Submitted URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/#ftag=RSSba...
Effective URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Submission: On October 16 via api from US

Summary

This website contacted 66 IPs in 8 countries across 57 domains to perform 346 HTTP transactions. The main IP is 2.18.233.143, located in Ascension Island and belongs to AKAMAI-AS - Akamai Technologies, Inc., US. The main domain is www.zdnet.com.
TLS certificate: Issued by GeoTrust RSA CA 2018 on April 23rd 2019. Valid for: a year.
This is the only time www.zdnet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
9 2.18.233.143 16625 (AKAMAI-AS)
51 2a04:4e42:3::444 54113 (FASTLY)
2 23.45.108.200 20940 (AKAMAI-ASN1)
3 2.18.234.21 16625 (AKAMAI-AS)
5 23.32.243.235 20940 (AKAMAI-ASN1)
18 172.217.16.162 15169 (GOOGLE)
1 13.224.196.40 16509 (AMAZON-02)
2 34.205.11.82 14618 (AMAZON-AES)
1 216.58.205.230 15169 (GOOGLE)
1 52.51.104.248 16509 (AMAZON-02)
1 35.190.38.167 15169 (GOOGLE)
1 9 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
14 152.199.23.241 15133 (EDGECAST)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
5 2606:4700::68... 13335 (CLOUDFLAR...)
6 34.251.227.160 16509 (AMAZON-02)
8 2606:4700::68... 13335 (CLOUDFLAR...)
3 184.31.90.90 20940 (AKAMAI-ASN1)
5 64.30.230.22 6623 (CBSI-1)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
1 3.225.45.120 14618 (AMAZON-AES)
1 151.101.14.133 54113 (FASTLY)
1 2600:9000:200... 16509 (AMAZON-02)
1 1 23.67.136.71 20940 (AKAMAI-ASN1)
2 2 35.190.72.21 15169 (GOOGLE)
2 2 2.18.233.201 16625 (AKAMAI-AS)
2 2 52.212.172.70 16509 (AMAZON-02)
1 18.195.251.148 16509 (AMAZON-02)
1 4 52.30.105.51 16509 (AMAZON-02)
1 34.193.242.172 14618 (AMAZON-AES)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
4 99.80.15.126 16509 (AMAZON-02)
2 52.31.175.110 16509 (AMAZON-02)
4 15.188.31.119 16509 (AMAZON-02)
5 37.252.172.250 29990 (ASN-APPNEXUS)
1 4 66.117.28.68 15224 (OMNITURE)
34 151.101.14.2 54113 (FASTLY)
1 6 2.19.43.224 20940 (AKAMAI-ASN1)
1 104.17.208.240 13335 (CLOUDFLAR...)
1 2 52.49.44.242 16509 (AMAZON-02)
2 2a03:2880:f02... 32934 (FACEBOOK)
1 2600:9000:20e... 16509 (AMAZON-02)
2 2 66.117.28.86 15224 (OMNITURE)
1 16 172.217.18.162 15169 (GOOGLE)
1 35.227.208.151 15169 (GOOGLE)
1 23.99.128.52 8075 (MICROSOFT...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
6 2a00:1450:400... 15169 (GOOGLE)
4 151.101.13.181 54113 (FASTLY)
1 1 172.217.23.162 15169 (GOOGLE)
2 2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1288:110... 34010 (YAHOO-IRD)
2 2a03:2880:f12... 32934 (FACEBOOK)
2 151.101.12.134 54113 (FASTLY)
1 35.157.160.140 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
46 2.18.235.40 16625 (AKAMAI-AS)
6 2a00:1450:400... 15169 (GOOGLE)
3 2.19.38.84 20940 (AKAMAI-ASN1)
5 35.177.62.3 16509 (AMAZON-02)
3 69.173.144.142 26667 (RUBICONPR...)
4 37.157.4.41 198622 (ADFORM)
3 69.173.144.152 26667 (RUBICONPR...)
7 2a00:1450:400... 15169 (GOOGLE)
2 34.251.154.165 16509 (AMAZON-02)
3 104.109.78.125 20940 (AKAMAI-ASN1)
3 37.157.5.73 198622 (ADFORM)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a04:4e42:3::621 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
346 66
Apex Domain
Subdomains
Transfer
51 cbsistatic.com
zdnet1.cbsistatic.com
zdnet3.cbsistatic.com
zdnet2.cbsistatic.com
zdnet4.cbsistatic.com
573 KB
37 moatads.com
z.moatads.com
geo.moatads.com
px.moatads.com
1 MB
34 taboola.com
cdn.taboola.com
trc.taboola.com
images.taboola.com
443 KB
25 doubleclick.net
securepubads.g.doubleclick.net
ad.doubleclick.net
cm.g.doubleclick.net
googleads.g.doubleclick.net
212 KB
15 googletagservices.com
www.googletagservices.com
418 KB
14 moatpixel.com
cbsdfp5832910442.s.moatpixel.com
6 KB
14 rubiconproject.com
ads.rubiconproject.com
optimized-by.rubiconproject.com
beacon-eu2.rubiconproject.com
s.update.rubiconproject.com
eus.rubiconproject.com
29 KB
14 tiqcdn.com
tags.tiqcdn.com
89 KB
13 googlesyndication.com
tpc.googlesyndication.com
pagead2.googlesyndication.com
254 KB
10 cbsi.com
dw.cbsi.com
saa.cbsi.com
rev.cbsi.com
13 KB
9 lightboxcdn.com
www.lightboxcdn.com
api1.lightboxcdn.com
160 KB
9 viglink.com
cdn.viglink.com
api.viglink.com
85 KB
9 zdnet.com
www.zdnet.com
urs.zdnet.com
189 KB
7 adform.net
track.adform.net
s1.adform.net
87 KB
7 ml314.com
ml314.com
in.ml314.com
15 KB
6 ampproject.org
cdn.ampproject.org
137 KB
6 scorecardresearch.com
sb.scorecardresearch.com
4 KB
6 everesttech.net
pixel.everesttech.net
cm.everesttech.net
3 KB
6 demdex.net
dpm.demdex.net
cbsi.demdex.net
4 KB
6 google.com
adservice.google.com
www.google.com
1 KB
5 adnxs.com
secure.adnxs.com
6 KB
5 google.de
adservice.google.de
www.google.de
946 B
4 perfectmarket.com
widget.perfectmarket.com
94 KB
3 tru.am
tru.am
beacon.tru.am
14 KB
3 everestjs.net
www.everestjs.net
8 KB
3 go-mpulse.net
c.go-mpulse.net
57 KB
2 google-analytics.com
www.google-analytics.com
18 KB
2 disqus.com
zdnet-1.disqus.com
2 KB
2 facebook.com
www.facebook.com
319 B
2 facebook.net
connect.facebook.net
88 KB
2 imrworldwide.com
secure-us.imrworldwide.com
866 B
2 casalemedia.com
as-sec.casalemedia.com
1 KB
2 akstat.io
686eb704.akstat.io
708 B
2 crwdcntrl.net
sync.crwdcntrl.net
1 KB
2 mathtag.com
pixel.mathtag.com
1 KB
2 rlcdn.com
idsync.rlcdn.com
847 B
2 betrad.com
l.betrad.com
240 B
2 evidon.com
c.evidon.com
1 KB
1 gstatic.com
fonts.gstatic.com
13 KB
1 jsdelivr.net
cdn.jsdelivr.net
1 KB
1 googleapis.com
fonts.googleapis.com
716 B
1 summerhamster.com
www.summerhamster.com
181 B
1 yieldmanager.com
ad.yieldmanager.com
341 B
1 googleadservices.com
www.googleadservices.com
305 B
1 azurewebsites.net
lightboxapi1.azurewebsites.net
503 B
1 urbanairship.com
web-sdk.urbanairship.com
17 KB
1 trackonomics.net
cdn-magiclinks.trackonomics.net
18 KB
1 qualtrics.com
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
15 KB
1 chartbeat.net
ping.chartbeat.net
168 B
1 eyeota.net
ps.eyeota.net
141 B
1 bluekai.com
tags.bluekai.com
856 B
1 chartbeat.com
static.chartbeat.com
14 KB
1 cbsinteractive.com
vidtech.cbsinteractive.com
281 KB
1 akamaihd.net
iicbsi-a.akamaihd.net
272 B
1 adsrvr.org
match.adsrvr.org
537 B
1 sharethrough.com
native.sharethrough.com
120 KB
1 indexww.com
js-sec.indexww.com
26 KB
346 57
Domain Requested by
24 images.taboola.com www.googletagservices.com
cdn.taboola.com
z.moatads.com
22 px.moatads.com
18 securepubads.g.doubleclick.net www.zdnet.com
securepubads.g.doubleclick.net
www.googletagservices.com
15 www.googletagservices.com www.zdnet.com
securepubads.g.doubleclick.net
rev.cbsi.com
pagead2.googlesyndication.com
15 zdnet2.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
15 zdnet1.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
14 cbsdfp5832910442.s.moatpixel.com
14 tags.tiqcdn.com zdnet2.cbsistatic.com
tags.tiqcdn.com
12 zdnet4.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
10 z.moatads.com securepubads.g.doubleclick.net
9 zdnet3.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
8 www.lightboxcdn.com www.zdnet.com
www.lightboxcdn.com
8 www.zdnet.com zdnet3.cbsistatic.com
7 pagead2.googlesyndication.com optimized-by.rubiconproject.com
pagead2.googlesyndication.com
www.zdnet.com
6 trc.taboola.com cdn.taboola.com
6 cdn.ampproject.org securepubads.g.doubleclick.net
6 tpc.googlesyndication.com securepubads.g.doubleclick.net
www.zdnet.com
6 sb.scorecardresearch.com 1 redirects tags.tiqcdn.com
cdn.taboola.com
widget.perfectmarket.com
6 ml314.com tags.tiqcdn.com
ml314.com
www.zdnet.com
5 geo.moatads.com z.moatads.com
5 googleads.g.doubleclick.net 1 redirects www.zdnet.com
pagead2.googlesyndication.com
5 secure.adnxs.com js-sec.indexww.com
5 dw.cbsi.com tags.tiqcdn.com
www.zdnet.com
5 cdn.viglink.com tags.tiqcdn.com
www.zdnet.com
4 track.adform.net optimized-by.rubiconproject.com
s1.adform.net
4 widget.perfectmarket.com cdn.taboola.com
widget.perfectmarket.com
4 cdn.taboola.com zdnet2.cbsistatic.com
cdn.taboola.com
4 pixel.everesttech.net 1 redirects
4 saa.cbsi.com tags.tiqcdn.com
4 api.viglink.com cdn.viglink.com
4 dpm.demdex.net 1 redirects www.zdnet.com
tags.tiqcdn.com
4 adservice.google.com securepubads.g.doubleclick.net
www.googletagservices.com
pagead2.googlesyndication.com
4 adservice.google.de securepubads.g.doubleclick.net
www.googletagservices.com
pagead2.googlesyndication.com
3 s1.adform.net track.adform.net
s1.adform.net
3 eus.rubiconproject.com www.zdnet.com
3 beacon-eu2.rubiconproject.com www.zdnet.com
3 optimized-by.rubiconproject.com ads.rubiconproject.com
3 ads.rubiconproject.com www.zdnet.com
3 www.everestjs.net tags.tiqcdn.com
www.everestjs.net
3 c.go-mpulse.net www.zdnet.com
c.go-mpulse.net
zdnet1.cbsistatic.com
2 s.update.rubiconproject.com www.zdnet.com
2 www.google-analytics.com widget.perfectmarket.com
2 zdnet-1.disqus.com zdnet2.cbsistatic.com
zdnet-1.disqus.com
2 www.facebook.com connect.facebook.net
2 www.google.com 2 redirects
2 cm.everesttech.net 2 redirects
2 connect.facebook.net tags.tiqcdn.com
connect.facebook.net
2 secure-us.imrworldwide.com 1 redirects
2 as-sec.casalemedia.com js-sec.indexww.com
2 686eb704.akstat.io zdnet1.cbsistatic.com
c.go-mpulse.net
2 cbsi.demdex.net tags.tiqcdn.com
2 sync.crwdcntrl.net 2 redirects
2 pixel.mathtag.com 2 redirects
2 idsync.rlcdn.com 2 redirects
2 tru.am tags.tiqcdn.com
tru.am
2 l.betrad.com www.zdnet.com
2 c.evidon.com www.zdnet.com
1 fonts.gstatic.com www.lightboxcdn.com
1 cdn.jsdelivr.net www.lightboxcdn.com
1 fonts.googleapis.com www.lightboxcdn.com
1 rev.cbsi.com www.zdnet.com
1 www.summerhamster.com
1 ad.yieldmanager.com
1 www.google.de
1 www.googleadservices.com 1 redirects
1 api1.lightboxcdn.com www.lightboxcdn.com
1 lightboxapi1.azurewebsites.net www.lightboxcdn.com
1 web-sdk.urbanairship.com zdnet3.cbsistatic.com
1 cm.g.doubleclick.net 1 redirects
1 cdn-magiclinks.trackonomics.net tags.tiqcdn.com
1 zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com tags.tiqcdn.com
1 beacon.tru.am tru.am
1 ping.chartbeat.net www.zdnet.com
1 ps.eyeota.net www.zdnet.com
1 tags.bluekai.com 1 redirects
1 static.chartbeat.com zdnet2.cbsistatic.com
1 vidtech.cbsinteractive.com zdnet2.cbsistatic.com
1 in.ml314.com ml314.com
1 iicbsi-a.akamaihd.net tags.tiqcdn.com
1 urs.zdnet.com zdnet2.cbsistatic.com
1 match.adsrvr.org js-sec.indexww.com
1 ad.doubleclick.net www.zdnet.com
1 native.sharethrough.com www.zdnet.com
1 js-sec.indexww.com www.zdnet.com
346 84
Subject Issuer Validity Valid
www.cbs.com
GeoTrust RSA CA 2018
2019-04-23 -
2020-07-22
a year crt.sh
*.cbsistatic.com
DigiCert SHA2 High Assurance Server CA
2019-02-22 -
2021-02-26
2 years crt.sh
*.evidon.com
DigiCert ECC Secure Server CA
2019-02-01 -
2020-05-02
a year crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018
2019-07-17 -
2020-03-09
8 months crt.sh
akstat.io
DigiCert SHA2 Secure Server CA
2019-04-16 -
2020-06-14
a year crt.sh
*.g.doubleclick.net
GTS CA 1O1
2019-10-03 -
2019-12-26
3 months crt.sh
*.sharethrough.com
Go Daddy Secure Certificate Authority - G2
2018-09-18 -
2019-11-17
a year crt.sh
l.betrad.com
Go Daddy Secure Certificate Authority - G2
2019-04-25 -
2021-06-24
2 years crt.sh
*.doubleclick.net
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
*.adsrvr.org
Trustwave Organization Validation SHA256 CA, Level 1
2019-03-07 -
2021-04-19
2 years crt.sh
*.zdnet.com
DigiCert SHA2 High Assurance Server CA
2017-12-12 -
2020-12-15
3 years crt.sh
*.google.com
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
*.tiqcdn.com
DigiCert SHA2 Secure Server CA
2017-10-25 -
2020-05-13
3 years crt.sh
a248.e.akamai.net
DigiCert Secure Site ECC CA-1
2019-08-13 -
2020-08-12
a year crt.sh
ssl418259.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-08-10 -
2020-02-16
6 months crt.sh
*.ml314.com
Amazon
2019-03-16 -
2020-04-16
a year crt.sh
ssl516460.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-08-24 -
2020-03-01
6 months crt.sh
www.everestjs.net
DigiCert SHA2 Secure Server CA
2018-10-15 -
2020-10-15
2 years crt.sh
*.cbsi.com
DigiCert SHA2 High Assurance Server CA
2017-11-07 -
2021-02-04
3 years crt.sh
ssl389962.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-09-11 -
2020-03-19
6 months crt.sh
vidtech.cbsinteractive.com
DigiCert SHA2 High Assurance Server CA
2018-12-13 -
2020-12-17
2 years crt.sh
*.chartbeat.com
Gandi Standard SSL CA 2
2019-04-10 -
2020-04-10
a year crt.sh
*.eyeota.net
Let's Encrypt Authority X3
2019-09-19 -
2019-12-18
3 months crt.sh
*.demdex.net
DigiCert SHA2 High Assurance Server CA
2018-01-09 -
2021-02-12
3 years crt.sh
*.chartbeat.net
Thawte RSA CA 2018
2018-12-20 -
2020-01-01
a year crt.sh
viglink.com
Amazon
2019-02-09 -
2020-03-09
a year crt.sh
saa.cbsi.com
DigiCert SHA2 High Assurance Server CA
2019-06-23 -
2020-09-25
a year crt.sh
*.adnxs.com
DigiCert ECC Secure Server CA
2019-01-23 -
2021-03-08
2 years crt.sh
f2.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-07-30 -
2020-07-25
a year crt.sh
*.scorecardresearch.com
COMODO RSA Organization Validation Secure Server CA
2018-11-28 -
2019-12-26
a year crt.sh
*.qualtrics.com
DigiCert SHA2 Secure Server CA
2018-10-08 -
2021-01-06
2 years crt.sh
*.imrworldwide.com
DigiCert SHA2 Secure Server CA
2019-02-25 -
2020-02-25
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2019-09-22 -
2019-12-20
3 months crt.sh
*.trackonomics.net
Go Daddy Secure Certificate Authority - G2
2018-12-22 -
2020-02-20
a year crt.sh
*.everesttech.net
DigiCert SHA2 Secure Server CA
2017-04-13 -
2020-04-17
3 years crt.sh
*.urbanairship.com
DigiCert ECC Secure Server CA
2018-06-20 -
2020-06-24
2 years crt.sh
*.azurewebsites.net
Microsoft IT TLS CA 5
2019-09-24 -
2021-09-24
2 years crt.sh
tpc.googlesyndication.com
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
p.ssl.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-09-03 -
2021-02-22
a year crt.sh
www.google.de
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
*.ads.yahoo.com
DigiCert SHA2 High Assurance Server CA
2019-06-27 -
2019-12-24
6 months crt.sh
*.disqus.com
DigiCert SHA2 Secure Server CA
2018-03-28 -
2020-04-27
2 years crt.sh
*.summerhamster.com
Let's Encrypt Authority X3
2019-09-30 -
2019-12-29
3 months crt.sh
*.google-analytics.com
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
moatads.com
DigiCert ECC Secure Server CA
2018-11-10 -
2020-02-09
a year crt.sh
misc-sni.google.com
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
*.rubiconproject.com
DigiCert SHA2 Secure Server CA
2019-02-13 -
2021-02-17
2 years crt.sh
*.moatads.com
DigiCert SHA2 Secure Server CA
2019-03-12 -
2021-06-10
2 years crt.sh
track.adform.net
DigiCert SHA2 Secure Server CA
2019-09-16 -
2021-09-20
2 years crt.sh
kazfv.com
Sectigo ECC Domain Validation Secure Server CA
2019-06-05 -
2020-06-04
a year crt.sh
*.googleapis.com
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
f3.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-05-29 -
2020-04-23
a year crt.sh

