS3
x-amz-request-id: 8FA57D5588E0A851
etag: "0ded5d19456110e4d188b2d3d8f2bb4d"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=20713
accept-ranges: bytes
content-length: 108120
x-amz-id-2: PxmJb7gesK0bEIifmvwe30i9xWkEPlAwrtz6YZHdtQApz1I0F2Zj3DeMDhRwHEVBLbPh41bXsT8=

GET
H2 200 5193859118673476556
tpc.googlesyndication.com/simgad/ Frame F3F7 41 KB
41 KB 9ms
7ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/5193859118673476556?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qmNFGCEI6tc7EiSRuJaBoNK-VG6UA

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f8525780c10e2f822650d9e725d2c8a1c22bd3b5eba5a0903b019dd24dbb9df4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 19 May 2020 23:23:39 GMT
x-content-type-options: nosniff
last-modified: Mon, 18 May 2020 17:20:34 GMT
server: sffe
age: 268178
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41507
x-xss-protection: 0
expires: Wed, 19 May 2021 23:23:39 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F3F7 2 KB
3 KB 8ms
6ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 22 May 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 53059
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Sat, 23 May 2020 11:08:58 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F3F7 295 B
519 B 7ms
6ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 22 May 2020 22:24:17 GMT
x-content-type-options: nosniff
server: cafe
age: 12540
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Sat, 23 May 2020 22:24:17 GMT

GET
H2 200 adview
securepubads.g.doubleclick.net/pagead/ Frame F3F7 0
0 204ms
203ms Image
text/html 172.217.22.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CPoPcDYLIXqzIGOuP7_UPpN2q8AXhts-pXZ3Ez8a7C8T3ltO_CRABIMyRriJgleKQgqAHoAGlw8CaA8gBAqkCzFKmw7FKsj7gAgCoAwHIAwiqBIcDT9Cqmc0Q3a2dVaanoRIqRa6To8MvKHSvvPdym-8OCEorWJ8lVI_KYf2GyU7flolpTsoGqalJxKNC-IUZ6xpp7wiFvsAoV8A3wC78EVQGoctJy0unp2XR_Ioza6L8Vt4tTVoAunsbCFAcY1bg59Wswf7syV6NeyFVT4ecKWtA20jJ_fFR34gIO-cXiZHtSEzRJUCkXSg5HWX1UNLzoklaanom7EyoGBFMVheH5Upc-4lef7S7YV8rNl4T-ghQX2FqeSW8wGremSO9O0gMSFrPxywcD3sPwHZWXBbs8jnCrGy6uDnn3JPRQF5amyGfNbe0KS4kC2MbwBqO3XK_lDgMd0CpfLA__R7-R_W69p2_K7OlkBXd81nIjaY2ktZjpRt2wxrP4t2H8NE6VSV-j1WTWdpkweWHE7q4FxE6sfLfqJYzmvvGKkW3dnW_kMEDcjZKvIii-QcY7NYfMFFQ8ajCg5VFPhkJXx8M7Jt5yejAwRzyQKkwozzmScWRUPkRee7_XtIIPIJyeMAEurPi2P8C4AQBkgUECAQYAZIFBAgFGASgBgKAB4SUyKwBqAeOzhuoB9XJG6gHk9gbqAe6BqgH8NkbqAfy2RuoB6a-G6gH7NUb2AcB8gcEEMqIJNIICQiA4YBwEAEYHYAKA8gLAdgTCg&sigh=0IY6zl1OAEA&tpd=AGWhJmvuIcqAIK9pInig93fIYGTx87AHmHunZ1dYzvj-ccJGkw
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.22.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra15s17-in-f66.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 8ms
7ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CBS_PREBID_HEADER1&hp=1&wf=1&vb=9&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=11&f=0&j=&t=1590198797153&de=209793793797&rx=764077057255&m=0&ar=6ba875f-clean&iw=2ec19fd&q=2&cb=0&cu=1590198797153&ll=2&lm=0&ln=0&em=0&en=0&d=25365849%3A465723849%3A4676441751%3A138290752599&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&id=1&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&fd=1&ac=1&it=500&pe=1%3A1865%3A1865%3A1896%3A1857&fs=178191&na=2028019593&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 May 2020 01:53:17 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 23 May 2020 01:53:17 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 4D8B 0
0 43ms
42ms Fetch
image/gif 172.217.22.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuySOTqma6jZ2ZAlD6qMyTiYfZ88C7Ij80HKYeY8ck7EDbCoG5cC0jXRuDuWIc53oH9BRorJ4o-cQdDOmKJ5VjYE1Ewccp2mj8ZZ2taZTX_IBPBQ1h6yV5CFrup7JbG0AGP7DE6cT9cue0Fky_ZhpsOVFqFn0C-UkpioS4F1Fik8efbFoFQdwspWtPgFrdkpRRHXmHma8NnDWkcn6L4poHHZepG6VuTXYiTReC7C3613eCfTgOOm3LXPNxsplzdYA-XcbOFqERN&sai=AMfl-YQj41WQTNSi5SX71GTrwL4C8zDp5athvPr4m9EaR8Akwho-HVlIyXBGf5b-WgFrIiMtu2ASDq_LCgW7HNMiVxC10ygBt0qIkV8tVqMXSA&sig=Cg0ArKJSzPRDQEZ6oJwoEAE&urlfix=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 23 May 2020 01:53:17 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4D8B 74 KB
28 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

124220f530266be8497184bf5b9adc70961a8021bfae7e70136fe862a35d17d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1589974910160429"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28390
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:17 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 4D8B 318 KB
106 KB 11ms
10ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: a8718bdc84c6cdc20dad43a50a131765e4f01c9507d2bddcf9ce91fd6860fbd8

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
last-modified: Mon, 04 May 2020 18:04:48 GMT
server: AmazonS3
x-amz-request-id: B9DD4D03B0B033BC
etag: "0ded5d19456110e4d188b2d3d8f2bb4d"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=9241
accept-ranges: bytes
content-length: 108120
x-amz-id-2: yNIorjjEuO1cTl34qLBSStQG5gZXuU90sxbogIohxeskU0uLM5CezcOBOS038HOewkSFLmUQZ7w=

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame A9E1 0
0 44ms
42ms Fetch
image/gif 172.217.22.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsui49XhDhZoWlB0H1xcUTRULrWFwojEymK32Gx4XMMuFjg-y5qNP_8Cl2T9gbGDxRFtSsE9e_u0B2_1o9BlLPFRzG8RP8cPqizAboCSYipByPPQfZhjH_gpjB10YZvQfudfgQrFvXd7JXCTufoZTih96uhWqMYYD5Ol-Jc0tawAg9tPiIrbWCCbt8NBFaC-lzIxqPd6gWzfgUt8AX-ccSIFzsttw4KDQLfXB63VqTtjunmX9o4p-8cu8U4if4xyaqnV1lfS7cXU&sai=AMfl-YREG1rlstd87hQMjNRFYQmo7VItNJEaQM172lnKqqabMnPBk8lUT5MNJfZ-N6zRSreRsMX3dH1bQIfv4E46Av-voM1nz0RNLnAowkxt6Q&sig=Cg0ArKJSzLaVAPYdtK0rEAE&urlfix=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 23 May 2020 01:53:17 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK adKit.min.js Show response
rev.cbsi.com/common/js/ Frame A9E1 6 KB
2 KB 377ms
13ms Script
application/x-javascript 104.111.215.35
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rev.cbsi.com/common/js/adKit.min.js?360718223
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.35 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-35.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 23 May 2020 01:53:18 GMT
Content-Encoding: gzip
Last-Modified: Mon, 13 May 2019 18:29:20 GMT
Server: AkamaiNetStorage
ETag: "e524dc608d5c7c30eef57b6ed95dc6a8:1557772160"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2149

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame A9E1 74 KB
28 KB 49ms
48ms Script
text/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

124220f530266be8497184bf5b9adc70961a8021bfae7e70136fe862a35d17d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1589974910160429"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28390
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:17 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame A9E1 318 KB
106 KB 12ms
11ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: a8718bdc84c6cdc20dad43a50a131765e4f01c9507d2bddcf9ce91fd6860fbd8