This page contains 27 frames:

Primary Page: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Frame ID: EA1855EA553AD3F769F64B7926FD1773
Requests: 246 HTTP requests in this frame

Frame: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Frame ID: B8E40CC679F72402214E33997469D5C2
Requests: 2 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1571269187995&lv=1
Frame ID: 8128129DC25BA611A8838B033D5C4295
Requests: 2 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637048605067352348
Frame ID: 7FA8CC390A09E08725E8B4B74766C91D
Requests: 1 HTTP requests in this frame

Frame: https://cbsi.demdex.net/dest5.html?d_nsid=undefined
Frame ID: 1120CA54C955856E39E2A23DC23FEC85
Requests: 1 HTTP requests in this frame

Frame: https://www.everestjs.net/static/pixel_details.html
Frame ID: B1B811599B22C977A5EA6D076A132CD6
Requests: 1 HTTP requests in this frame

Frame: https://cbsi.demdex.net/dest5.html?d_nsid=0
Frame ID: 2E77D6A90C97DCECC2D59A375F639040
Requests: 1 HTTP requests in this frame

Frame: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
Frame ID: 73DA9D48E9D011D3E436D779CCBDF795
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstZWFR_PHhPBnCE11mQlEplnLw7nhFS35bBn7XntRrEe_KO3IswPK8YHKsmgkOVVLoWbBhC2booXLiFdSB43_UepK6q3MUVuVzmL3VhNX0Y114LQdWhd-vNU9IwlgqGYhmjwX3HMDo3tyHxTOnsSWQWeZZ4JcrFvsnzqaE9iubrcboD3cGnhhpInqg4IMSfEjdDiTYKZz7K4jtUM2pa0EmsqhNkX3z9XakWdTZkT6peFjpHY45SHdPoICv60RTLWQvJU8D7QUER&sig=Cg0ArKJSzF_85mRCAm6lEAE&urlfix=1&adurl=
Frame ID: AC18F9E2D94522376B431154750019F9
Requests: 4 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/011909241711100/amp4ads-v0.js
Frame ID: A0122E15F74CF76747D5F2B97184E596
Requests: 12 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvui0e5TKnkC3mAJGQVctUFpPdJb3MGk_lKVbe841Q1O14Gydmi431Ipv1Mcb8qxwQDOXSVS4zXiGbWHqfBFRU1ub-N9nn2ynKx7FymykI_0kbPk5t503P9XiJrHr8NXoeNcYLT0BLtD6Abb1HIgfSK663knuYyJqDpH27mDqsD-qLtwYIdbTZcfisitLVUMpRZgRGgMMLZdKXyCGlbDuSa-HS2ftwCVYHWX38AtzqwSDOh6JFACtmmGb6TCCpsAlDaVMeg0UP9UYUogg&sig=Cg0ArKJSzPMkjfwkwAANEAE&urlfix=1&adurl=
Frame ID: 4D5998CAB129E4DD885DCB77A2BEDB10
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst5gdN9Y9J1FhgNY5b6mwlqO4NN5xwvWXYM_uvhJRBxb41TBUt_kEYmMN-XfosrZl3zawK2O7ekPq9_Dtm6iVgaSDqyV1XycLPLhCjv6Cca5agsmTbWg2W4Q7zO3zfdE3xigHrhM87p4HXMcxPEzD1xPgzIscznG4UmFefM3fdZlEspEhgEqIx0p8_Pcjm6QpkU9lQPRoX10256OVvhVihgZWZPzha5zPMQUBt31M_x130WNwWDQprH8PCW_B0GP4aAqedujJEC&sig=Cg0ArKJSzDJZE5UyucliEAE&urlfix=1&adurl=
Frame ID: 7D1AE417CA64A8FCB2F6DBE7D4DF90B6
Requests: 4 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuTRr7l-5Jm8mL42uRfhsi7jKzDBQTY7I1N5yWjQe_zChLLNeR5UhEZUk-nVxsYYSO38EbSO4lCF_QBw2j66zzzRuw4VdRqPBE0ajiYiPh5tV8ucWtmE4IJWns010D8PbGoKE6zPFZx-WPIPjrIeMRARgfywCYPfb3YWzqwGsWxKhvYDC9Wtl2sUA2rs3PPOnR8ivlElAKJ14-tRPmKgNKzmaSDaTDiZsKQQ4OEi6Y4_YFAAE9khbY8NHTzlVYLgYINHqs&sig=Cg0ArKJSzCaIEjFPgp3wEAE&urlfix=1&adurl=
Frame ID: D2868028E81F163AB4C84EB7339EC796
Requests: 14 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv8l3RtS_ckwZd2Av0JG3scclbnr-SjGHVOY9G-FkIaIo1kPp86IpDE7vpjFB_340z6zEWiG-SivAycez4-6Jds0GV7oPmCMwHZ-yGCh9bB1iD6c_DugXJpDlL-t4NFET1UEJdVyY27e0Ot7kwwmKNRn0Uok6Hg_9ed3GX_31SeNAZNaXCeUne-pTGhvHmjOTAzJk001Mo-Ran_Q8HBb8DDt_HVnWVF8WCvmw67Ly1xYTHFdHdsTP7ThnfTMARQygVhE1U&sig=Cg0ArKJSzNSyQhIQA70sEAE&urlfix=1&adurl=
Frame ID: 068AA2797144867EB7E4FAFFED41831F
Requests: 13 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstJR71nopOpBUZCKYr25mBJDKcvqLqVO2SfL4AaPyEdtMmtTbEU-XUNWOfk95or4yG2cSJMxUqbKZuSiTxq779T6auGGC0rM9Sk6WYVGghFvFFFTE5UnkK28rZIVVT2v0pxfH5iOuTI2ZS1h3s3k-3tFErIVVJ-HQmeRCM9GCyQD0Kz4xWmpPaPFQ-QZWc184BXIoL__PwiDBreM_TAhyJuL90EAbOOpwmK75bBwDvIM5N18e7pUwap2DFqjCqJjaGMLjw0By-0&sig=Cg0ArKJSzLy1jbE05D3FEAE&urlfix=1&adurl=
Frame ID: 8C4A6DE93F40B9FB8662FD06776D9FB0
Requests: 4 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvmA6NeUENjna2E-E3xFdfQN1y5fMAWqRCVr8-bFs1COKOsH1usmVjnaACo4eB6ce2hOoA9U7UacVFMfY4jnFi7KiD1UScyYXb8rvzzag_AlT-V1BZMzK7jw1u6osEduoiyU_L2bsTeoyGZYxBVn1rbCQGbrcm7C7loyauWe9YNkY_3ED9fdY8bcloa8I-sR2oL5a6SEpJkPCI3HR-empkUy1CjwoZxahhN_-isyNjjPs14KsYhUdfdxoOWBvc4KjREc7g&sig=Cg0ArKJSzJnfAomh82B5EAE&urlfix=1&adurl=
Frame ID: 31F6F6BA0A5300ABA4EDC3E344606058
Requests: 13 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvn8wqz8NS6SiZillpyDwo28eel4INKrp4guVS-fgWIVAqY87vEodgap2-4UmX1QrTwWWhRSr-WzAVGpD-RwSHvMBrg22zHLctEMyvPLB3QYFj9PLzO_Uzuc_mo4m3c8uSpLg4ICl1RdX_hkDocyzGcpcbne3plcFni7fVPIS26LpeLbKgP3zyPG9lxAO9g7M_SuS0PVsEDLWvD670xTRRIiBnS6V-9Z0ILYFf9jhMF7f6lRjcRSRihKkDYzi3MgGrBK-ld35D2&sig=Cg0ArKJSzN5u_XSSPOW2EAE&urlfix=1&adurl=
Frame ID: 527C249E805783AC6C541AA2DC39A6AC
Requests: 13 HTTP requests in this frame

Frame: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
Frame ID: 1A2CFF85083F116B14E346A1EC93D64D
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20191014/r20190131/zrt_lookup.html
Frame ID: 1854E11EB02C2C761FAAFA09853C1C1B
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: CDD3C1CFC8C285C3D05EDD863AEA9416
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: 51F9354E7D223AAB6C54F9E7427ADD3A
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=1742708726&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&ea=0&flash=0&wgl=1&adsid=NT&dt=1571269189787&bpp=11&bdt=312&fdt=212&idt=212&shv=r20191014&cbv=r20190131&saldr=sa&correlator=7975166544755&frm=23&ife=5&pv=2&ga_vid=1691836487.1571269190&ga_sid=1571269190&ga_hid=1330339269&ga_fc=0&iag=3&icsg=173464&nhd=1&dssz=21&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3497&biw=1585&bih=1200&isw=728&ish=90&ifk=1211492856&scr_x=0&scr_y=0&eid=20040031&oid=3&pvsid=3521079985367303&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.dmyed0z1vr0m&fsb=1&dtd=227
Frame ID: 12179365832E2772DE2B81243F838CD1
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=1742708724&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&ea=0&flash=0&wgl=1&dt=1571269189811&bpp=8&bdt=345&fdt=216&idt=216&shv=r20191014&cbv=r20190131&saldr=sa&correlator=7975166544755&frm=23&ife=5&pv=1&ga_vid=1029052592.1571269190&ga_sid=1571269190&ga_hid=562241255&ga_fc=0&iag=3&icsg=173464&nhd=1&dssz=21&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=3197&biw=1585&bih=1200&isw=300&ish=250&ifk=1466335409&scr_x=0&scr_y=0&eid=20040030&oid=3&pvsid=1810468466022061&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.fyrh3qrj94h5&fsb=1&dtd=227
Frame ID: EAA6D9CD21508EDE9ADB1401A2FF3369
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssGffFTS2LBe50qLJy2FHcF5D1HurVbuD0QfK3j8chqdr6_j4PWv9CUSq82Hjzt95tkH2f6M7RZ5DNXBHK1R_T14zixCKFXdCHiRcoiMa6d_JEtOF6xYkNtiLamvthhdR0J7_qguAFDwG-niAh1mdiG4_HK-xBb265Z3Z8NIweOTip0VbW4dI6Z3KxyamEVsaZVoQ0mSGTES7ZNzbpUV4_7dPQC_0lbo3hYfQBv5wZKsZs5GbT2pasqVFPMdXOC00g14bL3YciO&sig=Cg0ArKJSzPWJFd9M_tkEEAE&urlfix=1&adurl=
Frame ID: 4300576C97362CCE9EC4CE932259F672
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuQtXKbzAs2ZxF_cB_zrXO02cjRke8YSUuie99sn9lb8xaiVzRc-jE2UW0_Ohrr6gi17W-6mbcRTXhULAjZiq1UtzsBPnKvxFBH_We9Af9CeAi2FpCeLH9BvwOscBGgW8efMVWIV7pMKmGJL-x_wtlz0WFuqmWVTUFexszMiHr9RT6Xn-c9hxtIEAq2Nujts80ElJKXuh5JpbNESnrHilCr2tmUWt23G2nizOnlBUCZb8E7PFwkTPiNkYvmrVMlB50YqdHSVpqs&sig=Cg0ArKJSzKOnevvkgAeoEAE&urlfix=1&adurl=
Frame ID: D1B1015CED0F5C8962708C2BE401D20C
Requests: 3 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: B092F677D0ACD60819557DD057E28FD4
Requests: 1 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=637048605067352348
Frame ID: CA4D69B3569AA62C878E76C7960B561A
Requests: 3 HTTP requests in this frame

Screenshot


Page Statistics

346
Requests

100 %
HTTPS

32 %
IPv6

57
Domains

84
Subdomains

66
IPs

8
Countries

4545 kB
Transfer

14005 kB
Size

43
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 72
  • https://tags.bluekai.com/site/20486?limit=0&id=3605384201481224220&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=3605384201481224220%26eid=50056 HTTP 302
  • https://ml314.com/csync.ashx?fp=X7wNw99999OYI355&person_id=3605384201481224220&eid=50056
Request Chain 73
  • https://idsync.rlcdn.com/395886.gif?partner_uid=3605384201481224220 HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzYwNTM4NDIwMTQ4MTIyNDIyMBAAGg0IxNSe7QUSBQjoBxAAQgBKAA HTTP 307
  • https://ml314.com/csync.ashx?fp=b580563a721aa3eb8adea97fa5ddcf480b48f730076c68ee326fbf799c4fe8adf4cb09cee1a4f8eb&person_id=3605384201481224220&eid=50082
Request Chain 74
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3605384201481224220%26eid=50220 HTTP 302
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3605384201481224220%26eid=50220&mm_bnc&mm_bct&UUID=9bb15da7-a3e5-4d00-9ed8-18dc39df258b HTTP 302
  • https://ml314.com/csync.ashx?fp=9bb15da7-a3e5-4d00-9ed8-18dc39df258b&person_id=3605384201481224220&eid=50220
Request Chain 75
  • https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3605384201481224220 HTTP 302
  • https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3605384201481224220 HTTP 302
  • https://ml314.com/csync.ashx?fp=2da2853434d6ec49b240db22b03e9cd5&eid=50146&person_id=3605384201481224220
Request Chain 77
  • https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3605384201481224220&redir= HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3605384201481224220&redir=
Request Chain 103
  • https://pixel.everesttech.net/4083/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__EFOPTOUT__%26throttleCookie%3D__EFSYNC__%26time%3D__EFTIME__ HTTP 302
  • https://www.everestjs.net/static/pixel_details.html
Request Chain 119
  • https://sb.scorecardresearch.com/b?c1=2&c2=3005086&ns__t=1571269188950&ns_c=UTF-8&c8=Cyberbit%20discovers%20international%20airport%20riddled%20with%20Bitcoin-mining%20malware%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1571269188950&ns_c=UTF-8&c8=Cyberbit%20discovers%20international%20airport%20riddled%20with%20Bitcoin-mining%20malware%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&c9=
Request Chain 121
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/%23ftag%3DRSSbaffb68%7C&rp=&ts=compact&rnd=1571269188952 HTTP 302
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/%23ftag%3DRSSbaffb68%7C&rp=&ts=compact&rnd=1571269188952&ja=1
Request Chain 129
  • https://cm.everesttech.net/cm HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WGFlcVJBQUFCT0xaUURyeQ HTTP 302
  • https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEA905sSPz_GymtOMdvI0O0U&google_cver=1 HTTP 302
  • https://pixel.everesttech.net/1x1
Request Chain 144
  • https://www.googleadservices.com/pagead/conversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0 HTTP 302
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=RaqnXda-BdmugAf_naHIBA&random=1255348109&sscte=1&crd=&gtd= HTTP 302
  • https://www.google.com/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1255348109&crd=&is_vtc=1&random=615366517 HTTP 302
  • https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1255348109&crd=&is_vtc=1&random=615366517&ipr=y
Request Chain 210
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si

346 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
446 KB
100 KB
Document
General
Full URL
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
37f9d5b661c87dd04811525cb9364ffa350f9d63d0c860abd864ffb2bdc7504e
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.zdnet.com
:scheme
https
:path
/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
navigate
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

status
200
server
nginx
content-type
text/html; charset=UTF-8
set-cookie
fly_device=desktop; expires=Wed, 23-Oct-2019 23:39:47 GMT; path=/; domain=.zdnet.com; secure nemo_highlander-sharebar=sharebar%3a1%3aexclude; expires=Thu, 17 Oct 2019 06:59:59 GMT; path=/; domain=.zdnet.com; secure; fly_default_edition=eu; path=/; domain=.zdnet.com; secure fly_preferred_edition=eu; path=/; domain=.zdnet.com; secure fly_geo={"countryCode": "de"}; expires=Wed, 23-Oct-2019 23:39:47 GMT; path=/; domain=.zdnet.com; secure
x-enable-esi
true
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Accept-Encoding, User-Agent
access-control-allow-origin
https://www.zdnet.com
x-frame-options
SAMEORIGIN
content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
expires
Thu, 17 Oct 2019 00:25:06 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
referrer-policy
no-referrer-when-downgrade
x-content-type-options
nosniff
x-xss-protection
1; mode=block
x-tx-id
70f4a0fa-0d0b-4363-ab35-1819b04b322f
content-encoding
gzip
date
Wed, 16 Oct 2019 23:39:47 GMT
main-d833df87ab-rev.css
zdnet1.cbsistatic.com/fly/1824-fly/css/core/
357 KB
64 KB
Stylesheet
General
Full URL
https://zdnet1.cbsistatic.com/fly/1824-fly/css/core/main-d833df87ab-rev.css
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d603253cfb5d658c9f70b949fa0fee7e2cf73a522b0758ee6e32a55084bd388a
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
18663
status
200
vary
Accept-Encoding
content-length
65668
x-xss-protection
1; mode=block
last-modified
Wed, 16 Oct 2019 18:10:39 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da75d1f-59363"
strict-transport-security
max-age=31536000
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 23 Oct 2019 18:28:44 GMT
controls-b3dd8a5630-rev.css
zdnet1.cbsistatic.com/fly/css/video/htmlPlayerControls/
41 KB
6 KB
Stylesheet
General
Full URL
https://zdnet1.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-b3dd8a5630-rev.css
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
53b5d7825dc08f9b395c39b5c05f5b2440b898b4617111d59a94aa5e4e26c8a4
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
18663
status
200
vary
Accept-Encoding
content-length
6565
x-xss-protection
1; mode=block
last-modified
Wed, 16 Oct 2019 18:10:53 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da75d2d-a53d"
strict-transport-security
max-age=31536000
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 23 Oct 2019 18:28:44 GMT
tom-foremski.jpg
zdnet3.cbsistatic.com/hub/i/r/2014/07/22/60923da3-1175-11e4-9732-00505685119a/thumbnail/40x40/1949f9d1c166f50622ea92c64d9ca5b1/
825 B
1 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2014/07/22/60923da3-1175-11e4-9732-00505685119a/thumbnail/40x40/1949f9d1c166f50622ea92c64d9ca5b1/tom-foremski.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
851bb3ccde04ff1534b092c1963f531370779481ed36b3dab692cc98a299c430
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
x-content-type-options
nosniff
age
4135638
status
200
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
825
x-xss-protection
1; mode=block
last-modified
Thu, 25 Jun 2015 14:17:35 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 29 Aug 2020 02:51:48 GMT
huawei-logo-101.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/06/14/f18d93ce-16bf-4238-91f3-24ff763a0943/thumbnail/170x128/6749426f047dc93f4fd62a55f2b57692/
5 KB
5 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/06/14/f18d93ce-16bf-4238-91f3-24ff763a0943/thumbnail/170x128/6749426f047dc93f4fd62a55f2b57692/huawei-logo-101.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
c42f6df0eebb3d51bb3fc43ec77055bc09cdf808d26db3b5d75ccf65868b9cb2
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4043
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4930
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"24646475ed957884ca39b0c1d9cc06b2"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
qu1ckr00t.png
zdnet4.cbsistatic.com/hub/i/r/2019/10/16/8d4bc717-70fa-4b17-85ef-34a2d822b535/thumbnail/170x128/1710a878dcbafd763659a828727cc73c/
6 KB
5 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/10/16/8d4bc717-70fa-4b17-85ef-34a2d822b535/thumbnail/170x128/1710a878dcbafd763659a828727cc73c/qu1ckr00t.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
cad94e550873129e54995a8a38cc720a5e14eb9d7a4fccaf4dcad20798f71a25
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6810
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
5239
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"36165c62f7b7df72863d470d73302627"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
dark-web-criminals-are-selling-tools-to-5cfa3c2ebd785600c3ec8089-1-jun-10-2019-9-34-29-poster.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/06/10/b7fb1ab7-061e-4055-a4b9-22a3d4696eb3/thumbnail/170x128/e8a078dff50b9f3263e9a77c1f569d0c/
3 KB
3 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/06/10/b7fb1ab7-061e-4055-a4b9-22a3d4696eb3/thumbnail/170x128/e8a078dff50b9f3263e9a77c1f569d0c/dark-web-criminals-are-selling-tools-to-5cfa3c2ebd785600c3ec8089-1-jun-10-2019-9-34-29-poster.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
1a5c7c13fdda65e67781664a8350542028b989008d773b768ef5e2a695e6f276
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
16618
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
2628
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"f2e43fa3400d826df4195a9ac70dca62"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
google-cloud-updates-aipowered-speech-to-5c73e58360b2b5899fb224ab-1-feb-27-2019-17-31-20-poster.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/02/27/1db68635-40a5-437e-8b6f-ff1d3034921f/thumbnail/170x128/0210586deb69215800497d8db966579e/
4 KB
4 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/02/27/1db68635-40a5-437e-8b6f-ff1d3034921f/thumbnail/170x128/0210586deb69215800497d8db966579e/google-cloud-updates-aipowered-speech-to-5c73e58360b2b5899fb224ab-1-feb-27-2019-17-31-20-poster.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f444da05001f14ded9b611a70579edc66ea57225af5d25273094a0141bc92340
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
23530
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4075
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"ae31ee951b4d4bfb5518e0fcdc064a83"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
istock-1061357610.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/09/20/71154639-c01a-4477-87cb-bcbf979eb012/thumbnail/170x128/eb64b668b027fd2887a7a23d68f68032/
10 KB
10 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/09/20/71154639-c01a-4477-87cb-bcbf979eb012/thumbnail/170x128/eb64b668b027fd2887a7a23d68f68032/istock-1061357610.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
30eb3b695efa6bafee22c83f473bac04cad5a1ce3b77ab8593ed70b29d6a1bb2
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
x-content-type-options
nosniff
age
2291482
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
10293
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"37f2fc94430a30d7dba690d94d7e1223"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
soundwave.png
zdnet1.cbsistatic.com/hub/i/r/2019/10/16/520ca75e-54d4-4f67-ab31-86ca35338110/thumbnail/170x128/0a123d1e926ef6e999096d90799cdc68/
22 KB
22 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/10/16/520ca75e-54d4-4f67-ab31-86ca35338110/thumbnail/170x128/0a123d1e926ef6e999096d90799cdc68/soundwave.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
b574b50087aa11d4270c0fd5f62fe1d0051cc3e68a63982e318553f759add31d
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
27558
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
22633
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"19415392e1213854f465b52ba2abf0ed"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
datacentermanistock-1060784838.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/10/16/6b68da9a-49a8-4d8e-bd9c-82e84313dc80/thumbnail/170x128/e4c007583c297bd01f83f61112c64828/
7 KB
7 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/10/16/6b68da9a-49a8-4d8e-bd9c-82e84313dc80/thumbnail/170x128/e4c007583c297bd01f83f61112c64828/datacentermanistock-1060784838.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
0e2d486038ed4137fb69a8e69fa1bf8b43ce75792f45b7762cb0caf0fe83c72c
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
34834
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
7467
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"239f914f30ea3c948fce2ea07a9efb33"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
istock-cyber-security-concept.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/06/03/60d3abdb-6e0b-4b7a-a542-c6d778c84b27/thumbnail/170x128/b0e9b551dbfb7bf5f6de212565979f64/
6 KB
6 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/06/03/60d3abdb-6e0b-4b7a-a542-c6d778c84b27/thumbnail/170x128/b0e9b551dbfb7bf5f6de212565979f64/istock-cyber-security-concept.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
09e9d28bdae69a0df75ad726e351543a6ec6a23bcf95e56971c388d828f06506
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
35442
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
5833
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"f9322b146574d9da9ad32ad879ad373b"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
istock-845470768.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/08/02/fe1a8e3a-e4ba-44de-9b94-10ca71f90471/thumbnail/170x128/ea1c6af84c2b873b774e4b784c56269b/
9 KB
9 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/08/02/fe1a8e3a-e4ba-44de-9b94-10ca71f90471/thumbnail/170x128/ea1c6af84c2b873b774e4b784c56269b/istock-845470768.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
3c4e5d9190758a17654ffba0d04c5a820ba6ed162cd10807e9ccdcb2c20662e6
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6516838
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
8640
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"29a6aa8af3c942a277478a90aa4cae21"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
require-2.1.2.js
zdnet2.cbsistatic.com/fly/1824-fly/js/libs/
16 KB
6 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
18664
status
200
vary
Accept-Encoding
content-length
6305
x-xss-protection
1; mode=block
last-modified
Wed, 16 Oct 2019 18:10:36 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da75d1c-3f09"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 23 Oct 2019 18:28:44 GMT
evidon-sitenotice-tag.js
zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/
69 KB
14 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
8998e68f9bb1686ca1e03fcf3f0d6ea669c32d1f3554aeea809f1b1824ff6625
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
418322
status
200
vary
Accept-Encoding
content-length
13960
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:27:39 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e34ab-1134e"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 19 Oct 2019 03:27:33 GMT
country.js
c.evidon.com/geo/
249 B
437 B
Script
General
Full URL
https://c.evidon.com/geo/country.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.45.108.200 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-45-108-200.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
431ebbd4137063ecc5dfadb726e7f4f9b5eeafa66d015427b3e2972e270c4b2f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
last-modified
Tue, 10 Jul 2018 17:04:49 GMT
server
AkamaiNetStorage
status
200
etag
"9875d31177020d7eaf6c5248543955d0:1531242289"
vary
Accept-Encoding
access-control-allow-methods
GET,OPTIONS,POST
content-type
application/x-javascript
access-control-allow-origin
access-control-max-age
86400
accept-ranges
bytes
access-control-allow-headers
*
content-length
165
snthemes.js
zdnet3.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/
94 KB
8 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/snthemes.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
39f0e13a96fd029965b5b5fd3504853b6fe6ded07b4dd8862a0e033be626e655
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
371165
status
200
vary
Accept-Encoding
content-length
7763
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:27:39 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e34ab-177f3"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 19 Oct 2019 16:22:54 GMT
settings.js
zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/
33 KB
2 KB
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/settings.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
ad7ed17bf4c8d9dd2511e7254670822d0f90c8fb89187f860cfbcb91821abc84
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
409155
status
200
vary
Accept-Encoding
content-length
1669
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:27:39 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e34ab-828e"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 21 Oct 2019 04:22:51 GMT
truncated
/
917 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/jpeg
mag-white01.png
zdnet2.cbsistatic.com/fly/1571249270-fly/bundles/zdnetcss/images/core/
1 KB
1 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/fly/1571249270-fly/bundles/zdnetcss/images/core/mag-white01.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet1.cbsistatic.com/fly/1824-fly/css/core/main-d833df87ab-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
18662
status
200
vary
Accept-Encoding
content-length
936
x-xss-protection
1; mode=block
last-modified
Wed, 16 Oct 2019 18:07:50 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da75c76-4f1"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 23 Oct 2019 18:28:45 GMT
logo.png
zdnet2.cbsistatic.com/fly/1571249270-fly/bundles/zdnetcss/images/core/
4 KB
4 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/fly/1571249270-fly/bundles/zdnetcss/images/core/logo.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet1.cbsistatic.com/fly/1824-fly/css/core/main-d833df87ab-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
18662
status
200
vary
Accept-Encoding
content-length
4128
x-xss-protection
1; mode=block
last-modified
Wed, 16 Oct 2019 18:07:50 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da75c76-1009"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 23 Oct 2019 18:28:45 GMT
Raleway-Regular.woff2
zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
50 KB
50 KB
Font
General
Full URL
https://zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Regular.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
66ef1b7581d8ef7b82bfe2ca363a612a479d89b808e2241f68d3e8c75f4f06d4
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://zdnet1.cbsistatic.com/fly/1824-fly/css/core/main-d833df87ab-rev.css
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
x-content-type-options
nosniff
age
4128585
status
200
vary
Accept-Encoding
content-length
51572
x-xss-protection
1; mode=block
last-modified
Thu, 29 Aug 2019 19:30:36 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d6827dc-c974"
strict-transport-security
max-age=31536000
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 29 Aug 2020 04:43:37 GMT
Raleway-Bold.woff2
zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
51 KB
51 KB
Font
General
Full URL
https://zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Bold.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
9db8bd3e641dc88d54edf476a148e75e29b4e8ccd040cb340404d557578dcfbd
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://zdnet1.cbsistatic.com/fly/1824-fly/css/core/main-d833df87ab-rev.css
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
x-content-type-options
nosniff
age
7379256
status
200
vary
Accept-Encoding
content-length
52212
x-xss-protection
1; mode=block
last-modified
Tue, 23 Jul 2019 09:13:41 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d36cfc5-cbf4"
strict-transport-security
max-age=31536000
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Jul 2020 12:03:46 GMT
Raleway-Light.woff2
zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
50 KB
51 KB
Font
General
Full URL
https://zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Light.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
6de73873dd441f953668e77030299f082e0f3e6335bf944d88d44978162e6609
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://zdnet1.cbsistatic.com/fly/1824-fly/css/core/main-d833df87ab-rev.css
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
x-content-type-options
nosniff
age
7968773
status
200
vary
Accept-Encoding
content-length
51608
x-xss-protection
1; mode=block
last-modified
Tue, 16 Jul 2019 08:38:39 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d2d8d0f-c998"
strict-transport-security
max-age=31536000
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 15 Jul 2020 18:06:51 GMT
en.js
zdnet2.cbsistatic.com/fly/js/libs/evidon/translations/
311 KB
14 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/libs/evidon/translations/en.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
caab9bbec165591d5214448b624dae44a3cbc575721ba71da2f7130bbbcbc6dc
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
261332
status
200
vary
Accept-Encoding
content-length
14353
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:17 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e3585-4ddff"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 20 Oct 2019 23:04:15 GMT
vendorlist.js
zdnet2.cbsistatic.com/fly/js/libs/evidon/
113 KB
51 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/libs/evidon/vendorlist.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
eb07b53d262575cef96004e2be725ac235db39262e9bb8466a2a9b85cf532aa8
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
413971
status
200
vary
Accept-Encoding
content-length
52305
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:17 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e3585-1c3b9"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 19 Oct 2019 04:33:53 GMT
main.default.js
zdnet3.cbsistatic.com/fly/1824-fly/js/
209 KB
69 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/1824-fly/js/main.default.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
8208aba4a966a8881e913a09da3224fdf2d13bd4db81cabbb11373e76bb18ab1
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
18662
status
200
vary
Accept-Encoding
content-length
70811
x-xss-protection
1; mode=block
last-modified
Wed, 16 Oct 2019 18:10:38 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da75d1e-34353"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 23 Oct 2019 18:28:45 GMT
ls-zdnet.js
js-sec.indexww.com/ht/
85 KB
26 KB
Script
General
Full URL
https://js-sec.indexww.com/ht/ls-zdnet.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
57e1e8e64fe95a0acc0822d690633b9450b26919fcedc32958ebcf7d39393181

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:47 GMT
Content-Encoding
gzip
Last-Modified
Wed, 16 Oct 2019 23:15:30 GMT
Server
Apache
ETag
"7621ee-15269-5950f46e4f678"
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=2234
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/javascript
Content-Length
26184
Expires
Thu, 17 Oct 2019 00:17:01 GMT
YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
c.go-mpulse.net/boomerang/ Frame B8E4
187 KB
55 KB
Script
General
Full URL
https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.32.243.235 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-32-243-235.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:47 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/javascript;charset=UTF-8
Cache-Control
max-age=604800, s-maxage=604800
Transfer-Encoding
chunked
Connection
keep-alive, Transfer-Encoding
Timing-Allow-Origin
*
gpt.js
securepubads.g.doubleclick.net/tag/js/
45 KB
15 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
sffe /
Resource Hash
eed2b7b85bfd84ebdcda3f2d24b5b4566dc77d0340efb27b20e00a5b6085af2e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"309 / 702 of 1000 / last-modified: 1571261169"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14547
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:47 GMT
sfp.js
native.sharethrough.com/assets/
425 KB
120 KB
Script
General
Full URL
https://native.sharethrough.com/assets/sfp.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.196.40 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-224-196-40.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
98eb2463be19049566aa96149eafffe28130fcdf38a3df7274dd77bd4741471a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:27:26 GMT
content-encoding
gzip
last-modified
Wed, 16 Oct 2019 18:16:49 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C1
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
public, max-age=3600
x-amz-cf-id
9KzuJvMfzxeA4S3-ycU8yo-OWsCG531l8Dia0-dMYuotNG3FBOvk9w==
via
1.1 3bf3e75bcb9a86b3eb343a1d4392a6df.cloudfront.net (CloudFront)
expires
Wed, 16 Oct 2019 19:16:47 GMT
18863
l.betrad.com/site/v3/425/3445/1/1/1/1/
0
120 B
Image
General
Full URL
https://l.betrad.com/site/v3/425/3445/1/1/1/1/18863?consent=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.205.11.82 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-205-11-82.compute-1.amazonaws.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
x-powered-by
Express
etag
W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary
Accept-Encoding
icong1.png
c.evidon.com/pub/
600 B
899 B
Image
General
Full URL
https://c.evidon.com/pub/icong1.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.45.108.200 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-45-108-200.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
40d2dae0209b964e6ceb2607faafc02bb3d6efa0d73f47a4ab2a17279f642b91

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
last-modified
Tue, 21 May 2019 16:14:21 GMT
server
AkamaiNetStorage
status
200
etag
"d08da9f445b63100a56646de99043059:1558455261"
vary
Accept-Encoding
access-control-allow-methods
GET,OPTIONS,POST
content-type
image/png
access-control-allow-origin
access-control-max-age
86400
cache-control
max-age=86400
accept-ranges
bytes
access-control-allow-headers
*
content-length
623
18863
l.betrad.com/site/v3/425/3445/1/2/1/1/
0
120 B
Image
General
Full URL
https://l.betrad.com/site/v3/425/3445/1/2/1/1/18863?consent=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.205.11.82 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-205-11-82.compute-1.amazonaws.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
x-powered-by
Express
etag
W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary
Accept-Encoding
;ord=1571269187793
ad.doubleclick.net/ddm/ad/qhifvdf/mnrlvmieww/qn/ixl/zczhgo/
43 B
194 B
Image
General
Full URL
https://ad.doubleclick.net/ddm/ad/qhifvdf/mnrlvmieww/qn/ixl/zczhgo/;ord=1571269187793?
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.205.230 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s24-in-f230.1e100.net
Software
cafe /
Resource Hash
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 23:39:47 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
43
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rid
match.adsrvr.org/track/
109 B
537 B
XHR
General
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=184216
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.51.104.248 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-51-104-248.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e1887a901d847a6cbd14a5e5e33005b67a51ea5ccb5ddecd90e2f1da213b89dc

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
x-aspnet-version
4.0.30319
status
200
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.zdnet.com
cache-control
private
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length
109
expires
Fri, 15 Nov 2019 23:39:47 GMT
urs.js
urs.zdnet.com/sdk/
50 KB
50 KB
Script
General
Full URL
https://urs.zdnet.com/sdk/urs.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.38.167 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
167.38.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
via
1.1 google
last-modified
Thu, 07 Feb 2019 14:05:56 GMT
etag
"5c5c3b44-c7f5"
content-type
application/javascript
status
200
accept-ranges
bytes
alt-svc
clear
content-length
51189
integrator.js
adservice.google.de/adsid/
109 B
323 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/
109 B
319 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
pubads_impl_2019100301.js
securepubads.g.doubleclick.net/gpt/
157 KB
58 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
sffe /
Resource Hash
d98e77e558ef5c298f4c28cdd1604914a16a3fcc9249904ba70c57d989fb6aab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 03 Oct 2019 13:06:21 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
58949
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:47 GMT
scrolling-mpu-22779a851e-rev.js
zdnet3.cbsistatic.com/fly/js/components/
956 B
598 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/scrolling-mpu-22779a851e-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
4d565f67641c732365c3180ec1e37c7a987825faad3e8632de8a07a9101feedd
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
26318
status
200
vary
Accept-Encoding
content-length
491
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:32:11 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5da4bf2b-3bc"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 23 Oct 2019 16:21:09 GMT
config.json
c.go-mpulse.net/api/ Frame B8E4
2 KB
1 KB
XHR
General
Full URL
https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5237564&v=1.571.0&if=&sl=0&si=emyqbs7kxwl-NaN&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,LOGN&acao=
Requested by
Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.32.243.235 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-32-243-235.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
7b19a58671987586f4e0e0dba3f1ee7b040cdb52ae402789a977ed0402bbece7