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
last-modified: Mon, 04 May 2020 18:04:48 GMT
server: AmazonS3
x-amz-request-id: B9DD4D03B0B033BC
etag: "0ded5d19456110e4d188b2d3d8f2bb4d"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=9241
accept-ranges: bytes
content-length: 108120
x-amz-id-2: yNIorjjEuO1cTl34qLBSStQG5gZXuU90sxbogIohxeskU0uLM5CezcOBOS038HOewkSFLmUQZ7w=

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame A602 0
0 43ms
42ms Fetch
image/gif 172.217.22.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuQdI0NyksfqWnl3_m5LiBgcMgpOPS5Oqe6v6v48A1apxSXbxmEsYHZBTgiLII9dESOl0iRw94YFRsR2lA6Q1fuzO0ucOGcBzgyGpHXzmR5lqttkahntt-uINH1lTjjj4VtbXGcsYAD-cFR6nH9Rnk-ctjpLnbz_jfdZ-bcljs4xsmuIYGX2vL-FaYuiAMN7YMkgZExGeBNqylUCG2AhTctItVI81gwiAVTjoVJ4B3zus7NLr5amO2FcaA4lwOXUfzIq9VQ4btx&sai=AMfl-YTnzl2JiqbVqn3ddtXhbvLQOe1GHNNFWCn8TWM_64lU3G5PvLFRq0vkTjh7owzidYKKLiCBs1vbBhcm52YJz9vLMUq8ddA4SjNOxKJwaA&sig=Cg0ArKJSzNy8vMKz7zAGEAE&urlfix=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 23 May 2020 01:53:17 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame A602 74 KB
28 KB 49ms
48ms Script
text/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

124220f530266be8497184bf5b9adc70961a8021bfae7e70136fe862a35d17d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1589974910160429"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28390
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:17 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame A602 318 KB
106 KB 8ms
7ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: a8718bdc84c6cdc20dad43a50a131765e4f01c9507d2bddcf9ce91fd6860fbd8

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
last-modified: Mon, 04 May 2020 18:04:48 GMT
server: AmazonS3
x-amz-request-id: B9DD4D03B0B033BC
etag: "0ded5d19456110e4d188b2d3d8f2bb4d"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=9241
accept-ranges: bytes
content-length: 108120
x-amz-id-2: yNIorjjEuO1cTl34qLBSStQG5gZXuU90sxbogIohxeskU0uLM5CezcOBOS038HOewkSFLmUQZ7w=

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 5D91 0
0 45ms
43ms Fetch
image/gif 172.217.22.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsscCfhafkFmRXmK2BKn_PAFGLPr6n_0Ssb1UgA9PgGeHkII86dEcMYS55alASfkN3GUhCs3DDjlREGB5yNz5Vfi5MEIG5wZBm92nq9B8rjR0jgNOdZSrRcUjrM6deZwKNSQiMtTLuhzPx_32RfKymPjg61xUSvBHRHACRJzPPpn4wXF9BcYwzUAZulSVjxe9wKp8iYT1vqiSoX9_AHKYq_PP5SNIYRX4UJ_r7m4fu0qvRGe1Il3HrGTFpgJ4RUyhPAl39XcxNuMWzPbDQ&sai=AMfl-YQtMKcUP_4wYtdyaJHeSFijEb8TA8AhsEJaeh9Mi4f2LjrnROYssKo9PGcg0VZojSMEd30ADyt5hfZ9sEnYzWabQSJKIr5exzg362Sk7g&sig=Cg0ArKJSzDwTlYEHkbwpEAE&urlfix=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 23 May 2020 01:53:17 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 sfp-set-targeting.js Show response
native.sharethrough.com/assets/ Frame 5D91 53 KB
19 KB 32ms
9ms Script
application/javascript 52.222.149.172
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://native.sharethrough.com/assets/sfp-set-targeting.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.149.172 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-149-172.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6509c3762686f2a443e0d615631a8211862b5d26549e37fa48b6a2ace276e405

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:27:39 GMT
content-encoding: gzip
last-modified: Thu, 14 May 2020 21:05:30 GMT
server: AmazonS3
age: 1599
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=3600
x-amz-cf-pop: FRA53
x-amz-cf-id: vCKEXwA4ciwlvqgfSZeR5sR6TDjO5xEFfZAWcmFVudgy3eaC7hSZHA==
via: 1.1 c483a0db2609b3ac0bb94a739fe72cc7.cloudfront.net (CloudFront)

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5D91 74 KB
28 KB 50ms
48ms Script
text/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

124220f530266be8497184bf5b9adc70961a8021bfae7e70136fe862a35d17d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1589974910160429"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28390
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:17 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 5D91 318 KB
106 KB 8ms
6ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: a8718bdc84c6cdc20dad43a50a131765e4f01c9507d2bddcf9ce91fd6860fbd8

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
last-modified: Mon, 04 May 2020 18:04:48 GMT
server: AmazonS3
x-amz-request-id: B9DD4D03B0B033BC
etag: "0ded5d19456110e4d188b2d3d8f2bb4d"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=9241
accept-ranges: bytes
content-length: 108120
x-amz-id-2: yNIorjjEuO1cTl34qLBSStQG5gZXuU90sxbogIohxeskU0uLM5CezcOBOS038HOewkSFLmUQZ7w=

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 47BF 0
0 43ms
42ms Fetch
image/gif 172.217.22.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstatx6csPVh-1zZAdeLBdkrOdM709_qcEPfrNBMiDqiaD3Pbw3k_JFALv_vk8G9lq8hIynhsNQ3tdzBk4jgR2hr9ADgZjR3hDkszS5A6ZNgpd6Sh_1pzXYHbMI7RIsPUkpPHgLm9X6h0Fd5UsWgCBs_8Khap1EB-3-RqcGi_BPcBHfQaJiSRVPOb75mD_O0oIXxIkBTnxKJcmRl6DDXd2QRSbArL5tVzBq_58ZxoLyl2r8EO03Giu6kXhvUv6HPDpjyJMdpSiIj&sai=AMfl-YSP6xpkoSszNz9pck5hvQiB5OocbcRKrp3Bw06fxVC8c9BrbpwZZD1NKgoG7eawaXUZrbI8y3X3eivSKBZGq4eQDaoN5Pgcbo9cguARYw&sig=Cg0ArKJSzOcYb41UiTDpEAE&urlfix=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 23 May 2020 01:53:17 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 47BF 74 KB
28 KB 49ms
48ms Script
text/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

124220f530266be8497184bf5b9adc70961a8021bfae7e70136fe862a35d17d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1589974910160429"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28390
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:17 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 47BF 318 KB
106 KB 10ms
8ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: a8718bdc84c6cdc20dad43a50a131765e4f01c9507d2bddcf9ce91fd6860fbd8

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
last-modified: Mon, 04 May 2020 18:04:48 GMT
server: AmazonS3
x-amz-request-id: B9DD4D03B0B033BC
etag: "0ded5d19456110e4d188b2d3d8f2bb4d"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=9241
accept-ranges: bytes
content-length: 108120
x-amz-id-2: yNIorjjEuO1cTl34qLBSStQG5gZXuU90sxbogIohxeskU0uLM5CezcOBOS038HOewkSFLmUQZ7w=

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame DDDC 0
0 42ms
42ms Fetch
image/gif 172.217.22.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstlxE43hkQHsb4DBZmSB4Akc2u8OoBqG6FtqILOx52R49lFJ7JPa07oZTDJPxf4wPSP8OEaCI0La1GJj3RJ9GMlJxnInylsxUdcrly9R6huEH7pckmXw-CdBkYhy8owY_1Sbcn0uNJYEJLXVshgPQC22jqQhvqU4GCHsQvnIzhhWOg40tr5UyEA-TUGzLxj78FrDuY4vwpTdpItiljnu3pcNsDtJpxJc5dthpElQj7bbF9zg1UzUmVEUNpdr3CEt2uY4oSBBTqc&sai=AMfl-YR82lHDe7DP88LeyEnm7o-PW_3Awq10QUlMU2GVQKshlx_4DBD0N1XfuKbNLMBZhirBmULtfWHXa1MaL-kQI2Ns3q18JNLQauaFeP_1dg&sig=Cg0ArKJSzNF_ZVNdYw53EAE&urlfix=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 23 May 2020 01:53:17 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame DDDC 74 KB
28 KB 51ms
49ms Script
text/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

124220f530266be8497184bf5b9adc70961a8021bfae7e70136fe862a35d17d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1589974910160429"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28390
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:17 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame DDDC 318 KB
106 KB 10ms
7ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: a8718bdc84c6cdc20dad43a50a131765e4f01c9507d2bddcf9ce91fd6860fbd8

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
last-modified: Mon, 04 May 2020 18:04:48 GMT
server: AmazonS3
x-amz-request-id: B9DD4D03B0B033BC
etag: "0ded5d19456110e4d188b2d3d8f2bb4d"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=9241
accept-ranges: bytes
content-length: 108120
x-amz-id-2: yNIorjjEuO1cTl34qLBSStQG5gZXuU90sxbogIohxeskU0uLM5CezcOBOS038HOewkSFLmUQZ7w=

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 7 KB
6 KB 34ms
21ms XHR
application/json 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020050602&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js?21066225

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2550649a975030efe77981df089b6051ed806191dbbbd4d99ac42451c4c92a5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 23 May 2020 01:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 5701
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 14 KB
5 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js?21066225

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5456
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:18 GMT

GET
H2 200 n.js Show response
geo.moatads.com/ 140 B
314 B 26ms
25ms Script
text/html 3.11.4.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=341666498&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbjBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&i=CBSDFPCW2&hp=1&wf=1&vb=9&cm=9&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1590198797999&de=631537837216&m=0&ar=6ba875f9bd3-clean&iw=7ba5134&q=5&cb=0&ym=0&cu=1590198797999&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745571990%3A138247985738&zMoatPS=middle&zMoatPT=article&zMoatFT=TRE-03-10aaa6b&zMoatW=300&zMoatH=250&zMoatVGUID=4e843674-dc03-4919-8d35-dcfc47e6f657&zMoatSN=d&zMoatSL=mpu-middle%3FT-1000&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software&zMoatDev=Desktop&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&id=1&bo=23605329&bp=23619609&bd=middle&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20middle&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A1865%3A1865%3A1896%3A1857&iq=na&tt=na&tu=&tp=&fs=178172&na=695286851&cs=0&callback=DOMlessLLDcallback_92279795
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.11.4.3 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-11-4-3.eu-west-2.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: 66cad5165e5162dce73e6bed8340913f315178521e9ecb3a0affe22a3afafe45

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:18 GMT
server: TornadoServer/4.5.3
etag: "d95781f4ba3ef1d746c329ac43ac02b8d963d251"
content-type: text/html; charset=UTF-8
status: 200
cache-control: max-age=900
timing-allow-origin: *
content-length: 140

GET
H2 200 sfp.js Show response
native.sharethrough.com/assets/ 422 KB
120 KB 23ms
23ms Script
application/javascript 52.222.149.172
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://native.sharethrough.com/assets/sfp.js
Requested by: Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/gpt/a/wrap.js?v2_1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.149.172 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-149-172.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 73531244dfaaf087694392ec070a281073c940e972e7fa5fd32b31474c464eea

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:10:29 GMT
content-encoding: gzip
age: 2570
x-cache: Hit from cloudfront
status: 200
x-amz-request-id: 3CD0819C38BF4C23
x-amz-id-2: lsjoGsApp4dPhfsNXz0IHqF4EGpxvWL9XVmGXkMoi+iVd1Ub2tkJ2b40eLCftEzjophnwFwT0bM=
last-modified: Thu, 14 May 2020 21:09:29 GMT
server: AmazonS3
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 c483a0db2609b3ac0bb94a739fe72cc7.cloudfront.net (CloudFront)
cache-control: public, max-age=3600
x-amz-cf-pop: FRA53
x-amz-cf-id: hsuiecMz8ELTkwlReyzhNwIMKHQ8XUu8SFjhZ1TebyW-xML1iZkGzA==
expires: Thu, 14 May 2020 22:09:28 GMT

GET
DATA 200
OK truncated
/ Frame 5D91 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5096fc20b15d166b31ae815ab8dbc2d4524fe666fc2913502e5304f521edc1c1

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 8ms
7ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=9&cm=8&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1590198798201&de=148484780429&m=0&ar=6ba875f9bd3-clean&iw=7ba5134&q=37&cb=0&ym=0&cu=1590198798201&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745696286%3A138239338545&zMoatPS=bottom&zMoatPT=article&zMoatFT=TRE-03-10aaa6b&zMoatW=970&zMoatH=66&zMoatVGUID=4e843674-dc03-4919-8d35-dcfc47e6f657&zMoatSN=d&zMoatSL=leader-plus-bottom%3FT-1000&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software&zMoatDev=Desktop&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&id=1&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=970x66&zMoatSZPS=970x66%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A1865%3A1865%3A1896%3A1857&iq=na&tt=na&tu=&tp=&fs=178172&na=1952177293&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 May 2020 01:53:18 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 23 May 2020 01:53:18 GMT

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame F3F7
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

14ms
14ms

Image
text/html

2a00:1450:4001:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

date: Sat, 23 May 2020 01:53:18 GMT
x-content-type-options: nosniff
server: safe
status: 302
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame A9E1 43 KB
14 KB 44ms
42ms Script
text/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: rev.cbsi.com
URL: https://rev.cbsi.com/common/js/adKit.min.js?360718223

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e85d55c2ef395085ea70522cff040caae649be4025a0ee0da21fe4e28abc21ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "523 / 891 of 1000 / last-modified: 1590083532"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 14368
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:18 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame FE5F 0
0 6ms
5ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Fri, 22 May 2020 23:54:38 GMT
expires: Sat, 22 May 2021 23:54:38 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 7120
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 9ms
9ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vb=9&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F5193859118673476556%3Fsqp%3D4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg%26rs%3DAOga4qmNFGCEI6tc7EiSRuJaBoNK-VG6UA&i=CBS_PREBID_HEADER1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=341666498&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbjBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=970&rm=1&fy=0&gp=0&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&id=1&f=0&j=&t=1590198797153&de=209793793797&rx=764077057255&cu=1590198797153&m=1175&ar=6ba875f-clean&iw=2ec19fd&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=3907&le=1&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A1865%3A1865%3A1896%3A1857&as=0&ag=44&an=0&gf=44&gg=0&ix=44&ic=44&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=44&bx=0&dj=1&im=0&in=0&pd=0&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=87&cd=0&ah=87&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=178191&na=1653824780&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 May 2020 01:53:18 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 23 May 2020 01:53:18 GMT

GET
H/1.1 200
OK public.json Show response
platform-cdn.sharethrough.com/api/external/v1/placements/8ec3a4f3/ 3 KB
2 KB 48ms
11ms XHR
application/json 52.222.149.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://platform-cdn.sharethrough.com/api/external/v1/placements/8ec3a4f3/public.json

Requested by

Host: native.sharethrough.com
URL: https://native.sharethrough.com/assets/sfp.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.222.149.47 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-149-47.fra53.r.cloudfront.net

Software

nginx/1.16.1 /

Resource Hash

01f20940e0c30019afafb557b08ba34722f1749e4cba452fdc75ba820f63be46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 23 May 2020 01:53:18 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
User-Cache-Control: no-cache, must-revalidate
X-Amz-Cf-Pop: FRA53
X-Cache: Hit from cloudfront
Status: 200 OK
Connection: keep-alive
Content-Length: 1374
X-XSS-Protection: 1; mode=block
X-Request-Id: 6dc405de-418a-4e4a-a202-9e185b2792cd
X-Runtime: 0.030687
Access-Control-Allow-Origin: *
User-Header: Expires: Sat, 26 Jul 1997 05:00:00 GMT
Server: nginx/1.16.1
ETag: W/"01f20940e0c30019afafb557b08ba347"
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET
Content-Type: application/json; charset=utf-8
Via: 1.1 c0486ca54d4ad5a3da496bc2b5f49cd2.cloudfront.net (CloudFront)
Cache-Control: max-age=900, public
X-Amz-Cf-Id: oVcxHkK7HU9CvbwP08pMttday6SZypWqZTjjLc1B6WcWBlo-x6ZmHw==

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame A9E1 109 B
168 B 15ms
14ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 23 May 2020 01:53:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame A9E1 109 B
168 B 16ms
15ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 23 May 2020 01:53:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2020050602.js Show response
securepubads.g.doubleclick.net/gpt/ Frame A9E1 243 KB
87 KB 43ms
42ms Script
text/javascript 172.217.22.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

sffe /

Resource Hash

c4b5c1f949f059e3abb05ddcb7cc9944f8c16811e0eb1db9003bc5f8a4eb0634

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 06 May 2020 17:23:28 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 89224
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:18 GMT