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:47 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
694
utag.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
93 KB
19 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FC3) /
Resource Hash
64cfd2a647408273e2609b638b29d1f10370824f0169ee4db637edac660dfb66

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
last-modified
Mon, 16 Sep 2019 18:11:12 GMT
server
ECAcc (frc/8FC3)
etag
"4063075910"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=300
accept-ranges
bytes
content-length
19393
expires
Wed, 16 Oct 2019 23:44:47 GMT
isInternalUser.js
iicbsi-a.akamaihd.net/common/js/esi/
22 B
272 B
Script
General
Full URL
https://iicbsi-a.akamaihd.net/common/js/esi/isInternalUser.js?cb=cbsiInternal
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:6c00::210:ba12 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:47 GMT
Cache-Control
max-age=117295
Server
AkamaiNetStorage
Connection
keep-alive
ETag
"fb25287978f1b619e801f164a2dfd9ea:1473886414"
Content-Length
22
Content-Type
application/x-javascript
vglnk.js
cdn.viglink.com/api/
78 KB
28 KB
Script
General
Full URL
https://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a10d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
cf-cache-status
HIT
age
188656
cf-ray
526ddfc91dddcbb4-VIE
status
200
content-length
27719
x-amz-id-2
HNEV4caKoOdziBrXGZIDp4CzG6boiBMb4TLu65nU6otYm4+p2OQwr1vWix1CX0FBodMy916W6w4=
last-modified
Mon, 16 Sep 2019 19:15:01 GMT
server
cloudflare
etag
"1545d811432c0074356408ee8f6c1e23"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
FB54A2C70C0BB866
cache-control
public, max-age=1800
accept-ranges
bytes
content-type
text/javascript
expires
Thu, 17 Oct 2019 00:09:48 GMT
utag.1779.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
3 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1779.js?utv=ut4.43.201812051842
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F23) /
Resource Hash
cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2016 20:43:57 GMT
server
ECAcc (frc/8F23)
etag
"392561602"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1785
expires
Thu, 31 Oct 2019 23:39:47 GMT
utag.1782.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F14) /
Resource Hash
791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
last-modified
Mon, 29 Oct 2018 17:20:42 GMT
server
ECAcc (frc/8F14)
etag
"3447796852"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1071
expires
Thu, 31 Oct 2019 23:39:47 GMT
utag.1787.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
142 KB
48 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F9A) /
Resource Hash
95ec4dea002be118a633dc5070c23358d10e179ad3de44f23ac97578c6971df7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
last-modified
Wed, 04 Sep 2019 18:05:01 GMT
server
ECAcc (frc/8F9A)
etag
"3504427907+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
48569
expires
Thu, 31 Oct 2019 23:39:47 GMT
utag.1790.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
938 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1790.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F10) /
Resource Hash
10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
last-modified
Mon, 01 Aug 2016 14:31:10 GMT
server
ECAcc (frc/8F10)
etag
"2267415266+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
872
expires
Thu, 31 Oct 2019 23:39:47 GMT
utag.1791.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1791.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F39) /
Resource Hash
7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
last-modified
Mon, 01 Aug 2016 14:31:10 GMT
server
ECAcc (frc/8F39)
etag
"3334871598+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1196
expires
Thu, 31 Oct 2019 23:39:47 GMT
utag.1792.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
4 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1792.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FF4) /
Resource Hash
dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
last-modified
Thu, 28 Jul 2016 14:28:47 GMT
server
ECAcc (frc/8FF4)
etag
"2022868805"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1664
expires
Thu, 31 Oct 2019 23:39:47 GMT
utag.1797.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
969 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F7F) /
Resource Hash
3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
last-modified
Wed, 25 Jan 2017 20:07:58 GMT
server
ECAcc (frc/8F7F)
etag
"1907756232"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
883
expires
Thu, 31 Oct 2019 23:39:47 GMT
tag.aspx
ml314.com/
26 KB
12 KB
Script
General
Full URL
https://ml314.com/tag.aspx?1792019
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.227.160 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-251-227-160.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
9c6af299685617864c257472040f437ef951afec994720a24781931cc3527017

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:48 GMT
Content-Encoding
gzip
Last-Modified
Wed, 16 Oct 2019 18:44:52 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, max-age=68704
Connection
keep-alive
Content-Length
11933
Expires
Thu, 17 Oct 2019 18:44:52 GMT
lightbox.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 8128
326 B
545 B
Script
General
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1571269187995&lv=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
d6a75907d2f5e09455d3cdd4197c508ef0d05ab6a77c6eac4fdebdbaf900bfd4

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
server
cloudflare
age
191013
x-powered-by
ASP.NET
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cf-ray
526ddfc93d938c74-VIE
st.v3.js
www.everestjs.net/static/
25 KB
7 KB
Script
General
Full URL
https://www.everestjs.net/static/st.v3.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.90.90 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a184-31-90-90.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
3624e97a6a4f6fb481369929e579039d00be03b0a2e5d1f5f961c44dfd98940c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:48 GMT
Content-Encoding
gzip
Last-Modified
Mon, 12 Aug 2019 09:05:18 GMT
Server
Apache
ETag
"1ff0663-624a-58fe7d2af0fea"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=43304
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
7175
Expires
Thu, 17 Oct 2019 11:41:32 GMT
ds.js
dw.cbsi.com/js/cbsi/
18 KB
7 KB
Script
General
Full URL
https://dw.cbsi.com/js/cbsi/ds.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1791.js?utv=ut4.43.201805241512
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
d696da403b0169c2191d0ec0b0fcdaa85487b21b19fd58f4b1fb5b9edf40b153

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:48 GMT
Content-Encoding
gzip
Last-Modified
Wed, 13 Sep 2017 19:06:40 GMT
Server
Apache/2.4.25
ETag
"1917-55916dc13f000"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=43200, s-maxage=1800
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=80, max=178
Content-Length
6423
Expires
Thu, 17 Oct 2019 00:09:48 GMT
cbsinteractive.js
tru.am/scripts/custom/
3 KB
1 KB
Script
General
Full URL
https://tru.am/scripts/custom/cbsinteractive.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:a322 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
885fb8b9c3d2738bd627def3899f26d4d42641bbb868cc99d1fbc16f0ed9f4c6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
br
cf-cache-status
MISS
x-guploader-uploadid
AEnB2Uo90pcvZQSaqFvLYIrzTLKTmLlF4SjeUCu-uLPG1qDqpMePj6N0ioJHq-8LjaGQyt-k7jfXmq9jviRVRGcnDz0gR6F6NA
x-goog-storage-class
REGIONAL
status
200
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
text/javascript
last-modified
Tue, 30 Apr 2019 19:32:26 GMT
server
cloudflare
etag
W/"c486c91d1321adf59073588524182108"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=9gbW7g==, md5=xIbJHRMhrfWQc1iFJBghCA==
x-goog-generation
1556652746634603
cache-control
public, max-age=86400
x-goog-stored-content-length
2725
cf-ray
526ddfc96ee98c86-VIE
expires
Thu, 17 Oct 2019 23:39:48 GMT
anonc.js
dw.cbsi.com/
73 B
620 B
Script
General
Full URL
https://dw.cbsi.com/anonc.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
348d4be6afe7f85e7a4ff9078bf986a08f093749008d312fccba7ac9637db002

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:48 GMT
Server
Apache/2.4.25
Etag
Z1Z/hF2nqkTNkiKAXp8.1.dw_anonc
P3P
CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"
Cache-control
private, max-age=43200, s-max-age=0
Connection
Keep-Alive
Content-Type
application/javascript
Keep-Alive
timeout=80, max=311
Content-Length
73
Expires
Mon, 05 Jan 1970 12:12:12 GMT
pixel.gif
cdn.viglink.com/images/
43 B
114 B
Image
General
Full URL
https://cdn.viglink.com/images/pixel.gif?ch=1&rn=1.0191265194615413
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a10d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
cf-cache-status
REVALIDATED
last-modified
Tue, 10 Feb 2015 03:29:39 GMT
server
cloudflare
x-amz-request-id
398DB255F765F8AE
etag
"221d8352905f2c38b3cb2bd191d630b0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
max-age=15, must-revalidate
accept-ranges
bytes
cf-ray
526ddfc94e3dcbb4-VIE
content-length
43
x-amz-id-2
1mZ+cxwNG2syWohCFYvUscOgm4ABp6ZJYPPWOCCIpQflvsVnwWQdkXtJzi6TPlQTEBsCyHcJleQ=
pixel.gif
cdn.viglink.com/images/
43 B
275 B
Image
General
Full URL
https://cdn.viglink.com/images/pixel.gif?ch=2&rn=1.0191265194615413
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a10d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
cf-cache-status
UPDATING
age
16
cf-ray
526ddfc94e42cbb4-VIE
status
200
content-length
43
x-amz-id-2
1mZ+cxwNG2syWohCFYvUscOgm4ABp6ZJYPPWOCCIpQflvsVnwWQdkXtJzi6TPlQTEBsCyHcJleQ=
last-modified
Tue, 10 Feb 2015 03:29:39 GMT
server
cloudflare
etag
"221d8352905f2c38b3cb2bd191d630b0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
398DB255F765F8AE
cache-control
max-age=15, must-revalidate
accept-ranges
bytes
content-type
image/gif
user.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 8128
762 KB
124 KB
Script
General
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637057951420142886
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1571269187995&lv=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3c9bb3631896aee1e930e140eb8fcbb4ad9cd9b96ec259b88b4b2fce0a55e805

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
qP10qPK8evED/0zxduUG5Q==
age
190990
cf-polished
origSize=1198838
status
200
last-modified
Mon, 23 Sep 2019 18:35:07 GMT
x-ms-lease-status
unlocked
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
x-ms-request-id
21a330a5-b01e-013b-403e-7d51ca000000
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
526ddfc96da18c74-VIE
expires
Thu, 15 Oct 2020 23:39:48 GMT
fb_lightbox.2.1.5.css
www.lightboxcdn.com/static/
4 KB
1 KB
Stylesheet
General
Full URL
https://www.lightboxcdn.com/static/fb_lightbox.2.1.5.css?cb=637048605067352348
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637057951420142886
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b9028c7ecccf4f31fafcfca176cd6ed38197d7b3d6ea4c107b98af8eecc525b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
q4B4xYJoZwx9ikt94o1nCA==
age
190951
cf-polished
origSize=6016
x-ms-meta-cbmodifiedtime
Wed, 10 Apr 2019 18:50:43 GMT
status
200
last-modified
Wed, 10 Apr 2019 19:06:17 GMT
x-ms-lease-status
unlocked
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
x-ms-request-id
a8c06077-501e-007a-013d-723f8c000000
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
526ddfc9cdc88c74-VIE
expires
Thu, 15 Oct 2020 23:39:48 GMT
ls.html
www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 7FA8
0
0
Document
General
Full URL
https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637048605067352348
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637057951420142886
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
www.lightboxcdn.com
:scheme
https
:path
/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637048605067352348
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
accept-encoding
gzip, deflate, br
cookie
__cfduid=d540e67ed172818f6b66ea8c726d47c961571269188
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/

Response headers

status
200
date
Wed, 16 Oct 2019 23:39:48 GMT
content-type
text/html
content-md5
xa1/rdPe0J6SwxlD7atkzw==
last-modified
Mon, 23 Sep 2019 18:35:06 GMT
x-ms-request-id
3f676f03-301e-00cb-247a-84c7f1000000
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
cf-cache-status
MISS
expires
Thu, 15 Oct 2020 23:39:48 GMT
cache-control
public, max-age=31536000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
server
cloudflare
cf-ray
526ddfc9cdcb8c74-VIE
content-encoding
br
t.gif
www.lightboxcdn.com/z9g/
35 B
256 B
Image
General
Full URL
https://www.lightboxcdn.com/z9g/t.gif?c=1571269188118&h=www.zdnet.com&e=p&u=40913
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 16 Oct 2019 23:39:48 GMT
cf-cache-status
HIT
content-md5
KNaBTzCeoon4R8ac+RGUxg==
age
1096713
cf-polished
status=not_needed
x-ms-meta-cbmodifiedtime
Tue, 26 Feb 2019 00:59:40 GMT
status
200
content-length
35
x-ms-lease-status
unlocked
last-modified
Tue, 26 Feb 2019 01:15:02 GMT
server
cloudflare
etag
0x8D69B87D5A1B25F
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
x-ms-request-id
48b7eafb-401e-010c-457d-f6fd65000000
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
526ddfc9cdca8c74-VIE
cf-bgj
imgq:85
utsync.ashx
ml314.com/
906 B
1 KB
Script
General
Full URL
https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=50070&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&pv=1571269188161_5qeqbv4gn&bl=en-us&cb=2633157&return=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D22052%26dpuuid%3D%5BPersonID%5D%26redir%3D&ht=&d=&dc=&si=1571269188161_5qeqbv4gn&cid=463420f8-d49a-4522-9502-39fc1d0f882c&s=1600x1200&rp=
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?1792019
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.227.160 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-251-227-160.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
dc7b283c3bf79da4c932fe5c404d5d582873ef3c753143e81ffce2d98029a6c9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:48 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
p3P
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control
private
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
516
Expires
0
ud.ashx
in.ml314.com/
20 B
698 B
Script
General
Full URL
https://in.ml314.com/ud.ashx?topiclimit=&cb=1792019
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?1792019
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.225.45.120 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-225-45-120.compute-1.amazonaws.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:48 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, no-cache="set-cookie"
Connection
keep-alive
Content-Length
138
Expires
Thu, 17 Oct 2019 23:39:48 GMT
article-646651a118-rev.js
zdnet4.cbsistatic.com/fly/js/pages/
160 KB
45 KB
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/js/pages/article-646651a118-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
992e73adb3e1f6f91021aec811784c5c06708c938bc3843583f56ea3fac5c1a2
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
179314
status
200
vary
Accept-Encoding
content-length
45961
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:32:20 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da4bf34-28124"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 21 Oct 2019 21:51:13 GMT
CBSI-PLAYER.js
vidtech.cbsinteractive.com/uvpjs/0.42.297/
1 MB
281 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
age
1697793
x-cache
HIT, HIT
status
200
content-length
286838
x-amz-id-2
eFLdg4aPXUFc7W4j8Nhh9UdduMDflMLRIufQ6v/Vh6+pWt+vfGcNnF3gpKRr47exsFfoiPpv1MY=
x-served-by
cache-dca17783-DCA, cache-fra19147-FRA
last-modified
Fri, 01 Feb 2019 18:20:56 GMT
server
AmazonS3
x-timer
S1571269188.217908,VS0,VE0
etag
"eb5dd4ed3dcb7641ebbcb604d7ddb038"
vary
Accept-Encoding
x-amz-request-id
F767A360D0453B01
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
3, 7
chartbeat.js
static.chartbeat.com/js/
35 KB
14 KB
Script
General
Full URL
https://static.chartbeat.com/js/chartbeat.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:d400:18:1fcd:349:ca21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
99fd27cd410417b5633d3fc37196751afc4b3f9ffa5853dedb73cfcb3e810d7c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 22:06:50 GMT
content-encoding
gzip
last-modified
Thu, 01 Aug 2019 01:56:46 GMT
server
nginx
age
5577
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/x-javascript
status
200
cache-control
max-age=7200
x-amz-cf-pop
FRA2
x-amz-cf-id
xCUf1zCjWTERymHAIjY40cXCFqGHX8Um92mnsz03DbSsclO-P2FNEA==
via
1.1 ea71ce4ac4724c3ed76f4816ddddaa6c.cloudfront.net (CloudFront)
expires
Thu, 17 Oct 2019 00:06:50 GMT
mpulse-1.0.2.js
zdnet1.cbsistatic.com/fly/js/libs/
12 KB
5 KB
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
465615
status
200
vary
Accept-Encoding
content-length
4877
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:19 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e3587-2fdf"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 18 Oct 2019 14:19:33 GMT
csync.ashx
ml314.com/
Redirect Chain
  • https://tags.bluekai.com/site/20486?limit=0&id=3605384201481224220&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=3605384201481224220%26eid=50056
  • https://ml314.com/csync.ashx?fp=X7wNw99999OYI355&person_id=3605384201481224220&eid=50056
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=X7wNw99999OYI355&person_id=3605384201481224220&eid=50056
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.227.160 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-251-227-160.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:48 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Thu, 17 Oct 2019 19:39:48 GMT

Redirect headers

Location
https://ml314.com/csync.ashx?fp=X7wNw99999OYI355&person_id=3605384201481224220&eid=50056
Date
Wed, 16 Oct 2019 23:39:48 GMT
Connection
keep-alive
Content-Length
0
BK-Server
5d79
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
csync.ashx
ml314.com/
Redirect Chain
  • https://idsync.rlcdn.com/395886.gif?partner_uid=3605384201481224220
  • https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzYwNTM4NDIwMTQ4MTIyNDIyMBAAGg0IxNSe7QUSBQjoBxAAQgBKAA
  • https://ml314.com/csync.ashx?fp=b580563a721aa3eb8adea97fa5ddcf480b48f730076c68ee326fbf799c4fe8adf4cb09cee1a4f8eb&person_id=3605384201481224220&eid=50082
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=b580563a721aa3eb8adea97fa5ddcf480b48f730076c68ee326fbf799c4fe8adf4cb09cee1a4f8eb&person_id=3605384201481224220&eid=50082
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.227.160 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-251-227-160.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:48 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Thu, 17 Oct 2019 19:39:48 GMT