POST
H/1.1 204
No Content /
6852bd0b.akstat.io/ 0
354 B 23ms
11ms Other
image/gif 2a02:26f0:eb:187::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://6852bd0b.akstat.io/

Requested by

Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:eb:187::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Sat, 23 May 2020 01:53:18 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Sat, 23 May 2020 01:53:18 GMT

GET
H2 200 v4 Show response
btlr.sharethrough.com/ 5 KB
2 KB 117ms
98ms XHR
application/json 52.28.154.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/v4?placement_key=8ec3a4f3&creative_key=DSVrahGSQryLMTqzWuxnTJYLuq&mrid=2c8076c0-9c98-11ea-9f89-d75a9aa7f8b3
Requested by: Host: native.sharethrough.com
URL: https://native.sharethrough.com/assets/sfp.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.28.154.93 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-154-93.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.1 / Express
Resource Hash: f0a4d9ec2d4afa6ec7c84f528b39823192f60b90a3dfb9c34a87ac3d54d2add2

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:18 GMT
content-encoding: gzip
status: 200
server: nginx/1.16.1
x-powered-by: Express
etag: W/"1217-uDcAb0cZLVB301Z9fkBHty+P5AA"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.zdnet.com
access-control-allow-credentials: true
content-length: 2010

GET
H/1.1 200
OK butler
b.sharethrough.com/ 43 B
229 B 405ms
98ms Image
image/gif 52.7.144.6
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b.sharethrough.com/butler?type=networkImpressionRequest&pkey=8ec3a4f3&placementIndex=1&networkKey=stxnetwork&networkOrder=1&bwidth=1600&bheight=1200&byscroll=0&ploc=https%253A%252F%252Fwww.zdnet.com%252Farticle%252Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%252F%253Fftag%253DTRE-03-10aaa6b%2526bhid%253D29142058075829832022560656856021%2526mid%253D12845869%2526cid%253D2218374048&umtime=1590198798432&version=887-7f381b1f-eu&bidId=NO_BID_ID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.7.144.6 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-7-144-6.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 23 May 2020 01:53:18 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame A9E1 15 KB
4 KB 50ms
50ms XHR
text/plain 172.217.22.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1027508176241115&correlator=161373048548344&output=ldjh&impl=fifs&adsid=NT&vrg=2020050602&npa=1&guci=1.2.0.0.2.1.0.0&sc=1&sfv=1-0-37&ecs=20200523&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=372x142%2C372x142&prev_scp=env%3Dprod%26session%3Dd%26subses%3D1%26ptype%3Darticle%26vguid%3D4e843674-dc03-4919-8d35-dcfc47e6f657%7Cenv%3Dprod%26session%3Dd%26subses%3D1%26ptype%3Darticle%26vguid%3D4e843674-dc03-4919-8d35-dcfc47e6f657&cookie_enabled=1&cdm=www.zdnet.com&bc=31&abxe=1&lmt=1590198798&dt=1590198798498&dlt=1590198797837&idt=648&frm=23&biw=1600&bih=1200&isw=371&ish=771&oid=3&adxs=-12245933%2C-12245933&adys=-12245933%2C-12245933&adks=3261246841%2C3261246840&ucis=yfskt2ek65xa%7C2x0h6jmxtaws&ifi=1&ifk=759689804&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&top=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&dssz=13&icsg=10888&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0%7C0x0&msz=0x0%7C0x0&ga_vid=897368901.1590198799&ga_sid=1590198799&ga_hid=1891249657&fws=256%2C256&ohw=0%2C0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

cafe /

Resource Hash

757fd768613a74665ea1bcc1cf2504dbd6a25b9f8d0ae760678dc94dcd543b6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4082
x-xss-protection: 0
google-lineitem-id: 4746066197,4746066197
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138239375180,138239468731
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
002e55dadaf6c0af07df6993f3eb5eb6.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame A9E1 0
0 40ms
13ms Other
text/html 2a00:1450:4001:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://002e55dadaf6c0af07df6993f3eb5eb6.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html?n=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:821::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame A9E1 0
0 6ms
5ms Other
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html?n=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
233 B 40ms
39ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020050602&jk=3983514342715402&bg=!PD-lPydYaxjNx0TwiDECAAAAOVIAAAALmQF1JpfbiUG5F8On7lJN9bzMpWMJ1uLIgOrpdFOiwZVOmwjiux_6huzuDAUfJD54X1C2FxAD_PCitRAL_Y9dlfyj5K7YA4dH35Zh1hHVhcsZvfrMdUNPjcf1Y-pz3VOjFgDSSbUqTiccUgRm3yVcO6ZipPod_mLFEFFXbdHUkkPeDjR1w2fgTRTtgOSrWUT38I1Cb42FCE1lsutecvttI2Iuie859YCmfsXbI8gml2bdcu-h0IwLzDpsIIjqyEwIAg5n3rQn1Rw8WVih7zyAoUHWtrvxNrsNQwEPBWDyOqOmN4CvjAfWjAlI_JqvKZgRYTed3OBF0YR8qhq-DapeDlVOMOETvQRPKXJ1y0rjdO-zzvSrJyH3iZ1RMSgo75UvzRBIr9b2aumvzGvlewspr_MhW-wBSEwDj6lGqlVd_DNO7zFehF3vKWmmVOl2UqYWp2tauHOKvTgCw_j9hHTcvT0kVzFswJOb78p0kZCzMLOEJjLvHNxyyQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 May 2020 01:53:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 /
www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/ 64 KB
64 KB 1349ms
1349ms Image
text/html 2a04:4e42:1b::444
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048

Requested by

Host: native.sharethrough.com
URL: https://native.sharethrough.com/assets/sfp.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-length: 145033
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sat, 23 May 2020 01:53:19 GMT
x-frame-options: SAMEORIGIN
date: Sat, 23 May 2020 01:53:19 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
vary: Accept-Encoding, User-Agent
x-tx-id: 4700885f-165e-4bf3-bd4a-f330dcbd063b
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=5400, private
accept-ranges: bytes
expires: Sat, 23 May 2020 03:23:19 GMT

GET
H2 200 Huawei_Native_-_Article_4_Image.jpeg
str-assets.imgix.net/creative_workflow/creative_thumbnails/435216/images/original/ 4 KB
4 KB 22ms
7ms Image
image/webp 2a04:4e42:3::720
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://str-assets.imgix.net/creative_workflow/creative_thumbnails/435216/images/original/Huawei_Native_-_Article_4_Image.jpeg?w=170&h=89&auto=format&fit=crop&dpr=1

Requested by

Host: native.sharethrough.com
URL: https://native.sharethrough.com/assets/sfp.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::720 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

imgix /

Resource Hash

cf3e2d0802ef76d12175cd66881427360add02c33637a3e61bfa72eabd8c4b93

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:18 GMT
x-content-type-options: nosniff
last-modified: Sat, 23 May 2020 01:35:52 GMT
server: imgix
age: 1046
vary: Accept, User-Agent
x-cache: HIT, HIT
content-type: image/webp
status: 200
cache-control: public, max-age=600
x-imgix-id: b10b6eb4cbcf1c91366c9e9064f727196882ad3a
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4254
x-served-by: cache-lax8625-LAX, cache-fra19129-FRA