Redirect headers

date
Wed, 16 Oct 2019 23:39:48 GMT
via
1.1 google
status
307
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://ml314.com/csync.ashx?fp=b580563a721aa3eb8adea97fa5ddcf480b48f730076c68ee326fbf799c4fe8adf4cb09cee1a4f8eb&person_id=3605384201481224220&eid=50082
cache-control
no-cache, no-store
timing-allow-origin
*
alt-svc
clear
content-length
0
csync.ashx
ml314.com/
Redirect Chain
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3605384201481224220%26eid=50220
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3605384201481224220%26eid=50220&mm_bnc&mm_bct&UUID=9bb15da7-a3e5-4d00-9ed8-18dc39df258b
  • https://ml314.com/csync.ashx?fp=9bb15da7-a3e5-4d00-9ed8-18dc39df258b&person_id=3605384201481224220&eid=50220
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=9bb15da7-a3e5-4d00-9ed8-18dc39df258b&person_id=3605384201481224220&eid=50220
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.227.160 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-251-227-160.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:47 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Thu, 17 Oct 2019 19:39:48 GMT

Redirect headers

Date
Wed, 16 Oct 2019 23:39:48 GMT
Server
MT3 1796 9706391 master zrh-pixel-x19
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location
https://ml314.com/csync.ashx?fp=9bb15da7-a3e5-4d00-9ed8-18dc39df258b&person_id=3605384201481224220&eid=50220
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
0
Expires
Wed, 16 Oct 2019 23:39:47 GMT
csync.ashx
ml314.com/
Redirect Chain
  • https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3605384201481224220
  • https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3605384201481224220
  • https://ml314.com/csync.ashx?fp=2da2853434d6ec49b240db22b03e9cd5&eid=50146&person_id=3605384201481224220
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=2da2853434d6ec49b240db22b03e9cd5&eid=50146&person_id=3605384201481224220
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.227.160 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-251-227-160.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:47 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Thu, 17 Oct 2019 19:39:48 GMT

Redirect headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:48 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Location
https://ml314.com/csync.ashx?fp=2da2853434d6ec49b240db22b03e9cd5&eid=50146&person_id=3605384201481224220
Cache-Control
no-cache
X-Server
10.45.8.205
Connection
keep-alive
Content-Length
0
Expires
0
pixel
ps.eyeota.net/
0
141 B
Image
General
Full URL
https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
18.195.251.148 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-195-251-148.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:48 GMT
Cache-control
private
Content-Length
0
demconf.jpg
dpm.demdex.net/
Redirect Chain
  • https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3605384201481224220&redir=
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3605384201481224220&redir=
42 B
840 B
Image
General
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3605384201481224220&redir=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.30.105.51 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-30-105-51.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v048-08178b371.edge-irl1.demdex.com 5.61.0.20191015084456 6ms (+1ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
gNSm0CkXT9Q=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
NyOR0Y0pQoM=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3605384201481224220&redir=
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
config.json
c.go-mpulse.net/api/v2/
2 KB
1 KB
XHR
General
Full URL
https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1571269188204&s=0b6f1882e41c5c47cacfd5a14c28a105cad872464ce1d4e696a9561c89108eb9
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.32.243.235 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-32-243-235.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
0ccfac17392f8b1cf81dccfde9b89171db92f42c6d7ceeef294dac3e04f206df

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:48 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
735
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F&u=CBsVclBNMQ75Cj1H29&d=zdnet.com&g=65713&g0=security&g1=tom%20foremski&n=1&f=00001&c=0&x=0&m=0&y=2261&o=1585&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=1268&t=C9iUf0Ceh6j-DeVmY1xJY-BDPEmDB&V=116&i=Cyberbit%20discovers%20international%20airport%20riddled%20with%20Bitcoin-mining%20malware%20%7C%20ZDNet&tz=-120&_acct=anon&sn=1&sv=DvwFL-BTlf6CVPgzEWp_KzCy5vqW&sd=1&im=067b2ff3&_
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.193.242.172 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-193-242-172.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Wed, 16 Oct 2019 23:39:48 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
ta-pagesocial-sdk.js
tru.am/scripts/
35 KB
12 KB
Script
General
Full URL
https://tru.am/scripts/ta-pagesocial-sdk.js
Requested by
Host: tru.am
URL: https://tru.am/scripts/custom/cbsinteractive.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:a322 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 18 Apr 2019 03:51:14 GMT
server
cloudflare
age
4236
etag
W/"942d5ae1e512ccdf18813550428dd002"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
cf-ray
526ddfca7f388c86-VIE
expires
Thu, 17 Oct 2019 23:39:48 GMT
beacon
beacon.tru.am/
0
352 B
Fetch
General
Full URL
https://beacon.tru.am/beacon
Requested by
Host: tru.am
URL: https://tru.am/scripts/ta-pagesocial-sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:a222 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded;charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 23:39:48 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
status
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, private, max-age=0
cf-ray
526ddfcb28c7cbac-VIE
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 UTC
id
dpm.demdex.net/
2 KB
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&ts=1571269188512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.30.105.51 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-30-105-51.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e5e3c735c1b1f62eab17d6352aca62faba788d6e14442f3df924e393e21c7dd2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v048-0bc0bd778.edge-irl1.demdex.com 5.61.0.20191015084456 3ms (+0ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
X-TID
bNUB2CerT0U=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
675
Expires
Thu, 01 Jan 1970 00:00:00 GMT
utag.v.js
tags.tiqcdn.com/utag/tiqapp/
2 B
116 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=cbsi/zdnetglobalsite/201909161811&cb=1571269188512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FA5) /
Resource Hash
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
last-modified
Thu, 14 Apr 2016 16:59:33 GMT
server
ECAcc (frc/8FA5)
etag
"2243872957"
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=600
accept-ranges
bytes
content-length
2
expires
Wed, 16 Oct 2019 23:49:47 GMT
c.gif
dw.cbsi.com/clear/
42 B
346 B
Image
General
Full URL
https://dw.cbsi.com/clear/c.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=28d0a422-cfea-4d23-bae1-2b6eaf0a254f&assettitle=cyberbit%20discovers%20international%20airport%20riddled%20with%20bitcoin-mining%20malware&assettype=content_article&pubdate=2019-10-16%2022%3A54%3A13&viewguid=463420f8-d49a-4522-9502-39fc1d0f882c&devicetype=desktop&sitetype=responsive%20web&author=tom%20foremski&authorid=a2cf5ea4-8175-11e2-9d12-0018fe8a00b0&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&ts=1571269188504&ld=www.zdnet.com&ldc=60cce569-6e45-4d3d-8a53-82fe282cef2d&brwinsz=1600x1200&brscrsz=1600x1200&brlang=en-US&tcset=utf8&im=dsjs&clgf=Z1Z%2FhF2nqkTNkiKAXp8&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&title=Cyberbit%20discovers%20international%20airport%20riddled%20with%20Bitcoin-mining%20malware%20%7C%20ZDNet
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:48 GMT
Server
Apache/2.4.25
Vary
*
Content-Type
image/gif
Cache-control
no-cache, must-revalidate, no-transform
Connection
Keep-Alive
Keep-Alive
timeout=80, max=307
Content-Length
42
Expires
Mon, 05 Jan 1970 12:12:12 GMT
ping
api.viglink.com/api/
266 B
946 B
XHR
General
Full URL
https://api.viglink.com/api/ping
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
95effe867db89e11e734c3042e1a4463222db03972c75c257906b83b1ad6f847

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:48 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
266
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Cookie set dest5.html
cbsi.demdex.net/ Frame 1120
0
0
Document
General
Full URL
https://cbsi.demdex.net/dest5.html?d_nsid=undefined
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.175.110 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-31-175-110.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Host
cbsi.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Accept-Encoding
gzip, deflate, br
Cookie
demdex=00120815331763341403966649282315108448
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Wed, 16 Oct 2019 10:21:45 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=00120815331763341403966649282315108448;Path=/;Domain=.demdex.net;Expires=Mon, 13-Apr-2020 23:39:48 GMT;Max-Age=15552000
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding, User-Agent
X-TID
MjLVfFg7RdI=
Content-Length
2764
Connection
keep-alive
id
saa.cbsi.com/
90 B
576 B
XHR
General
Full URL
https://saa.cbsi.com/id?d_visid_ver=2.3.0&d_fieldgroup=A&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&mid=00352975121889695403989015476005537048&ts=1571269188550
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.188.31.119 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-15-188-31-119.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
24afd9816a9512461bcd633855ec499112a8392d95a3ce1e0cbed2b8ceaab773
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

status
200
date
Wed, 16 Oct 2019 23:39:48 GMT
x-content-type-options
nosniff
server
jag
xserver
anedge-95484cfc6-qtgjk
vary
Origin
x-c
master-1047.I1d1c81.M0-302
p3p
CP="This is not a P3P policy"
access-control-allow-origin
https://www.zdnet.com
access-control-allow-credentials
true
content-type
application/x-javascript
content-length
90
x-xss-protection
1; mode=block
id
dpm.demdex.net/
2 KB
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&d_mid=00352975121889695403989015476005537048&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%012ED3D5227FFF8000-40143FF1A05629F0&ts=1571269188609
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.30.105.51 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-30-105-51.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
55799d8028d831643ba65704f93b5935686ff8307f27c47228496f9fcbff6a5c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v048-0a4466b84.edge-irl1.demdex.com 5.61.0.20191015084456 4ms (+1ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
X-TID
kBoSDpN+Rhk=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
675
Expires
Thu, 01 Jan 1970 00:00:00 GMT
s7563000269179
saa.cbsi.com/b/ss/cnetzdnetglobalsite/10/JS-2.3.0/
2 KB
2 KB
Script
General
Full URL
https://saa.cbsi.com/b/ss/cnetzdnetglobalsite/10/JS-2.3.0/s7563000269179?AQB=1&ndh=1&pf=1&callback=s_c_il[0].doPostbacks&et=1&t=17%2F9%2F2019%201%3A39%3A48%204%20-120&d.&nsid=0&jsonv=1&.d&mid=00352975121889695403989015476005537048&aid=2ED3D5227FFF8000-40143FF1A05629F0&aamlh=6&ce=UTF-8&ns=cbsinteractive&pageName=zdnet%3A%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F&g=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&cc=USD&ch=editorial&server=www.zdnet.com&v0=ftag%3ARSSbaffb68%7C&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c1=zdnet&v1=zdnet&h1=editorial%7Carticle&c2=D%3Dv2&v2=eu&l2=113c25b6-ec91-11e3-95d2-02911863765e%7C113c25b6-ec91-11e3-95d2-02911863765e%7C11858747-ec91-11e3-95d2-02911863765e&c3=D%3Dv3&v3=responsive%20web%7Cdesktop&l3=a2cf5ea4-8175-11e2-9d12-0018fe8a00b0&c4=D%3Dv4&c5=D%3Dv5&v5=cnetzdnetglobalsite&c6=D%3Dv6&v6=editorial%7Carticle&c7=D%3Dv7&v7=D%3Dg&c8=D%3Dv8&v8=Cyberbit%20discovers%20international%20airport%20riddled%20with%20Bitcoin-mining%20malware%20%7C%20ZDNet&c9=D%3DUser-Agent&c10=D%3Dv10&v10=article&c11=D%3Dv11&v15=not%20authenticated%7Canon&c20=D%3Dv20&v20=cyberbit%20discovers%20international%20airport%20riddled%20with%20bitcoin-mining%20malware&c22=D%3Dv22&v22=content_article&c23=D%3Dv23&v23=113c25b6-ec91-11e3-95d2-02911863765e&c24=D%3Dv24&v24=463420f8-d49a-4522-9502-39fc1d0f882c&c25=D%3Dv25&c26=D%3Dv26&c28=D%3Dv28&c30=D%3Dv30&v30=28d0a422-cfea-4d23-bae1-2b6eaf0a254f&c31=D%3Dv31&c33=D%3Dv33&c34=D%3Dv34&c35=D%3Dv35&v35=Z1Z%2FhF2nqkTNkiKAXp8&c44=D%3Dv44&v44=zdnet&c50=D%3Dv50&c51=D%3Dv51&c52=D%3Dv52&c53=D%3Dv53&c54=D%3Dv54&c65=D%3Dv65&v65=discover&c69=D%3Dv69&v85=false&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&AQE=1
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.188.31.119 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-15-188-31-119.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
1f7311d5849534d0cbe2bfebb7740f327b9c99dc4ffb84ccef58cf4f9523cea0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-aam-tid
hSJN5yUGQrI=
date
Wed, 16 Oct 2019 23:39:48 GMT
x-content-type-options
nosniff
x-c
master-1047.I1d1c81.M0-302
p3p
CP="This is not a P3P policy"
status
200
content-length
1597
x-xss-protection
1; mode=block
dcs
dcs-prod-irl1-v048-0bb7cef0f.edge-irl1.demdex.com 5.61.0.20191015084456 6ms (+0ms)
pragma
no-cache
last-modified
Thu, 17 Oct 2019 23:39:48 GMT
server
jag
xserver
anedge-95484cfc6-f8nkh
etag
3374274887921532928-4615564284243887167
vary
*
content-type
application/x-javascript;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Tue, 15 Oct 2019 23:39:48 GMT
domains
api.viglink.com/api/
76 B
521 B
XHR
General
Full URL
https://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
54b4196e11ec4792c458b7740634a09c7656a5bc2bb289f857e1ac1fed39da46

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:48 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
76
Expires
Thu, 01 Jan 1970 00:00:00 GMT
/
686eb704.akstat.io/
0
354 B
XHR
General
Full URL
https://686eb704.akstat.io/?h.pg=article&when=1571269188705&t_other=custom4%7C624&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=6eee4dbe9b962825e051896280593d8e74ac3ea8&h.t=1571269188223&http.initiator=api&rt.start=api&rt.si=a367b677-19a1-4b32-b5ff-0da51fc0d217&rt.ss=1571269189446&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.32.243.235 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-32-243-235.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:48 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Wed, 16 Oct 2019 23:39:48 GMT
jpt
secure.adnxs.com/
99 B
1 KB
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834629&size=728x90&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=sM3aMiNX&psa=0&promo_sizes=970x250&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
d701acedff5a52204a1033ddcb13ee4cfa9d03777fc0d71ef94eaab9f954daea
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:50 GMT
X-Proxy-Origin
144.76.109.30; 144.76.109.30; 538.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.240:80
AN-X-Request-Uuid
87dde36f-11cb-4fc3-8af1-6dd66aaec35f
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
99
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/
99 B
1 KB
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834625&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=qbx8dy4p&psa=0&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
a4e826cd575126b72bc4e8ee65a10d69136d4d70dacb39d1d852407c51cfda14
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:50 GMT
X-Proxy-Origin
144.76.109.30; 144.76.109.30; 538.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.120:80
AN-X-Request-Uuid
dce9af5e-d425-495f-97aa-000e5877265a
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
99
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/
99 B
1 KB
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834627&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=9kYbMbg7&psa=0&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
89ab6386d6c3daa4576d9a7b4ec1d18bb80004f57d69d9290a2a6c77ca2e6ec0
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:50 GMT
X-Proxy-Origin
144.76.109.30; 144.76.109.30; 538.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.117:80
AN-X-Request-Uuid
c95a07ab-6902-42e6-81a2-9a4ecfaf0c4e
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
99
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/
99 B
1 KB
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834631&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=ODPevibA&psa=0&promo_sizes=300x600&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
409998ea7cd82b19af10cafff130e45dd95a8b4dc901123644639035d81d3e5d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:50 GMT
X-Proxy-Origin
144.76.109.30; 144.76.109.30; 538.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.14:80
AN-X-Request-Uuid
ec3d3319-ef52-4370-ae33-aa3ad4b40e2b
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
99
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/
99 B
1 KB
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834632&size=728x90&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=rxl5hqqi&psa=0&promo_sizes=970x250&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
8ae4e392521897a8b9f08d3af545ddfde937f7ed60c8ef860f637baa6280e970
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:50 GMT
X-Proxy-Origin
144.76.109.30; 144.76.109.30; 538.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.235:80
AN-X-Request-Uuid
1a102295-f3eb-4be7-8576-dee3d5b040b6
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
99
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cygnus
as-sec.casalemedia.com/
65 B
942 B
XHR
General
Full URL
https://as-sec.casalemedia.com/cygnus?v=7.2&s=182823&fn=headertag.IndexExchangeHtb.adResponseCallback&r=%7B%22id%22%3A6213334%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C%22%7D%2C%22imp%22%3A%5B%7B%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22202%22%2C%22siteID%22%3A%22182829%22%7D%2C%22id%22%3A%221%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22220%22%2C%22siteID%22%3A%22183316%22%7D%2C%22id%22%3A%222%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22209%22%2C%22siteID%22%3A%22182828%22%7D%2C%22id%22%3A%223%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22210%22%2C%22siteID%22%3A%22182826%22%7D%2C%22id%22%3A%224%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22208%22%2C%22siteID%22%3A%22182824%22%7D%2C%22id%22%3A%225%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22222%22%2C%22siteID%22%3A%22182825%22%7D%2C%22id%22%3A%226%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22219%22%2C%22siteID%22%3A%22183315%22%7D%2C%22id%22%3A%227%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22201%22%2C%22siteID%22%3A%22182823%22%7D%2C%22id%22%3A%228%22%7D%5D%2C%22ext%22%3A%7B%22source%22%3A%22ixwrapper%22%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22adserver.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%229ba58f0f-4cb0-4fa1-b378-275e5ee0b58f%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID%22%7D%7D%2C%7B%22id%22%3A%22FALSE%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_LOOKUP%22%7D%7D%2C%7B%22id%22%3A%222019-10-16T23%3A39%3A47%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_CREATED_AT%22%7D%7D%5D%7D%5D%7D%7D
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
26d5f8b2eea728749535bb49cd51009762976f81e38b33df53254d7546d6b28b