GET
H/1.1 200
OK butler
b.sharethrough.com/ 43 B
229 B 365ms
98ms Image
image/gif 52.7.144.6
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b.sharethrough.com/butler?type=impressionReceived&pkey=8ec3a4f3&placementIndex=1&ckey=sfp-DSVrahGSQryLMTqzWuxnTJYLuq&vkey=DSUUwxnWzcmLboawY5j12naVCz&arid=d7473331b-4388-4abe-ab25-6dbbb866da33&awid=9dba1744-76c1-4026-8c26-f0bde143d2a1&renderOffset=0&bootTime=3303.14&benchmarkBoot=27.569999918341637&responseTime=122&butlerLatency=121.30500003695488&bwidth=1600&bheight=1200&byscroll=0&ploc=https%253A%252F%252Fwww.zdnet.com%252Farticle%252Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%252F%253Fftag%253DTRE-03-10aaa6b%2526bhid%253D29142058075829832022560656856021%2526mid%253D12845869%2526cid%253D2218374048&umtime=1590198798554&version=887-7f381b1f-eu&bidId=NO_BID_ID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.7.144.6 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-7-144-6.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 23 May 2020 01:53:18 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK butler
b.sharethrough.com/ 43 B
229 B 395ms
101ms Image
image/gif 52.7.144.6
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b.sharethrough.com/butler?arid=d7473331b-4388-4abe-ab25-6dbbb866da33&awid=9dba1744-76c1-4026-8c26-f0bde143d2a1&pkey=8ec3a4f3&ckey=sfp-DSVrahGSQryLMTqzWuxnTJYLuq&tkey=bqSbBKSUnnhMPViET2buaJ7u&vkey=DSUUwxnWzcmLboawY5j12naVCz&sourceId=sfp&renderInPlace=false&placementIndex=1&twidth=170&theight=89&action=clickout&isVast=false&bwidth=1600&bheight=1200&pwidth=770&pheight=134&pxoff=215&pyoff=1956&renderOffset=0&renderLatency=139.95000021532178&type=impression&byscroll=0&ploc=https%253A%252F%252Fwww.zdnet.com%252Farticle%252Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%252F%253Fftag%253DTRE-03-10aaa6b%2526bhid%253D29142058075829832022560656856021%2526mid%253D12845869%2526cid%253D2218374048&umtime=1590198798571&version=887-7f381b1f-eu&bidId=NO_BID_ID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.7.144.6 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-7-144-6.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 23 May 2020 01:53:18 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7FC5 0
0 43ms
42ms Fetch
image/gif 172.217.22.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvY7nVcaJ3c5WkHFNIgMTAtxQo-26fU1-8soYXd__s3XC16Fn0FTIgY_yMLlS5SFga5ZOOG5_dwLzZGPPvZC6ZIGWACQ_2aEmFBCgsiqncoWJYU91D33X0QzVXPXPyFBJJgN6s8Ft-De_zNXsbKnl7icDuyPDCqn1rXqpDmE_c9B02iyVj30j10RihgZy7FzsrKe4YP2VhxD_qKUGtgWCKrqbvki7H677C-BjLE1pfLDpWXzTWCfj2jxZ5fLHiOgLXz0MKry7Xy&sai=AMfl-YRsAN_uAEJZH9EYHzp4GfkDn7KyKxHqr5wpLXk5vAF4pTzKdmdvq45m7jRQuhI5aXqfXP8M5qtn3wYjG5S9BdhUr4LP7V4fUVx8Tt3W&sig=Cg0ArKJSzOJbXr-S64CMEAE&urlfix=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 23 May 2020 01:53:18 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:18 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7FC5 74 KB
28 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

124220f530266be8497184bf5b9adc70961a8021bfae7e70136fe862a35d17d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1589974910160429"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28390
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:18 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 7FC5 318 KB
106 KB 10ms
10ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: a8718bdc84c6cdc20dad43a50a131765e4f01c9507d2bddcf9ce91fd6860fbd8

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:18 GMT
content-encoding: gzip
last-modified: Mon, 04 May 2020 18:04:48 GMT
server: AmazonS3
x-amz-request-id: B9DD4D03B0B033BC
etag: "0ded5d19456110e4d188b2d3d8f2bb4d"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=9240
accept-ranges: bytes
content-length: 108120
x-amz-id-2: yNIorjjEuO1cTl34qLBSStQG5gZXuU90sxbogIohxeskU0uLM5CezcOBOS038HOewkSFLmUQZ7w=

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame A9E1 73 KB
27 KB 49ms
49ms Script
text/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

656716137d4e28b0da293f471affb65b1beb1a6c2d9fe2fa9c3640a592754b1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1589974910160429"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27764
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:18 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 77C2 0
0 43ms
43ms Fetch
image/gif 172.217.22.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsun73d6Gg9tEPAh4G_wLVhO3lJhbUb_dj5WjXwI3XU0nI_nb_RVUvTBmJmoUbq7SvN_sjqs3hJbjVvESjPzUcCRTXoaN3-kEFN_-7QWcBs2ukfAkN3SFP10avQ8jrxNxJSKzmz8b5SWQ9bNqqWXviyBwYL3D4GrqorTrzhCRjthiDQwWSu2hGzgwpIjJcen222lEkPOfyWUONoFcoN5J7iIAT-QwTP3cdyA7fglnAPyLFi38PxXc1P8qsIdbC8bnGZxkUEciYG7&sai=AMfl-YSkSEJaSPpo4C53PMePo86Dwa3rpHaa6T0oWm23GMP7853-y80vL9_s_ochIHkP3UTn0TLjov1NcbLErqvIA-p8e2vQeAb5J_MsNI-o&sig=Cg0ArKJSzJ_fEJ02abmxEAE&urlfix=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 23 May 2020 01:53:18 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:18 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 77C2 74 KB
28 KB 49ms
48ms Script
text/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

124220f530266be8497184bf5b9adc70961a8021bfae7e70136fe862a35d17d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1589974910160429"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28390
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:18 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 77C2 318 KB
106 KB 8ms
8ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: a8718bdc84c6cdc20dad43a50a131765e4f01c9507d2bddcf9ce91fd6860fbd8

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:18 GMT
content-encoding: gzip
last-modified: Mon, 04 May 2020 18:04:48 GMT
server: AmazonS3
x-amz-request-id: B9DD4D03B0B033BC
etag: "0ded5d19456110e4d188b2d3d8f2bb4d"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=9240
accept-ranges: bytes
content-length: 108120
x-amz-id-2: yNIorjjEuO1cTl34qLBSStQG5gZXuU90sxbogIohxeskU0uLM5CezcOBOS038HOewkSFLmUQZ7w=

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame A9E1 7 KB
6 KB 17ms
17ms XHR
application/json 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020050602&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aea2846586a5352b0a2d5d4ffb6287426f85a04298c22b923e541afaf818ebd5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 23 May 2020 01:53:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 5617
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame A9E1 14 KB
5 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 23 May 2020 01:53:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5456
x-xss-protection: 0
expires: Sat, 23 May 2020 01:53:18 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 136A 0
0 8ms
5ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Fri, 22 May 2020 23:54:38 GMT
expires: Sat, 22 May 2021 23:54:38 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 7120
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 8ms
8ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=9&cm=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1590198798679&de=343329599555&m=0&ar=6ba875f9bd3-clean&iw=7ba5134&q=50&cb=0&ym=0&cu=1590198798679&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4746066197%3A138239468731&zMoatPT=article&zMoatW=372&zMoatH=142&zMoatVGUID=4e843674-dc03-4919-8d35-dcfc47e6f657&zMoatSN=d&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software&zMoatDev=Desktop&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&id=1&bo=23605329&bp=23619609&bd=-&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=372x142&zMoatPS=Not%20Specified&zMoatSZPS=Not%20Specified&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A1865%3A1865%3A1896%3A1857&iq=na&tt=na&tu=&tp=&fs=178172&na=1548129934&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 May 2020 01:53:18 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 23 May 2020 01:53:18 GMT

GET
H2 200 pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
253 B 22ms
9ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=97&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=51085689&L2id=2638283940&L3id=5245653073&L4id=138301161526&S1id=23605329&S2id=23619609&ord=1590198798173&r=158697697999&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=4e843674-dc03-4919-8d35-dcfc47e6f657&zMoatCURL=zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software&zMoatPS=top&zMoatPT=article&bedc=1&q=1&nu=1&ib=1&dc=1&ob=1&oh=0&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 May 2020 01:53:18 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 23 May 2020 01:53:18 GMT

GET
H2 200 pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
253 B 21ms
8ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=97&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=51085689&L2id=2638283940&L3id=5245653073&L4id=138301161526&S1id=23605329&S2id=23619609&ord=1590198798173&r=158697697999&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=4e843674-dc03-4919-8d35-dcfc47e6f657&zMoatCURL=zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software&zMoatPS=top&zMoatPT=article&bedc=1&q=2&nu=1&ib=1&dc=1&ob=1&oh=0&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 May 2020 01:53:18 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 23 May 2020 01:53:18 GMT