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:48 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript
Content-Length
85
Expires
Wed, 16 Oct 2019 23:39:48 GMT
utag.1775.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
26 KB
9 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.43.201909161811
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FF9) /
Resource Hash
0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:47 GMT
content-encoding
gzip
last-modified
Thu, 10 Nov 2016 20:41:55 GMT
server
ECAcc (frc/8FF9)
etag
"1112944691"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
8960
expires
Thu, 31 Oct 2019 23:39:47 GMT
utag.277.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
993 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.43.201909161811
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F15) /
Resource Hash
0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2016 20:43:58 GMT
server
ECAcc (frc/8F15)
etag
"461771432"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
863
expires
Thu, 31 Oct 2019 23:39:48 GMT
utag.1772.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1772.js?utv=ut4.43.201909161811
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F31) /
Resource Hash
e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2016 20:43:58 GMT
server
ECAcc (frc/8F31)
etag
"4198895974+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
959
expires
Thu, 31 Oct 2019 23:39:48 GMT
utag.1796.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
8 KB
3 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1796.js?utv=ut4.43.201909161811
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FB7) /
Resource Hash
9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
last-modified
Mon, 28 Nov 2016 15:09:53 GMT
server
ECAcc (frc/8FB7)
etag
"931235332+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
2762
expires
Thu, 31 Oct 2019 23:39:48 GMT
utag.1810.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1810.js?utv=ut4.43.201909161811
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F9D) /
Resource Hash
07178558c596bc2fe33d99750a349d5413fa4571fc778cefbe4f4f367404f6d6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
last-modified
Mon, 08 Jul 2019 17:22:10 GMT
server
ECAcc (frc/8F9D)
etag
"4274102907+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
988
expires
Thu, 31 Oct 2019 23:39:48 GMT
pixel_details.html
www.everestjs.net/static/ Frame B1B8
Redirect Chain
  • https://pixel.everesttech.net/4083/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__EFOPTOUT__%26throttleCook...
  • https://www.everestjs.net/static/pixel_details.html
0
0
Document
General
Full URL
https://www.everestjs.net/static/pixel_details.html
Requested by
Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.90.90 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a184-31-90-90.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
www.everestjs.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/

Response headers

Server
Apache
Last-Modified
Tue, 04 Oct 2011 16:14:21 GMT
ETag
"8623-a6-4ae7b62583140"
Accept-Ranges
bytes
Content-Type
text/html
Content-Encoding
gzip
Content-Length
146
Cache-Control
max-age=13872
Expires
Thu, 17 Oct 2019 03:31:00 GMT
Date
Wed, 16 Oct 2019 23:39:48 GMT
Connection
keep-alive
Vary
Accept-Encoding

Redirect headers

Date
Wed, 16 Oct 2019 23:39:48 GMT
Server
Apache
Set-Cookie
everest_session_v2=XaeqRAAABOLZQDry; path=/; domain=.everesttech.net everest_g_v2=g_surferid~XaeqRAAABOLZQDry; path=/; domain=.everesttech.net; expires=Fri, 10-Sep-2021 10:19:48 GMT
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control
no-cache
Location
https://www.everestjs.net/static/pixel_details.html#google=XaeqRAAABOLZQDry&gsurfer=XaeqRAAABOLZQDry&optout=0&throttleCookie=&time=20191016233948
Content-Length
345
Keep-Alive
timeout=15, max=996521
Connection
Keep-Alive
Content-Type
text/html; charset=iso-8859-1
Cookie set dest5.html
cbsi.demdex.net/ Frame 2E77
0
0
Document
General
Full URL
https://cbsi.demdex.net/dest5.html?d_nsid=0
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.175.110 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-31-175-110.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Host
cbsi.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Accept-Encoding
gzip, deflate, br
Cookie
demdex=00120815331763341403966649282315108448; dextp=269-1-1571269188676|477-1-1571269188777|771-1-1571269188877
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Wed, 16 Oct 2019 08:54:46 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=00120815331763341403966649282315108448;Path=/;Domain=.demdex.net;Expires=Mon, 13-Apr-2020 23:39:48 GMT;Max-Age=15552000
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding, User-Agent
X-TID
EKqGnkQ8Qt8=
Content-Length
2764
Connection
keep-alive
/
www.zdnet.com/components/breaking-news/xhr/
1 KB
1 KB
XHR
General
Full URL
https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1824-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
32eb2fea0269f7de785c491d3f5e9f5707e87055ecc21ae29f56e2dd92ef6e22
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
497
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 16 Oct 2019 23:39:29 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 16 Oct 2019 23:39:49 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
dadc521d-f5a9-4d74-9898-3c9ece7fbd2f
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Thu, 17 Oct 2019 01:09:29 GMT
disqus-count-5922ea1c53-rev.js
zdnet2.cbsistatic.com/fly/js/components/
406 B
401 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/disqus-count-5922ea1c53-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
b8c15c61feffdfe68b168cf2ac8cf58867f38547da3b15d7971a75c44f16bc26
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
462477
status
200
vary
Accept-Encoding
content-length
270
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:12 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d9e3580-196"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 18 Oct 2019 15:11:51 GMT
disqus-loader-db6fae9369-rev.js
zdnet3.cbsistatic.com/fly/js/components/
1 KB
934 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/disqus-loader-db6fae9369-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
4bb0f33f40b38593e1cba1c8b2f15703d33753bbd80f30511dd9c464a959afe7
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
237503
status
200
vary
Accept-Encoding
content-length
642
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:12 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e3580-580"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 21 Oct 2019 05:41:25 GMT
nation-state-spying-malware-revealed-v1.jpg
zdnet2.cbsistatic.com/hub/i/r/2014/11/28/93a18820-76b2-11e4-b569-d4ae52e95e57/thumbnail/70x53/df0f3c8fc4b1ca83a71f3e0ae1afbf2e/
5 KB
4 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2014/11/28/93a18820-76b2-11e4-b569-d4ae52e95e57/thumbnail/70x53/df0f3c8fc4b1ca83a71f3e0ae1afbf2e/nation-state-spying-malware-revealed-v1.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
87895fd04b827870be986cdc2be363c503a6b7eca1ab786a789b471b3652b6c7
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1079898
status
200
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4076
x-xss-protection
1; mode=block
last-modified
Sun, 09 Aug 2015 19:13:10 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 03 Oct 2020 11:41:22 GMT
renee-james.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/09/30/f4a0c85d-3a0d-45ea-8697-359ec3fcc355/thumbnail/70x53/8375ae3d295bfebee1bb0e35fed59868/
1 KB
2 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/09/30/f4a0c85d-3a0d-45ea-8697-359ec3fcc355/thumbnail/70x53/8375ae3d295bfebee1bb0e35fed59868/renee-james.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
24f7451ae040188b7b4fca25ef6ea8312f287d07a88d00fc9b1dabe327bed115
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
582819
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
1503
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"db1915052d15f7815c8b88e879465a1e"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
istock-986666126.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/09/27/141d19e0-0f8a-4a60-82ad-73af01ace37f/thumbnail/70x53/401558f5bf24c560b176c5706b0e85ac/
5 KB
5 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/09/27/141d19e0-0f8a-4a60-82ad-73af01ace37f/thumbnail/70x53/401558f5bf24c560b176c5706b0e85ac/istock-986666126.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
32c2c694bf33100bf116d6a571e3c3be1e914fd47aec0d05051a5cb077b9fc9c
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
760832
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4806
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"07e87c2f4fc7f7c96116d8e2a92790f5"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
istock-482018035.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/09/20/58baaed3-202a-4aff-a4b1-5b6f321ef8c8/thumbnail/70x53/ebb0b66142c8ea6a695c2d4703dad23f/
5 KB
4 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/09/20/58baaed3-202a-4aff-a4b1-5b6f321ef8c8/thumbnail/70x53/ebb0b66142c8ea6a695c2d4703dad23f/istock-482018035.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
682499050894dd63171c826837903d1e3f19ef897b51e51979635d7e8b7904d8
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2261420
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4116
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"901797aebf0b23ecbab534d61ad33bb1"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
/
www.zdnet.com/newsletter/xhr/widget-login/
2 KB
2 KB
XHR
General
Full URL
https://www.zdnet.com/newsletter/xhr/widget-login/?topic=security
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1824-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
4c6270cff1039574ff4269d0333ad2630d80518dc66bf4b9fd9e06493e98d87f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
727
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 16 Oct 2019 23:39:49 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
62438c13-ba0d-4cc4-8d5f-50c9b3431177
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Wed, 16 Oct 2019 23:39:49 GMT
/
www.zdnet.com/m3d0s1/xhr/right-rail/
11 KB
3 KB
XHR
General
Full URL
https://www.zdnet.com/m3d0s1/xhr/right-rail/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1824-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
7ed632d778129f27ac2cc7499ce3accb5eec4c08d95154ca65e1325cb26201bd
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
1606
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 16 Oct 2019 23:39:49 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
341b6a74-ccac-4338-a472-98b630f38c69
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Wed, 16 Oct 2019 23:39:49 GMT
front-door-carousel-56427878d9-rev.js
zdnet1.cbsistatic.com/fly/js/components/
5 KB
2 KB
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/components/front-door-carousel-56427878d9-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
5ecc6a93ec2939faa8dbf80084346c7d940f5a2181ee69343810da52902eb92d
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
465612
status
200
vary
Accept-Encoding
content-length
1564
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:12 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e3580-124a"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 18 Oct 2019 14:19:37 GMT
urban-airship-29ae327ed0-rev.js
zdnet3.cbsistatic.com/fly/js/components/
1 KB
979 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-29ae327ed0-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
fa33d1db535d783b0baf4e74bdc7ce9e54633f87a03669b2803e567088d64ccb
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
98805
status
200
vary
Accept-Encoding
content-length
827
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:32:12 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da4bf2c-514"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 22 Oct 2019 20:13:03 GMT
advertisement-d41d8cd98f-rev.js
zdnet2.cbsistatic.com/fly/js/utils/
0
262 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/utils/advertisement-d41d8cd98f-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
x-content-type-options
nosniff
age
51442
status
200
vary
Accept-Encoding
content-length
0
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:32:27 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5da4bf3b-0"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 23 Oct 2019 09:22:26 GMT
loader.js
cdn.taboola.com/libtrc/cbsinteractive-zdnet/
84 KB
19 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e692d2f4ffcf80a868f605627e06aadec70e3f0a26666dd991245feaec9e09f9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
EZf1UWocOVZ.ZdjwcYckvKVLZ2N1nmxY
content-encoding
gzip
etag
"6bec1a18132e81383ac88556cbc6f118"
age
148
x-cache
HIT
status
200
content-length
18763
x-amz-id-2
0gKvkHO3ipcOgqP/OapwvUJdA0kuGYfITN+dOw5ZpOQRUwcIx0gMREq+E6HZm1BcvpdnHk1tHWM=
x-served-by
cache-fra19139-FRA
last-modified
Wed, 16 Oct 2019 12:49:18 GMT
server
AmazonS3
x-timer
S1571269189.966223,VS0,VE1
date
Wed, 16 Oct 2019 23:39:48 GMT
vary
Accept-Encoding
x-amz-request-id
C8E088C8A7F2D4A4
via
1.1 varnish
cache-control
private,max-age=14401
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
34
x-cache-hits
1
cs.js
sb.scorecardresearch.com/c2/3005086/
0
400 B
Script
General
Full URL
https://sb.scorecardresearch.com/c2/3005086/cs.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.43.201909161811
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:48 GMT
Content-Encoding
gzip
Last-Modified
Fri, 08 Apr 2011 23:11:26 GMT
ETag
"d41d8cd98f00b204e9800998ecf8427e:1349196464"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=259200
Connection
keep-alive
Content-Length
20
Expires
Sat, 19 Oct 2019 23:39:48 GMT
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=3005086&ns__t=1571269188950&ns_c=UTF-8&c8=Cyberbit%20discovers%20international%20airport%20riddled%20with%20Bitcoin-mining%20malware%20%7C%20ZDNet&c7=http...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1571269188950&ns_c=UTF-8&c8=Cyberbit%20discovers%20international%20airport%20riddled%20with%20Bitcoin-mining%20malware%20%7C%20ZDNet&c7=htt...
0
248 B
Image
General
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1571269188950&ns_c=UTF-8&c8=Cyberbit%20discovers%20international%20airport%20riddled%20with%20Bitcoin-mining%20malware%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&c9=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:48 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1571269188950&ns_c=UTF-8&c8=Cyberbit%20discovers%20international%20airport%20riddled%20with%20Bitcoin-mining%20malware%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&c9=
Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:48 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
/
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/
60 KB
15 KB
Script
General
Full URL
https://zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_3xeBFJDuSs0SRW5&Q_LOC=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.43.201909161811
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
78f602a77cadacf7f6825a039e9e0e8901e42ea5c674837351ce82d5f58b7dea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
161767
cf-polished
origSize=62065
status
200
edge-control
max-age=604800
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-bgj
minify
server
cloudflare
x-powered-by
Express
etag
W/"f271-hRKxnJl0+9aHAqBR1SrTUAe+RRE"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=60, s-maxage=604800
cf-ray
526ddfcf1f3964b5-FRA
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
m
secure-us.imrworldwide.com/cgi-bin/
Redirect Chain
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/%23ftag%3DRSSbaf...
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/%23ftag%3DRSSbaf...
44 B
332 B
Image
General
Full URL
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/%23ftag%3DRSSbaffb68%7C&rp=&ts=compact&rnd=1571269188952&ja=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.49.44.242 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-49-44-242.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 23:39:49 GMT
server
nginx
status
200
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin
*
cache-control
no-cache
content-type
image/gif
content-length
44
expires
Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 16 Oct 2019 23:39:49 GMT
server
nginx
status
302
location
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/%23ftag%3DRSSbaffb68%7C&rp=&ts=compact&rnd=1571269188952&ja=1
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin
*
cache-control
no-cache
content-length
0
expires
Thu, 01 Dec 1994 16:00:00 GMT
fbevents.js
connect.facebook.net/en_US/
105 KB
23 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
0629946fe142c676784daa479fe86526051bfa44bdeb5e3f4608fa22b8e153ae
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
content-length
23413
x-xss-protection
0
pragma
public
x-fb-debug
s8pxoJS06z53lhVKtjiBpuHhM0nuslsSIBrBhzgEbxoQpdmr5cOIgZoRKqJA7PtvUJUadYiLuTb17FKq1QgGuA==
x-fb-trip-id
997090344
x-frame-options
DENY
date
Wed, 16 Oct 2019 23:39:48 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
cbs_zQTp2H_zdnet.js
cdn-magiclinks.trackonomics.net/client/static/v2/
95 KB
18 KB
Script
General
Full URL
https://cdn-magiclinks.trackonomics.net/client/static/v2/cbs_zQTp2H_zdnet.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1810.js?utv=ut4.43.201909161811
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:d800:1d:8c8c:47c0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
Apache/2.4.34 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.8 /
Resource Hash
6b58782f772eaeb73d36b47159ed802f146182cf5d8fe4cfd838e6e629e6bd1a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 01:22:41 GMT
content-encoding
gzip
last-modified
Thu, 10 Oct 2019 06:53:39 GMT
server
Apache/2.4.34 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.8
age
80203
status
200
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
access-control-allow-origin
*
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
HpRSPdnmWgwvpkheRhDtb9P0vTXKCl_tlhXhQqgJFCpzyh7bc4Ts0g==
via
1.1 1ac3fd533bf6be1b511077f8b8e23bfd.cloudfront.net (CloudFront)
nation-state-spying-malware-revealed-v1.jpg
zdnet2.cbsistatic.com/hub/i/r/2014/11/28/93a18820-76b2-11e4-b569-d4ae52e95e57/thumbnail/70x53/df0f3c8fc4b1ca83a71f3e0ae1afbf2e/
5 KB
4 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2014/11/28/93a18820-76b2-11e4-b569-d4ae52e95e57/thumbnail/70x53/df0f3c8fc4b1ca83a71f3e0ae1afbf2e/nation-state-spying-malware-revealed-v1.jpg
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1824-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
87895fd04b827870be986cdc2be363c503a6b7eca1ab786a789b471b3652b6c7
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1079898
status
200
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4076
x-xss-protection
1; mode=block
last-modified
Sun, 09 Aug 2015 19:13:10 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 03 Oct 2020 11:41:22 GMT
renee-james.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/09/30/f4a0c85d-3a0d-45ea-8697-359ec3fcc355/thumbnail/70x53/8375ae3d295bfebee1bb0e35fed59868/
1 KB
2 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/09/30/f4a0c85d-3a0d-45ea-8697-359ec3fcc355/thumbnail/70x53/8375ae3d295bfebee1bb0e35fed59868/renee-james.jpg
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1824-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
24f7451ae040188b7b4fca25ef6ea8312f287d07a88d00fc9b1dabe327bed115
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
582819
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
1503
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"db1915052d15f7815c8b88e879465a1e"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
istock-986666126.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/09/27/141d19e0-0f8a-4a60-82ad-73af01ace37f/thumbnail/70x53/401558f5bf24c560b176c5706b0e85ac/
5 KB
5 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/09/27/141d19e0-0f8a-4a60-82ad-73af01ace37f/thumbnail/70x53/401558f5bf24c560b176c5706b0e85ac/istock-986666126.jpg
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1824-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
32c2c694bf33100bf116d6a571e3c3be1e914fd47aec0d05051a5cb077b9fc9c
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
760832
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4806
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"07e87c2f4fc7f7c96116d8e2a92790f5"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
4083-12969.js
www.everestjs.net/dl/4083/
484 B
664 B
Script
General
Full URL
https://www.everestjs.net/dl/4083/4083-12969.js
Requested by
Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.90.90 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a184-31-90-90.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:48 GMT
Content-Encoding
gzip
Last-Modified
Mon, 25 Nov 2013 14:23:10 GMT
Server
Apache
ETag
"4a5a49-1e4-4ec011a776f80"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=67589
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
288
Expires
Thu, 17 Oct 2019 18:26:17 GMT
v
pixel.everesttech.net/4083/
128 B
716 B
Image
General
Full URL
https://pixel.everesttech.net/4083/v?ev___loc=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&ev___ref=%2F%2F
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:48 GMT
Last-Modified
Wed, 19 Oct 2016 22:11:25 GMT
Server
Apache
ETag
"1433c2-80-53f3f17013d40"
Vary
Cookie
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/png
Keep-Alive
timeout=15, max=997170
Content-Length
128
1x1
pixel.everesttech.net/
Redirect Chain
  • https://cm.everesttech.net/cm
  • https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WGFlcVJBQUFCT0xaUURyeQ
  • https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEA905sSPz_GymtOMdvI0O0U&google_cver=1
  • https://pixel.everesttech.net/1x1
128 B
407 B
Image
General
Full URL
https://pixel.everesttech.net/1x1
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:49 GMT
Last-Modified
Wed, 19 Oct 2016 22:11:25 GMT
Server
Apache
ETag
"443742-80-53f3f17013d40"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=998584
Content-Length
128

Redirect headers

Date
Wed, 16 Oct 2019 23:39:49 GMT
Server
AMO-cookiemap/1.1
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location
https://pixel.everesttech.net/1x1
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=15,max=100
Content-Length
0
istock-482018035.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/09/20/58baaed3-202a-4aff-a4b1-5b6f321ef8c8/thumbnail/70x53/ebb0b66142c8ea6a695c2d4703dad23f/
5 KB
4 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/09/20/58baaed3-202a-4aff-a4b1-5b6f321ef8c8/thumbnail/70x53/ebb0b66142c8ea6a695c2d4703dad23f/istock-482018035.jpg
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1824-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
682499050894dd63171c826837903d1e3f19ef897b51e51979635d7e8b7904d8
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2261420
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4116
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"901797aebf0b23ecbab534d61ad33bb1"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
fly-disqus-count-1f604770a3-rev.js
zdnet2.cbsistatic.com/fly/js/components/
882 B
585 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/fly-disqus-count-1f604770a3-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
b2ab8784d5ca4bc5e4e1990ba55c6d9f041b8fe8cf41ad9afa37bc1c3dd12756
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
235057
status
200
vary
Accept-Encoding
content-length
460
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:12 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d9e3580-372"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 21 Oct 2019 06:22:10 GMT
ua-sdk.min.js
web-sdk.urbanairship.com/notify/v1/
78 KB
17 KB
Script
General
Full URL
https://web-sdk.urbanairship.com/notify/v1/ua-sdk.min.js
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-29ae327ed0-rev.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
35.227.208.151 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
151.208.227.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
e59c8c655db8c097ed0067789aeb44ed58f25f8c68a5772bbb3f1fdc18e5e336

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:35:07 GMT
content-encoding
gzip
x-goog-meta-goog-reserved-file-mtime
1556302399
age
282
x-guploader-uploadid
AEnB2UpsW46tuodJa_4ApDTUeYilikiv_85atFVFUrPhGg2OoAAnnBIomBIoIcsyoEyX-ENI5u4jcPInw589UYpWH6oezl3WuQ
x-goog-storage-class
MULTI_REGIONAL
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
16960
last-modified
Fri, 26 Apr 2019 18:13:21 GMT
server
UploadServer
etag
"251defdc0ecc8a3bad8ae4cf9aab1923"
vary
Accept-Encoding
x-goog-hash
crc32c=A7yEjg==, md5=JR3v3A7MijutiuTPmqsZIw==
x-goog-generation
1556302401249893
cache-control
public, max-age=300
x-goog-stored-content-length
16960
accept-ranges
bytes
content-type
application/javascript
expires
Wed, 16 Oct 2019 23:40:07 GMT
z
lightboxapi1.azurewebsites.net/z9l/40913/www.zdnet.com/jsonp/
218 B
503 B
Script
General
Full URL
https://lightboxapi1.azurewebsites.net/z9l/40913/www.zdnet.com/jsonp/z?cb=1571269188972&callback=jQuery17109358820109853059_1571269188111&_=1571269188972
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637057951420142886
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.99.128.52 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
waws-prod-dm1-001.cloudapp.net
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b5b4495171988d7e52c138e391c7beb196ee9fd1ed6d416467e59a88d197fdd2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:49 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
Content-Length
290
Vary
Accept-Encoding
Content-Type
application/javascript
z.gif
api1.lightboxcdn.com/z9u/LIewXglgNlCGD0BWAdABgAQApiwMYQDsAXEAZwAsBudASWIFMp0dd0B5AZXQA10BGVAH0-AFkGIAlOgCCAB1lR6AdXoAjANIQiSAMwB2ZDoBsWdQAkAKsAAyAGnRQIAa3roA4vVxOQUgMLkAJxAAW3p4PRE0Qz0AJgBOZD4jOPQO...
183 B
577 B
XHR
General
Full URL
https://api1.lightboxcdn.com/z9u/LIewXglgNlCGD0BWAdABgAQApiwMYQDsAXEAZwAsBudASWIFMp0dd0B5AZXQA10BGVAH0-AFkGIAlOgCCAB1lR6AdXoAjANIQiSAMwB2ZDoBsWdQAkAKsAAyAGnRQIAa3roA4vVxOQUgMLkAJxAAW3p4PRE0Qz0AJgBOZD4jOPQOWAAzWACIXQNjIA__XZX/z.gif
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637057951420142886
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4ea5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
dd787044f07fb551657e198707ea27bfddcf6cf53bd6e8bf5efd6322a5273cba

Request headers

Accept
*/*
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
br
cf-cache-status
HIT
age
3775
x-powered-by
ASP.NET
status
200
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin,Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
access-control-allow-credentials
true
cf-ray
526ddfcf4b90cb98-VIE
expires
Thu, 17 Oct 2019 23:39:49 GMT
show-hide-1.0-7dc26ff326-rev.js
zdnet3.cbsistatic.com/fly/js/components/
2 KB
819 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/show-hide-1.0-7dc26ff326-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f92514f4e39c16da9037f964148a09a79419744b77d611860ffc81c86aeace0a
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
567119
status
200
vary
Accept-Encoding
content-length
710
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:13 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e3581-7a5"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 17 Oct 2019 10:07:50 GMT
309391486091569
connect.facebook.net/signals/config/
281 KB
65 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/309391486091569?v=2.9.6&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
e9861478977dbf62d4a69be6936c96a1534a62caf67dcd476299ab89fe0c9f19
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
content-length
66631
x-xss-protection
0
pragma
public
x-fb-debug
H6aTfCz7+hWCvxCP3uE2BhXxupINWC0YizfOPah5LI6Sa0krEn2nwI53l57jhs3g6gVXx1+qA9v3XDlsyRrlqQ==
x-fb-trip-id
997090344
x-frame-options
DENY
date
Wed, 16 Oct 2019 23:39:48 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires
Sat, 01 Jan 2000 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
159 KB
25 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3809023126579124&correlator=2283871878575819&output=ldjh&impl=fifs&adsid=NT&eid=21063203%2C21063636&vrg=2019100301&guci=1.2.0.0.2.2.0.0&plat=1%3A536903688%2C2%3A536903688%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20191016&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=7x7%7C5x5%2C1x1%2C728x90%7C970x66%7C970x250%2C300x250%7C300x600%7C300x1050%2C320x50%7C11x11%2C300x250%2C300x250%2C641x321%2C728x90%7C970x66%7C970x250%2C371x771&fluid=0%2C0%2C0%2C0%2Cheight%2C0%2C0%2C0%2C0%2C0&ists=256&prev_scp=pos%3Dnav%7C%7Cpos%3Dtop%7Cpos%3Dtop%7Cpos%3Dtop%26strnativekey%3D8ec3a4f3%7Cpos%3Dmiddle%7Cpos%3Dbottom%7Cpos%3Dtop%7Cpos%3Dbottom%7Cpos%3Dtop&eri=1&cust_params=buyingcycle%3Ddiscover%26topic%3Dsecurity%252Ctech-industry%252Csoftware%26tag%3Dmalware%26prodtype%3Dantivirus%252Csecurity-systems%252Csoftware%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%26env%3Dprod%26firstpg%3D1%26vguid%3D463420f8-d49a-4522-9502-39fc1d0f882c%26session%3Dg%26subses%3D5%26ftag%3DRSSbaffb68%257C&cookie_enabled=1&bc=31&abxe=1&lmt=1571269188&dt=1571269188992&dlt=1571269187583&idt=356&frm=20&biw=1585&bih=1200&oid=3&adxs=-12245933%2C0%2C-12245933%2C-12245933%2C208%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933&adys=-12245933%2C87%2C-12245933%2C-12245933%2C1409%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933&adks=3747269986%2C3580519168%2C3173884068%2C730226395%2C399830143%2C2507844531%2C2627782634%2C3009957790%2C2379608522%2C3505078266&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&dssz=86&icsg=0&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x2327%7C1585x0%7C1585x0%7C370x0%7C770x11%7C370x0%7C370x250%7C770x1170%7C1210x0%7C370x0&msz=7x7%7C1585x0%7C688x105%7C300x280%7C770x11%7C300x280%7C300x280%7C641x361%7C728x130%7C371x771&ga_vid=301950735.1571269189&ga_sid=1571269189&ga_hid=1532477700&fws=132%2C4%2C132%2C132%2C4%2C132%2C132%2C132%2C132%2C132&ohw=1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
b4bd1eef3a1c0a2375f4dee3471baf1369289cbbecce839600e3f74dbfcb8b25
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
24675
x-xss-protection
0
google-lineitem-id
4745974454,-2,-1,5192378298,4745189935,241984809,253246569,4745327422,253246569,4825966980
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138239360957,-2,-1,138290277353,138239344157,75375443409,75375443409,138239368367,75374362809,138247024569
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
x-google-amp-ad-validated-version
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2019100301.js
securepubads.g.doubleclick.net/gpt/
63 KB
24 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
sffe /
Resource Hash
33e7cfb629c6fc28bec6f0039c2b843ac7d63cb54a883599ca33ce2384e251fa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 03 Oct 2019 13:06:21 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
24653
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:49 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

beacon.js
sb.scorecardresearch.com/
1 KB
1 KB
Script
General
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:49 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
902
Expires
Thu, 17 Oct 2019 23:39:49 GMT
load.js
widget.perfectmarket.com/cbsinteractive-zdnet/
13 KB
5 KB
Script
General
Full URL
https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
rwr9L97XovW8QPypI62jHvd7E2HiNZm2
content-encoding
gzip
etag
"fc0de48a0976cde02ddee0bd49a81832"
age
285
x-cache
HIT, HIT
status
200
content-length
4742
x-amz-id-2
Bz2c9kwNodx0L6M8xAJpExrz7GFvRlfRtLOPWcHSIojvVdRDzBqnQn8nRTx6YzRGVaK4v96+5vg=
x-served-by
cache-lax8650-LAX, cache-fra19168-FRA
last-modified
Thu, 20 Oct 2016 17:48:07 GMT
server
AmazonS3
x-timer
S1571269189.094042,VS0,VE0
date
Wed, 16 Oct 2019 23:39:49 GMT
vary
Accept-Encoding,,
x-amz-request-id
1BFE0E96C42427AE
via
1.1 varnish, 1.1 varnish
cache-control
max-age=300
accept-ranges
bytes
content-type
binary/octet-stream
x-cache-hits
1, 1
impl.20191016-8-RELEASE.js
cdn.taboola.com/libtrc/
393 KB
112 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/impl.20191016-8-RELEASE.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e8d98c9b6e89759e0df4f47e53b267d161c6096e0252641223fac82919e29fe7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
4CPTIedgkNrSY7tPuBXpj_lfQ1gEkGa_
content-encoding
gzip
etag
"889158a8e2d898f1d5ae5aa0e047addd"
age
5
x-cache
HIT
status
200
x-amz-replication-status
COMPLETED
content-length
113951
x-amz-id-2
GAOwbpqLPrtmSz6ET3rJ9p1DWp0XQCdJZpBqmT1SpyClA1TJRm7aOmV/1x0kg7/GXPcp5d2IndU=
x-served-by
cache-fra19139-FRA
last-modified
Wed, 16 Oct 2019 12:01:17 GMT
server
AmazonS3
x-timer
S1571269189.075206,VS0,VE0
date
Wed, 16 Oct 2019 23:39:49 GMT
vary
Accept-Encoding
x-amz-request-id
B5F8BD24D97460D3
via
1.1 varnish
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
62
x-cache-hits
6
headerstats
as-sec.casalemedia.com/
0
337 B
XHR
General
Full URL
https://as-sec.casalemedia.com/headerstats?s=182823&u=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&v=3
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Server
Apache
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Wed, 16 Oct 2019 23:39:49 GMT
/
www.google.de/pagead/1p-user-list/1036174608/
Redirect Chain
  • https://www.googleadservices.com/pagead/conversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=RaqnXda-BdmugA...
  • https://www.google.com/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1255348109&crd=&is_vtc=1&random=615366517
  • https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1255348109&crd=&is_vtc=1&random=615366517&ipr=y
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1255348109&crd=&is_vtc=1&random=615366517&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 23:39:49 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 16 Oct 2019 23:39:49 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
content-type
image/gif
location
https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1255348109&crd=&is_vtc=1&random=615366517&ipr=y
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
ad.yieldmanager.com/
0
341 B
Image
General
Full URL
https://ad.yieldmanager.com/pixel?id=2447099&t=2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1288:110:c305::9000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:49 GMT
X-Content-Type-Options
nosniff
Server
ATS
Age
0
Expect-CT
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security
max-age=31536000
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
s
pixel.everesttech.net/4083/
128 B
716 B
Image
General
Full URL
https://pixel.everesttech.net/4083/s?s=12969
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:49 GMT
Last-Modified
Wed, 19 Oct 2016 22:11:25 GMT
Server
Apache
ETag
"443742-80-53f3f17013d40"
Vary
Cookie
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/png
Keep-Alive
timeout=15, max=998585
Content-Length
128
/
www.facebook.com/tr/
44 B
246 B
Image
General
Full URL
https://www.facebook.com/tr/?id=309391486091569&ev=PageView&dl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&rl=&if=false&ts=1571269189101&sw=1600&sh=1200&v=2.9.6&r=stable&a=tmtealium&ec=0&o=30&fbp=fb.1.1571269189101.680434797&it=1571269188983&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
content-length
44
expires
Wed, 16 Oct 2019 23:39:49 GMT
count.js
zdnet-1.disqus.com/
1 KB
1 KB
Script
General
Full URL
https://zdnet-1.disqus.com/count.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.134 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:55 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Age
716681
P3P
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
871
X-XSS-Protection
1; mode=block
Last-Modified
Tue, 01 Oct 2019 21:53:32 GMT
Server
nginx
ETag
"5d93cadc-367"
Strict-Transport-Security
max-age=300; includeSubdomains
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, max-age=300
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
b
sb.scorecardresearch.com/
0
248 B
Image
General
Full URL
https://sb.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1571269189144&ns_c=UTF-8&cv=3.1e&c8=Cyberbit%20discovers%20international%20airport%20riddled%20with%20Bitcoin-mining%20malware%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&c9=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
pmk-201618008.1.js
widget.perfectmarket.com/cbsinteractive-zdnet/
323 KB
89 KB
Script
General
Full URL
https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
bVoOWfmxkMrYwv2s6Uu9D96fE._5IBqu
content-encoding
gzip
etag
"da73fb2066df9f51d08b6688cfb35441"
age
6632757
x-cache
HIT, HIT
status
200
content-length
91236
x-amz-id-2
wkFmxY+lOES9rYglfPROKACcfb0gAMeGScvzy6d4PJZomIvyF10zpjVaiULjMUddSJsR0/QeaBo=
x-served-by
cache-lax8640-LAX, cache-fra19168-FRA
last-modified
Thu, 20 Oct 2016 17:47:53 GMT
server
AmazonS3
x-timer
S1571269189.171736,VS0,VE0
date
Wed, 16 Oct 2019 23:39:49 GMT
vary
Accept-Encoding,,
x-amz-request-id
06F7A8AE5B8106C6
via
1.1 varnish, 1.1 varnish
cache-control
max-age=31536000
accept-ranges
bytes
content-type
text/javascript
x-cache-hits
10, 5
/
686eb704.akstat.io/
0
354 B
Other
General
Full URL
https://686eb704.akstat.io/
Requested by
Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.32.243.235 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-32-243-235.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Wed, 16 Oct 2019 23:39:49 GMT
bcn
www.summerhamster.com/
43 B
181 B
Image
General
Full URL
https://www.summerhamster.com/bcn?fe=1571269189181&y=2.0.1105&elg=341651572&flg=68&x=zzz.cgqhw.frp%2Fduwlfoh%2Ffbehuelw-glvfryhuv-lqwhuqdwlrqdo-dlusruw-ulggohg-zlwk-elwfrlq-plqlqj-pdozduh%2F&vqwo=1&deo=0&g0=vg%3A%3Aer%2Cxd%3A%3Aqexd%3A%3Aqsu%7Cvg%3A%3Ask%3A%3Aqsk%3A%3Aqsu%7Cgisl%3A%3Alp%2Clqi%2Cqh%3A%3Aqoe%3A%3Aqsu%3A%3Axuo%3D%2F%2Fdg.grxeohfolfn.qhw%2Fggp%2Fdg%2Ftkliygi%2Fpquoyplhzz%2Ftq%2Flao%2Fcfckjr%2F%3Brug%3D1571269187793%3F%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cddg%2Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.des_re_halvw%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Csu%3A%3Aid%3A%3Aquiv%3A%3Aqsu&hu=0&g2=0%3A%3A0%3A%3A0%3A%3A0%3A%3A0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.157.160.140 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-157-160-140.eu-central-1.compute.amazonaws.com
Software
Jetty(9.2.10.v20150310) /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Wed, 16 Oct 2019 23:39:49 GMT
server
Jetty(9.2.10.v20150310)
access-control-allow-origin
*
content-length
43
access-control-allow-methods
*
content-type
image/gif
analytics.js
www.google-analytics.com/
43 KB
17 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
313
date
Wed, 16 Oct 2019 23:34:36 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17803
expires
Thu, 17 Oct 2019 01:34:36 GMT
beacon.js
sb.scorecardresearch.com/
1 KB
1 KB
Script
General
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:49 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
902
Expires
Thu, 17 Oct 2019 23:39:49 GMT
tboptevent.html
widget.perfectmarket.com/opt/ Frame 73DA
0
0
Document
General
Full URL
https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Varnish /
Resource Hash

Request headers

:method
GET
:authority
widget.perfectmarket.com
:scheme
https
:path
/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/