GET
H2 200 pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
253 B 12ms
11ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=201&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=51085689&L2id=2638283940&L3id=5245653073&L4id=138301161526&S1id=23605329&S2id=23619609&ord=1590198798173&r=158697697999&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=4e843674-dc03-4919-8d35-dcfc47e6f657&zMoatCURL=zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software&zMoatPS=top&zMoatPT=article&bedc=1&q=3&nu=1&ib=1&dc=1&ob=1&oh=0&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 May 2020 01:53:18 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 23 May 2020 01:53:18 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A9E1 0
55 B 39ms
38ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020050602&jk=1027508176241115&bg=!j4yljJRYRMSNtV-MgL8CAAAAO1IAAAAMmQF7HM88468ZDNKCjYrRYxTd3ypLVbjbAM2EezCLmOB_pnZfN_v6e41O9iqEGAB8kA1pczNJwSF9xx5pj_-YaDHVNFLc_7nAMol_2miOvi-2dQkLla4nARTugB4qisHUhMsMsJw-G3cFbeeGi3ulHbbizu0TlJcp6xlOCgpNJ67zku5wbOuSeiypXhjIGohxjS-tAYcV3vXtHBCGbNbGf6rLojln5q0lm1HtIRxxJcEjDfXsKQUq7xBQMugujha1y-VEtU69rVZfJ03cdotywOuC0xHMSRHX7aANktejvguBwr0i04T8rZrK4carVqfQdbURXdvYHNO9aqYpY960QnMHkufV616hGNozpjJPx7WTdBNQeCMkfjzdZj1FKNx9Vd1dnJdtRAb7C_cmFF-0V8tYHVLaGPK0XnSY_6mVVrbMdBMifbwtgeMx7VdZtOv13zwZRs3CvjVq0BIGaqMKEzbbSlGT0vGg5WB7ProHL0vFkcxu-EO52-meRKsdJA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 May 2020 01:53:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame F3F7 42 B
112 B 40ms
39ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuGzEpTL0H7W1NSdfQpjJuWIJ59mA0fdJBqfFpdYqfG3RNKNfF5EcPJkKiLB8nUJvGQcZSd4oaPEI7We7-ERQP0u64CONu6AoIdb3ZiGsJB6uuwjpXPbVhwANN1qQ&sai=AMfl-YRBrBEUiIC9yraqA6OSO__Pa-1pX3YJ0ug1dBaT506cLjySJ_extQQNuoNevnZW2Qys2XFm_hoe7EXj8T1NTD71CrXkeJQGDhldOCtzkQ&sig=Cg0ArKJSzCUtxz_I0-vUEAE&id=ampim&o=315,360&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1007&mtos=0,0,0,1007,1007&tos=0,0,0,1007,0&tfs=298&tls=1305&g=100&h=100&tt=1305&r=v&avms=ampa&adk=3581870410

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 May 2020 01:53:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 9ms
9ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&vb=9&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBS_PREBID_HEADER1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=341666498&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbjBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=970&rm=1&fy=0&gp=0&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&id=1&f=0&j=&t=1590198797153&de=209793793797&rx=764077057255&cu=1590198797153&m=2288&ar=6ba875f-clean&iw=2ec19fd&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4016&le=1&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A1865%3A1865%3A1896%3A1857&as=1&ag=1162&an=44&gi=1&gf=1162&gg=44&ix=1162&ic=1162&ez=1&ck=1162&kw=1004&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1162&bx=44&ci=1162&jz=1004&dj=1&im=1&in=1&pd=1&nb=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1004&cd=87&ah=1004&am=87&rf=0&re=1&ft=703&fv=0&fw=703&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=178191&na=846590653&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 May 2020 01:53:19 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 23 May 2020 01:53:19 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 10ms
9ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&vb=9&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBS_PREBID_HEADER1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=341666498&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbjBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=970&rm=1&fy=0&gp=0&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&id=1&f=0&j=&t=1590198797153&de=209793793797&rx=764077057255&cu=1590198797153&m=2289&ar=6ba875f-clean&iw=2ec19fd&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4016&le=1&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A1865%3A1865%3A1896%3A1857&as=1&ag=1162&an=1162&gi=1&gf=1162&gg=1162&ix=1162&ic=1162&ez=1&ck=1162&kw=1004&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1162&bx=1162&ci=1162&jz=1004&dj=1&im=1&in=1&pd=1&nb=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1004&cd=1004&ah=1004&am=1004&rf=0&re=1&ft=703&fv=703&fw=703&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=178191&na=658028978&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 May 2020 01:53:19 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 23 May 2020 01:53:19 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 10ms
10ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&vb=9&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBS_PREBID_HEADER1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=341666498&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbjBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=970&rm=1&fy=0&gp=0&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&id=1&f=0&j=&t=1590198797153&de=209793793797&rx=764077057255&cu=1590198797153&m=2290&ar=6ba875f-clean&iw=2ec19fd&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4016&le=1&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A1865%3A1865%3A1896%3A1857&as=1&ag=1162&an=1162&gi=1&gf=1162&gg=1162&ix=1162&ic=1162&ez=1&ck=1162&kw=1004&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1162&bx=1162&ci=1162&jz=1004&dj=1&im=1&in=1&pd=1&nb=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1004&cd=1004&ah=1004&am=1004&rf=0&re=1&ft=703&fv=703&fw=703&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=178191&na=1736514329&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 May 2020 01:53:19 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 23 May 2020 01:53:19 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 8ms
8ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&vb=9&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBS_PREBID_HEADER1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=341666498&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbjBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=970&rm=1&fy=0&gp=0&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&id=1&f=0&j=&t=1590198797153&de=209793793797&rx=764077057255&cu=1590198797153&m=6314&ar=6ba875f-clean&iw=2ec19fd&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4016&le=1&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A1865%3A1865%3A1896%3A1857&as=1&ag=5189&an=1162&gi=1&gf=5189&gg=1162&ix=5189&ic=5189&ez=1&ck=1162&kw=1004&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5189&bx=1162&ci=1162&jz=1004&dj=1&im=1&in=1&pd=1&nb=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5031&cd=1004&ah=5031&am=1004&rf=0&re=1&ft=4730&fv=703&fw=703&wb=2&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=178191&na=648745271&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 May 2020 01:53:23 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 23 May 2020 01:53:23 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 225ms
225ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&wf=1&vb=9&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBS_PREBID_HEADER1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=341666498&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbjBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=970&rm=1&fy=0&gp=0&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&id=1&f=0&j=&t=1590198797153&de=209793793797&rx=764077057255&cu=1590198797153&m=6517&ar=6ba875f-clean&iw=2ec19fd&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4016&le=1&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A1865%3A1865%3A1896%3A1857&as=1&ag=5391&an=5189&gi=1&gf=5391&gg=5189&ix=5391&ic=5391&ez=1&ck=1162&kw=1004&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5391&bx=5189&ci=1162&jz=1004&dj=1&im=1&in=1&pd=1&nb=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5232&cd=5031&ah=5232&am=5031&rf=0&re=1&ft=4831&fv=4730&fw=703&wb=2&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=178191&na=1547748366&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 May 2020 01:53:23 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 23 May 2020 01:53:23 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 9ms
9ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=25&q=2&hp=1&wf=1&vb=9&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F5193859118673476556%3Fsqp%3D4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg%26rs%3DAOga4qmNFGCEI6tc7EiSRuJaBoNK-VG6UA&i=CBS_PREBID_HEADER1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=341666498&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbjBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=6&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=970&rm=1&fy=0&gp=0&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&id=1&f=0&j=&t=1590198797153&de=209793793797&rx=764077057255&cu=1590198797153&m=11146&ar=6ba875f-clean&iw=2ec19fd&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4016&le=1&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A1865%3A1865%3A1896%3A1857&as=1&ag=10021&an=5391&gi=1&gf=10021&gg=5391&ix=10021&ic=10021&ez=1&ck=1162&kw=1004&aj=1&pg=100&pf=100&ib=0&cc=1&bw=10021&bx=5391&ci=1162&jz=1004&dj=1&im=1&in=1&pd=1&nb=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=9863&cd=5232&ah=9863&am=5232&rf=0&re=1&ft=4831&fv=4831&fw=703&wb=2&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=178191&zsqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&zrs=AOga4qmNFGCEI6tc7EiSRuJaBoNK-VG6UA&na=198187771&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 May 2020 01:53:28 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 23 May 2020 01:53:28 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 9ms
9ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=3&hp=1&wf=1&vb=9&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBS_PREBID_HEADER1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=341666498&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbjBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=7&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=970&rm=1&fy=0&gp=0&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&id=1&f=0&j=&t=1590198797153&de=209793793797&rx=764077057255&cu=1590198797153&m=16170&ar=6ba875f-clean&iw=2ec19fd&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4016&le=1&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A1865%3A1865%3A1896%3A1857&as=1&ag=15044&an=10021&gi=1&gf=15044&gg=10021&ix=15044&ic=15044&ez=1&ck=1162&kw=1004&aj=1&pg=100&pf=100&ib=0&cc=1&bw=15044&bx=10021&ci=1162&jz=1004&dj=1&im=1&in=1&pd=1&nb=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=14887&cd=9863&ah=14887&am=9863&rf=0&re=1&ft=4831&fv=4831&fw=703&wb=2&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=178191&na=1670979131&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 May 2020 01:53:33 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 23 May 2020 01:53:33 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 10ms
10ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=25&q=2&hp=1&wf=1&vb=9&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Fwww.zdnet.com%2F%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=341666498&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbjBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&confidence=2&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=134&w=770&fy=215&gp=1956&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software%2F%3Fftag%3DTRE-03-10aaa6b%26bhid%3D29142058075829832022560656856021%26mid%3D12845869%26cid%3D2218374048&id=1&cm=0&f=0&j=&t=1590198798173&de=158697697999&cu=1590198798173&m=15747&ar=6ba875f9bd3-clean&iw=7ba5134&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=1956&lb=4016&le=1&lf=134&lg=1&lh=76&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A0%3A-&pe=1%3A1865%3A1865%3A1896%3A1857&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&aj=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&dj=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&cq=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=15112&cd=10084&ah=15112&am=10084&rf=0&re=0&wb=1&cl=0&at=0&d=51085689%3A2638283940%3A5245653073%3A138301161526&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=TRE-03-10aaa6b&zMoatSZ=11x11&zMoatPS=top&zMoatSZPS=11x11%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=11&zMoatH=11&zMoatVGUID=4e843674-dc03-4919-8d35-dcfc47e6f657&zMoatSN=d&zMoatSL=sharethrough-top%3FT-1000&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software&zMoatDev=Desktop&zMoatDfpSlotId=sharethrough-top&hv=Domsearch%20Late&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tz=sharethrough-top&iq=na&tt=na&tu=&tp=&tc=0&fs=178172&na=1320778332&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 May 2020 01:53:33 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 23 May 2020 01:53:33 GMT

Verdicts & Comments Add Verdict or Comment

130 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

12 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.zdnet.com/	1970-01-19 10:26:30	Name: zdnetSessionCount Value: 1
www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software	1969-12-31 23:59:59	Name: zdnet_ad_ftag Value: TRE-03-10aaa6b
.zdnet.com/	1969-12-31 23:59:59	Name: zdnetSessionStarted Value: true
.zdnet.com/	1970-01-19 10:26:30	Name: arrowImpCnt Value: 1
.zdnet.com/	1970-01-19 10:26:30	Name: arrowImp Value: true
.zdnet.com/	1970-01-19 09:53:23	Name: RT Value: "z=1&dm=zdnet.com&si=e2b6b6c8-ac51-4f4b-a051-051caa52ed74&ss=kaizaz3d&sl=1&tt=1go&bcn=%2F%2F6852bd0b.akstat.io%2F&ld=1jt"
.zdnet.com/	1969-12-31 23:59:59	Name: fly_preferred_edition Value: eu
.zdnet.com/	1969-12-31 23:59:59	Name: fly_default_edition Value: eu
.zdnet.com/	1970-01-19 09:53:23	Name: fly_device Value: desktop
www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software	1969-12-31 23:59:59	Name: zdnet_ad Value: %7B%22type%22%3A%22gpt%22%2C%22region%22%3A%22uk%22%2C%22subses%22%3A%221%22%2C%22session%22%3A%22d%22%7D
.zdnet.com/	1970-01-19 09:53:23	Name: fly_geo Value: {"countryCode": "de"}
www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software	1970-01-19 09:43:26	Name: pv Value: 1

29 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048(Line 298) Message: Found registered service worker: [object ServiceWorkerRegistration]
console-api	info	URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048(Line 283) Message: Registration of service worker /service-worker.js successful with scope:https://www.zdnet.com/
console-api	log	URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: _injectQueryStringGCP functional
console-api	log	URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_chartbeat performance
console-api	log	URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_tealium functional
console-api	log	URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048(Line 30) Message: Loading iframes
console-api	log	URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_urban_airship targeting
console-api	log	URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_sharebar social
console-api	log	URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_sharebar social
console-api	log	URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_taboola targeting
console-api	log	URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_async_load targeting
console-api	log	URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048(Line 167) Message: %c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api	log	(Line 71) Message: blank creative loaded: 138239468890 (5 x 5, pos=nav, slot=nav-ad)
console-api	log	(Line 71) Message: blank creative loaded: 138247985735 (300 x 250, pos=top, slot=mpu-plus-top)
console-api	log	(Line 71) Message: blank creative loaded: 138247985738 (300 x 250, pos=middle, slot=mpu-middle)
console-api	log	(Line 71) Message: blank creative loaded: 138239368367 (641 x 321, pos=top, slot=inpage-video-top)
console-api	log	(Line 71) Message: blank creative loaded: 138239321496 (300 x 250, pos=bottom, slot=mpu-bottom)
console-api	log	(Line 71) Message: blank creative loaded: 138239338545 (970 x 66, pos=bottom, slot=leader-plus-bottom)
console-api	log	URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048(Line 39) Message: Sharethrough ::: creative id = 138301161526, pos = top, size = 11x11
console-api	info	URL: https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js(Line 418) Message: Powered by AMP ⚡ HTML – Version 2005012256000 https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048
console-api	log	URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048(Line 164) Message: Dynamic Showcase Center container ::: creative id = 138247024569
console-api	log	(Line 71) Message: blank creative loaded: 138239375180 (372 x 142, pos=, slot=dynamic_showcase__0)
console-api	log	(Line 71) Message: blank creative loaded: 138239468731 (372 x 142, pos=, slot=dynamic_showcase__1)
console-api	log	URL: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/?ftag=TRE-03-10aaa6b&bhid=29142058075829832022560656856021&mid=12845869&cid=2218374048(Line 39) Message: Sharethrough : STR exists, calling STR.Tag.boot

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

002e55dadaf6c0af07df6993f3eb5eb6.safeframe.googlesyndication.com
373439e2f1e9391cffbd0d77c27529f2.safeframe.googlesyndication.com
6852bd0b.akstat.io
adservice.google.com
adservice.google.de
b.sharethrough.com
btlr.sharethrough.com
c.go-mpulse.net
cbsdfp5832910442.s.moatpixel.com
cdn.ampproject.org
cdn.cookielaw.org
clarium.global.ssl.fastly.net
enews.zdnet.com
fiaqj6abeejrukqce3ygyaaaabpmraqn-pab5qm-8bfb698a3-clienttons-s.akamaihd.net
geo.moatads.com
geolocation.onetrust.com
googleads.g.doubleclick.net
mb.moatads.com
native.sharethrough.com
pagead2.googlesyndication.com
platform-cdn.sharethrough.com
production-cmp.isgprivacy.cbsi.com
px.moatads.com
rev.cbsi.com
securepubads.g.doubleclick.net
str-assets.imgix.net
tpc.googlesyndication.com
trial-eum-clientnsv4-s.akamaihd.net
trial-eum-clienttons-s.akamaihd.net
urs.zdnet.com
vidtech.cbsinteractive.com
www.google.com
www.googletagservices.com
www.zdnet.com
xhoemrc7mvemsxwiqigq-pab5qm-42c1dbaea-clientnsv4-s.akamaihd.net
z.moatads.com
zdnet1.cbsistatic.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
zdnet4.cbsistatic.com
104.111.215.35
151.101.113.194
172.217.22.66
2.18.235.40
2606:2800:233:1cb7:261b:1f9c:2074:3c
2606:4700:10::6814:b944
2a00:1450:4001:802::2002
2a00:1450:4001:806::2004
2a00:1450:4001:809::2001
2a00:1450:4001:81f::2002
2a00:1450:4001:820::2002
2a00:1450:4001:821::2001
2a02:26f0:6c00::210:ba13
2a02:26f0:eb:187::11a6
2a02:26f0:eb:1a3::11a6
2a04:4e42:1b::444
2a04:4e42:1b::645
2a04:4e42:3::720
3.11.4.3
34.102.213.242
34.213.240.251
35.177.118.109
52.222.149.172
52.222.149.47
52.28.154.93
52.7.144.6
95.101.72.201
003bb3b204b1f78c55c6e8df4613470ec246dadfdd5d08bd688ce6796d65cac3
01f20940e0c30019afafb557b08ba34722f1749e4cba452fdc75ba820f63be46
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0f9ff4042daa13aa0766bc4854140f7a2942e4deae37d352a617b95000fa54ba
124220f530266be8497184bf5b9adc70961a8021bfae7e70136fe862a35d17d2
131b2b26438658798ce7fdddb00a3d5c29ab2677d16039c0dfe2941c87c230fe
139cc4ad53b8f5a98945419b1574ec312878cdd2e5082146bbf26d47b67d32e6
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9
1d93d85e9887c861e43962220f8ae363c16197932c5ffa3620eb42bb3c216a99
1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b
21c9c7889404394d4e4c780022b56b5fa39e83b19c34eb0508561a115a1dcc6a
22b8ea8e6162b9769eff235d8b5997e17565f1bb0fea7db4b937c8458d65cf2f
2550649a975030efe77981df089b6051ed806191dbbbd4d99ac42451c4c92a5a
2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab
2fa22d861597ee6a998776dd0db0cbadcb62a1dc7ac4f8f57ab4c5d5f5f30e3d
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
3964d65266975abb7c3bacd4b4f1c55655ce97900a52d07ebaae9e502de19cd7
3e739d0fcd6811c6f2c97393b66431eda17c61ebbdd01b88344e90a7a7a90c0b
5096fc20b15d166b31ae815ab8dbc2d4524fe666fc2913502e5304f521edc1c1
5f58ad72f5ad3047a55809c3211e4309fa7f0d1d2ecf2adde35ccd1355718237
6109d5731632d64df9eb483fcde4fb912fbe0e95eab63b7db6739f7a3f6ee757
6509c3762686f2a443e0d615631a8211862b5d26549e37fa48b6a2ace276e405
656716137d4e28b0da293f471affb65b1beb1a6c2d9fe2fa9c3640a592754b1f
6588b5f8796b1a393ab1866fa04b36e49a8cc45af863ee2a4168de17d3f93049
662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f
66cad5165e5162dce73e6bed8340913f315178521e9ecb3a0affe22a3afafe45
6911cdf8bbf72eff1b6ae5fa039c42f4ca431e578f4f657dd29c55a65f85fd22
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
6dfd67b5caf5008673dccf714c3004096995e270d0ce7b2eb7660fabb23882b1
70484d6450dacdea0cc8d8461da8765c8b212eb25e323d7f5cc82e63dbc6fc77
70d1b63641ae86512ee80c400ae1c15c7b5d723d2c9517a75f7637b22707e13f
73531244dfaaf087694392ec070a281073c940e972e7fa5fd32b31474c464eea
744ae87db00be85a6a482a3e8036f81aafaa7754be29b05a2330d0fbc8fea803
757fd768613a74665ea1bcc1cf2504dbd6a25b9f8d0ae760678dc94dcd543b6b
7640f30762fd8a67cef63f3c622236562a7703281b9b14b09121ff1894fafdcc
773334b5d68cce0ffc7c70380c09429392ffd66187da6fca2c5f94b26435b760
7b14f2a568927389e98f431d56487846c0f8fc7f3ea20e0c0954ebdc59c99456
7fa1c7b1686f9f116183456c39f7b3ed9cce063cfb428e575fe4a29ae05c4fa6
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
824e2ec0553bc582c02673a30139ac8fe4a6485943d64d32dfb7ae5a83efbe92
8718b067d2962104e03c7a3b3b541002d3613cb7a837733a1c84b53221891da2
8749204866447a691066e10ab0c81c72e4a22051c7e9b7aeed3d901ebed3cfe2
885e5e2eb1e6d9ddac93bd213b44b176ed3bf4054c236157b14442024245cfe2
8dff736a1096b3c8398b61122dd3b36b30b39ff947a0e8c855845dadb2c129a4
9252479eed19b6733fe0abaacfd95873a5ac1699c1f6af25c809b719d249252b
92fc2d3a18374bd7c240c58e3dceade8cfc0a4665a98595babfcf9d253850fa5
95783bf43b78701a92daf5ec7268db97c7144599c774821126b8cc5396724bfa
95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54
99e89ba1e4cbaf340356db070c1cb94ba45d4117852c4099bdf12982067b0e5a
9f74002b1e8d715457ea06a1a6393401882e15304ebbb0865b6ebf2e60ab3154
9f92f7c796f6c52f9ba3a79df0f8348e076bf5d066f5d35f5c2ccd7da3d9ed1d
a0aa48808ddef7604ba969db62e4af3a2ba001b7a8751823cf0ab2d430308ea5
a2c5d4e6a74355f147e25b3ced1d4a66288eab711d0bd3d449ef056fa777c184
a3686d9864c83969274e37c3b68596e2bdc3f2d1ec8e45b3cbc31fdd4aae230a
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
a70d5b9ad136255942779acf94da5cc72316fde5c10c5e7707d6f1888f43dcb8
a8718bdc84c6cdc20dad43a50a131765e4f01c9507d2bddcf9ce91fd6860fbd8
aea2846586a5352b0a2d5d4ffb6287426f85a04298c22b923e541afaf818ebd5
aebb2932852e7283bf07ea2422e79959291fc10b21ee277fbe74efab5dbf1cbe
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b219466e31feca9974841093620d143cf37e557aed960a35b1f02c6a096479df
bd9756d5946b8e5f1224df3ba63f85ab124c487102e45925a04eba1a3db0998d
c4b5c1f949f059e3abb05ddcb7cc9944f8c16811e0eb1db9003bc5f8a4eb0634
c58de4f73ced3633300d50631c8319baba0be5e5d59eaace386332d020f39de8
cbd4067b9b23b6dbb1c93b29e486b63c29519a18c109709dcac8b403f2aaef43
cd715c0fa7d69e85432e8b08d0a02b9613edf40212cca2040bde31670167638e
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108
cf3e2d0802ef76d12175cd66881427360add02c33637a3e61bfa72eabd8c4b93
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d2b891e379840927eaf16ac1147b0e270c409d7a9e2655dd866a175b996dea9c
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41
dd0c4ff5bc4e85bcd1ff717afc9d15b8274efe8e644542489bc31fae0346541b
dfd272053c730cd470302af475eb401d9be41c81f0081c20d7910f6c12732c9d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e85d55c2ef395085ea70522cff040caae649be4025a0ee0da21fe4e28abc21ef
ea7373d7059ab32d4304249b48a91311f91d2dce5e1ebf10450f33f9a8c5f5ec
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0517f76184f899b738515a124efe8f335f585847387b8889dfa7c0fb132f75a
f0a4d9ec2d4afa6ec7c84f528b39823192f60b90a3dfb9c34a87ac3d54d2add2
f3e2e0f12c5badfe408d69bf6c0fa9ce6247f9a45c849851a53b8647637cfcd0
f8525780c10e2f822650d9e725d2c8a1c22bd3b5eba5a0903b019dd24dbb9df4
fb7a86f12d2f0ac2f4111c147415ab30f9c7d84c5e15faba3875fce7ce590127
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097

www.zdnet.com Open in urlscan Pro 2a04:4e42:1b::444 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

148 Requests

100 %HTTPS

52 %IPv6

20 Domains

40 Subdomains

26 IPs

5 Countries

3429 kBTransfer

10263 kBSize

12 Cookies

33 Outgoing links

Page URL History

Redirected requests

148 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 11 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.zdnet.com Open in urlscan Pro
2a04:4e42:1b::444 Public Scan

Screenshot
Live screenshot

Full Image

148
Requests

100 %
HTTPS

52 %
IPv6

20
Domains

40
Subdomains

26
IPs

5
Countries

3429 kB
Transfer

10263 kB
Size

12
Cookies

148 HTTP transactions
11 data transactions