Response headers

status
404
server
Varnish
retry-after
0
accept-ranges
bytes
date
Wed, 16 Oct 2019 23:39:49 GMT
via
1.1 varnish
x-served-by
cache-fra19168-FRA
x-cache
MISS
x-cache-hits
0
x-timer
S1571269189.223328,VS0,VE0
content-length
0
collect
www.google-analytics.com/r/
35 B
101 B
Image
General
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j79&aip=1&a=1532477700&t=pageview&_s=1&dl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&ul=en-us&de=UTF-8&dt=Cyberbit%20discovers%20international%20airport%20riddled%20with%20Bitcoin-mining%20malware%20%7C%20ZDNet&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YAhAAEAB~&jid=1991322081&gjid=510666060&cid=301950735.1571269189&tid=UA-33613588-22&_gid=1144629424.1571269189&_r=1&cd2=other&z=910608133
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 23:39:49 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
vglnk.js
cdn.viglink.com/api/
78 KB
27 KB
Script
General
Full URL
https://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a10d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
cf-cache-status
HIT
age
188657
cf-ray
526ddfd1797bcbb4-VIE
status
200
content-length
27719
x-amz-id-2
HNEV4caKoOdziBrXGZIDp4CzG6boiBMb4TLu65nU6otYm4+p2OQwr1vWix1CX0FBodMy916W6w4=
last-modified
Mon, 16 Sep 2019 19:15:01 GMT
server
cloudflare
etag
"1545d811432c0074356408ee8f6c1e23"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
FB54A2C70C0BB866
cache-control
public, max-age=1800
accept-ranges
bytes
content-type
text/javascript
expires
Thu, 17 Oct 2019 00:09:49 GMT
0.8449412877877166
saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/
43 B
227 B
Image
General
Full URL
https://saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/0.8449412877877166?AQB=1&ce=UTF%2D8&events=event66&v0=ftag_cd:LGN22ef1e6&v2=en&v3=desktop&v4=right-rail&v5=zdnet&v10=article&v20=cyberbit+discovers+international+airport+riddled+with+bitcoin-mining+malware&v22=content_article&v23=&v24=463420f8-d49a-4522-9502-39fc1d0f882c&v30=28d0a422-cfea-4d23-bae1-2b6eaf0a254f&v60=33161585,33163467,33167286&v64=2150&v69=&c0=D%3Dv0&c2=D%3Dv2&c3=D%3Dv3&c4=D%3Dv4&c5=D%3Dv5&c10=D%3Dv10&c20=D%3Dv20&c22=D%3Dv22&c23=D%3Dv23&c24=D%3Dv24&c30=D%3Dv30&c60=D%3Dv60&c64=D%3Dv64&c69=D%3Dv69&pe=lnk_o&pev2=medusa_impression&vid=201910163-leadgen-zdnet&mid=90240133173074011141898988208131324462&aid=2D535D450507F28B-40000106A0001145&AQE=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.188.31.119 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-15-188-31-119.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
x-content-type-options
nosniff
x-c
master-1047.I1d1c81.M0-302
p3p
CP="This is not a P3P policy"
status
200
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Thu, 17 Oct 2019 23:39:49 GMT
server
jag
xserver
anedge-95484cfc6-cchjw
etag
3374274890069016576-4615459564888134729
vary
*
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Tue, 15 Oct 2019 23:39:49 GMT
e.gif
dw.cbsi.com/levt/ria/
43 B
369 B
Image
General
Full URL
https://dw.cbsi.com/levt/ria/e.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=28d0a422-cfea-4d23-bae1-2b6eaf0a254f&assettitle=cyberbit%20discovers%20international%20airport%20riddled%20with%20bitcoin-mining%20malware&assettype=content_article&pubdate=2019-10-16%2022%3A54%3A13&viewguid=463420f8-d49a-4522-9502-39fc1d0f882c&devicetype=desktop&sitetype=responsive%20web&author=tom%20foremski&authorid=a2cf5ea4-8175-11e2-9d12-0018fe8a00b0&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&s8=cnetzdnetglobalsite&v23=cnetzdnetglobalsite&v19=article&v17=113c25b6-ec91-11e3-95d2-02911863765e&v20=28d0a422-cfea-4d23-bae1-2b6eaf0a254f&v16=463420f8-d49a-4522-9502-39fc1d0f882c&riaevent=impression&comptyp=spot&mapp=medusa_app&objtyp=medusa&eventt=log&v18=security&comp=ucwc&ts=1571269189349&tcset=utf8&im=dsjs&title=Cyberbit%20discovers%20international%20airport%20riddled%20with%20Bitcoin-mining%20malware%20%7C%20ZDNet&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Server
Apache/2.4.25
Vary
*
Content-Type
image/gif
Cache-Control
no-cache, must-revalidate, no-transform
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=80, max=307
Content-Length
43
Expires
Fri, 23 Jan 1970 12:12:12 GMT
domains
api.viglink.com/api/
42 B
721 B
XHR
General
Full URL
https://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
042aa3b7f3ed24c885142293890e15da8988c020ba059266095fa6cb67cfd4d1

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:48 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame AC18
0
160 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstZWFR_PHhPBnCE11mQlEplnLw7nhFS35bBn7XntRrEe_KO3IswPK8YHKsmgkOVVLoWbBhC2booXLiFdSB43_UepK6q3MUVuVzmL3VhNX0Y114LQdWhd-vNU9IwlgqGYhmjwX3HMDo3tyHxTOnsSWQWeZZ4JcrFvsnzqaE9iubrcboD3cGnhhpInqg4IMSfEjdDiTYKZz7K4jtUM2pa0EmsqhNkX3z9XakWdTZkT6peFjpHY45SHdPoICv60RTLWQvJU8D7QUER&sig=Cg0ArKJSzF_85mRCAm6lEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 23:39:49 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:49 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame AC18
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s29-in-f2.1e100.net
Software
sffe /
Resource Hash
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29551
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:49 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame AC18
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:49 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=21076
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
osd.js
www.googletagservices.com/activeview/js/current/
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s29-in-f2.1e100.net
Software
sffe /
Resource Hash
f425f66d90f1150499b36ab47b56fa6fb1a68136e4f42befca20a920ff85306b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29055
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:49 GMT
amp4ads-host-v0.js
cdn.ampproject.org/rtv/011909241711100/
20 KB
7 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/011909241711100/amp4ads-host-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
37a8b06eab08134f2037c797f4596c7688dd564a8395cb7e072577f371d8f993
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding
br
etag
"beb093e69c81d951"
age
452859
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
7119
x-xss-protection
0
server
sffe
date
Fri, 11 Oct 2019 17:52:10 GMT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-content-type-options
nosniff
expires
Sat, 10 Oct 2020 17:52:10 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/011909241711100/ Frame A012
252 KB
69 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/011909241711100/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
6d157866400e2e50e077448f9cf06a9f29f70e031612ad6679d3626909a4c4e5
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding
br
etag
"96c1a383c63a0e85"
age
551806
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
70044
x-xss-protection
0
server
sffe
date
Thu, 10 Oct 2019 14:23:03 GMT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-content-type-options
nosniff
expires
Fri, 09 Oct 2020 14:23:03 GMT
amp-ad-exit-0.1.js
cdn.ampproject.org/rtv/011909241711100/v0/ Frame A012
15 KB
5 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/011909241711100/v0/amp-ad-exit-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4a9174ab8670879484f0dc42afea0ccaa3803217a9700ef9e1fb8262aa68c651
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding
br
etag
"047aa8cc2c1326e6"
age
32903
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
5411
x-xss-protection
0
server
sffe
date
Wed, 16 Oct 2019 14:31:26 GMT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-content-type-options
nosniff
expires
Thu, 15 Oct 2020 14:31:26 GMT
amp-analytics-0.1.js
cdn.ampproject.org/rtv/011909241711100/v0/ Frame A012
150 KB
40 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/011909241711100/v0/amp-analytics-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
197c294e1520b32d787d2678660c02fd195c1c93fee3441de596ef22c34ed425
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding
br
etag
"31e12d286572e15e"
age
701148
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
40838
x-xss-protection
0
server
sffe
date
Tue, 08 Oct 2019 20:54:01 GMT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-content-type-options
nosniff
expires
Wed, 07 Oct 2020 20:54:01 GMT
amp-fit-text-0.1.js
cdn.ampproject.org/rtv/011909241711100/v0/ Frame A012
3 KB
2 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/011909241711100/v0/amp-fit-text-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f6460a62bcb64a288196db0162ebd1ea5e2bbc95b3725ed6ca7c08eed129d767
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding
br
etag
"4547d0ff209c44ea"
age
572233
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
1388
x-xss-protection
0
server
sffe
date
Thu, 10 Oct 2019 08:42:36 GMT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-content-type-options
nosniff
expires
Fri, 09 Oct 2020 08:42:36 GMT
amp-form-0.1.js
cdn.ampproject.org/rtv/011909241711100/v0/ Frame A012
43 KB
14 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/011909241711100/v0/amp-form-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b801741390d0087dafca6ddd145ead69628e42ed4e3a4e0a662c96bac969e6fe
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding
br
etag
"098505ab236e9001"
age
620257
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
13920
x-xss-protection
0
server
sffe
date
Wed, 09 Oct 2019 19:22:12 GMT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-content-type-options
nosniff
expires
Thu, 08 Oct 2020 19:22:12 GMT
truncated
/ Frame A012
212 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
27fd5e8a820292a54692372abbdfc1e4ad717bb09e0cf1dbfc10d165a35c4f83

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
11285898496358263474
tpc.googlesyndication.com/simgad/ Frame A012
7 KB
7 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/11285898496358263474?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qlHLbYvVFmmluSsROdATqbNxzRPQg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
06b5e37405eb20ef6b93a33900acf3727c556133767f8ca396eaf2011ee6e21a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 02:46:59 GMT
x-content-type-options
nosniff
last-modified
Fri, 06 Sep 2019 23:26:36 GMT
server
sffe
age
75170
status
200
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
6918
x-xss-protection
0
expires
Thu, 15 Oct 2020 02:46:59 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame A012
2 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 20:45:12 GMT
x-content-type-options
nosniff
server
cafe
age
10477
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
2502
x-xss-protection
0
expires
Thu, 17 Oct 2019 20:45:12 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame A012
295 B
401 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 00:36:05 GMT
x-content-type-options
nosniff
server
cafe
age
83024
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Thu, 17 Oct 2019 00:36:05 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame A012
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CNzODRaqnXbXeBpGCgQfglL-YApWYyqdZlZ2N8p8KltPLeRABIMyRriJglQKgAbeTpLgDyAEC4AIAqAMByAMIqgSsAk_Q6fY1ZPw6kRpY0qaC2KmrnxLwcoX3uxHGlSUIPkhrr4TJi3kRVQbbJ2y1KaC9MBFf596KL172PIgF92E2_pkcz_FVGcxNHb-nA3KJR32OdXwvyXYxl6VQ5OukBPmv0ZDTnrxXwGpP9-yV0C_KvPDo62iOg8CxW26XNvfBsR2ejxfImaiDswvgofbQ3UcqeAEGSL7Sm5cwThpdUtyt4-gwQtDuSrTlrFQK2FzJpsadnLUWXOG1kPavGBhQdW3vT09oc_ltn-fahqucnj4oekHmssSr1TYNpB4vWsvBRThQBptXbCNNtz91ve3PCzRnlRDzGip0m8_9PFOGBf46szWFrn1qGQe6wMq89HKNB7zBfB4EN2Rs9N4sARQBCxvORCzsaERopf8jQjgHUsAEhInBv8EC4AQBkgUECAQYAZIFBAgFGASgBgKAB7Hs20eoB47OG6gH1ckbqAfB0xuoB4XUG6gHgdQbqAeC1BuoB4bUG6gHhNQbqAeT2BuoB-DTG6gHugaoB9nLG6gHz8wbqAemvhvYBwHyBwQQ0Loc0ggJCIDhgBAQARgdgAoD2BMC&sigh=lCN2ud3tRqc&tpd=AGWhJmugZzel0Uc3UiAHIu44D7mh-x4ltZ4xHJCMr686NMdq2Q
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

view
securepubads.g.doubleclick.net/pcs/ Frame 4D59
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvui0e5TKnkC3mAJGQVctUFpPdJb3MGk_lKVbe841Q1O14Gydmi431Ipv1Mcb8qxwQDOXSVS4zXiGbWHqfBFRU1ub-N9nn2ynKx7FymykI_0kbPk5t503P9XiJrHr8NXoeNcYLT0BLtD6Abb1HIgfSK663knuYyJqDpH27mDqsD-qLtwYIdbTZcfisitLVUMpRZgRGgMMLZdKXyCGlbDuSa-HS2ftwCVYHWX38AtzqwSDOh6JFACtmmGb6TCCpsAlDaVMeg0UP9UYUogg&sig=Cg0ArKJSzPMkjfwkwAANEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 23:39:49 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 4D59
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s29-in-f2.1e100.net
Software
sffe /
Resource Hash
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29551
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:49 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 4D59
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:49 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=21076
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
view
securepubads.g.doubleclick.net/pcs/ Frame 7D1A
0
255 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst5gdN9Y9J1FhgNY5b6mwlqO4NN5xwvWXYM_uvhJRBxb41TBUt_kEYmMN-XfosrZl3zawK2O7ekPq9_Dtm6iVgaSDqyV1XycLPLhCjv6Cca5agsmTbWg2W4Q7zO3zfdE3xigHrhM87p4HXMcxPEzD1xPgzIscznG4UmFefM3fdZlEspEhgEqIx0p8_Pcjm6QpkU9lQPRoX10256OVvhVihgZWZPzha5zPMQUBt31M_x130WNwWDQprH8PCW_B0GP4aAqedujJEC&sig=Cg0ArKJSzDJZE5UyucliEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 23:39:49 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:49 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 7D1A
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s29-in-f2.1e100.net
Software
sffe /
Resource Hash
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29551
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:49 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 7D1A
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:49 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=21076
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
view
securepubads.g.doubleclick.net/pcs/ Frame D286
0
256 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuTRr7l-5Jm8mL42uRfhsi7jKzDBQTY7I1N5yWjQe_zChLLNeR5UhEZUk-nVxsYYSO38EbSO4lCF_QBw2j66zzzRuw4VdRqPBE0ajiYiPh5tV8ucWtmE4IJWns010D8PbGoKE6zPFZx-WPIPjrIeMRARgfywCYPfb3YWzqwGsWxKhvYDC9Wtl2sUA2rs3PPOnR8ivlElAKJ14-tRPmKgNKzmaSDaTDiZsKQQ4OEi6Y4_YFAAE9khbY8NHTzlVYLgYINHqs&sig=Cg0ArKJSzCaIEjFPgp3wEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 23:39:49 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:49 GMT
9818.js
ads.rubiconproject.com/ad/ Frame D286
26 KB
8 KB
Script
General
Full URL
https://ads.rubiconproject.com/ad/9818.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.38.84 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-38-84.deploy.static.akamaitechnologies.com
Software
Apache / PHP/5.3.3
Resource Hash
d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:49 GMT
Content-Encoding
gzip
Server
Apache
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=4907
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
7558
Expires
Thu, 17 Oct 2019 01:01:36 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame D286
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s29-in-f2.1e100.net
Software
sffe /
Resource Hash
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29551
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:49 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame D286
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:49 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=21076
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
view
securepubads.g.doubleclick.net/pcs/ Frame 068A
0
255 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv8l3RtS_ckwZd2Av0JG3scclbnr-SjGHVOY9G-FkIaIo1kPp86IpDE7vpjFB_340z6zEWiG-SivAycez4-6Jds0GV7oPmCMwHZ-yGCh9bB1iD6c_DugXJpDlL-t4NFET1UEJdVyY27e0Ot7kwwmKNRn0Uok6Hg_9ed3GX_31SeNAZNaXCeUne-pTGhvHmjOTAzJk001Mo-Ran_Q8HBb8DDt_HVnWVF8WCvmw67Ly1xYTHFdHdsTP7ThnfTMARQygVhE1U&sig=Cg0ArKJSzNSyQhIQA70sEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 23:39:49 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:49 GMT
9818.js
ads.rubiconproject.com/ad/ Frame 068A
26 KB
8 KB
Script
General
Full URL
https://ads.rubiconproject.com/ad/9818.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.38.84 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-38-84.deploy.static.akamaitechnologies.com
Software
Apache / PHP/5.3.3
Resource Hash
d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:49 GMT
Content-Encoding
gzip
Server
Apache
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=4907
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
7558
Expires
Thu, 17 Oct 2019 01:01:36 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 068A
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s29-in-f2.1e100.net
Software
sffe /
Resource Hash
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29551
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:49 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 068A
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:49 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=21076
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
view
securepubads.g.doubleclick.net/pcs/ Frame 8C4A
0
255 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstJR71nopOpBUZCKYr25mBJDKcvqLqVO2SfL4AaPyEdtMmtTbEU-XUNWOfk95or4yG2cSJMxUqbKZuSiTxq779T6auGGC0rM9Sk6WYVGghFvFFFTE5UnkK28rZIVVT2v0pxfH5iOuTI2ZS1h3s3k-3tFErIVVJ-HQmeRCM9GCyQD0Kz4xWmpPaPFQ-QZWc184BXIoL__PwiDBreM_TAhyJuL90EAbOOpwmK75bBwDvIM5N18e7pUwap2DFqjCqJjaGMLjw0By-0&sig=Cg0ArKJSzLy1jbE05D3FEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 23:39:49 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:49 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 8C4A
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s29-in-f2.1e100.net
Software
sffe /
Resource Hash
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29551
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:49 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 8C4A
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:49 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=21076
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
view
securepubads.g.doubleclick.net/pcs/ Frame 31F6
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvmA6NeUENjna2E-E3xFdfQN1y5fMAWqRCVr8-bFs1COKOsH1usmVjnaACo4eB6ce2hOoA9U7UacVFMfY4jnFi7KiD1UScyYXb8rvzzag_AlT-V1BZMzK7jw1u6osEduoiyU_L2bsTeoyGZYxBVn1rbCQGbrcm7C7loyauWe9YNkY_3ED9fdY8bcloa8I-sR2oL5a6SEpJkPCI3HR-empkUy1CjwoZxahhN_-isyNjjPs14KsYhUdfdxoOWBvc4KjREc7g&sig=Cg0ArKJSzJnfAomh82B5EAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 23:39:49 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
9818.js
ads.rubiconproject.com/ad/ Frame 31F6
26 KB
8 KB
Script
General
Full URL
https://ads.rubiconproject.com/ad/9818.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.38.84 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-38-84.deploy.static.akamaitechnologies.com
Software
Apache / PHP/5.3.3
Resource Hash
d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:49 GMT
Content-Encoding
gzip
Server
Apache
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=4907
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
7558
Expires
Thu, 17 Oct 2019 01:01:36 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 31F6
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s29-in-f2.1e100.net
Software
sffe /
Resource Hash
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29551
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:49 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 31F6
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:49 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=21076
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
view
securepubads.g.doubleclick.net/pcs/ Frame 527C
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvn8wqz8NS6SiZillpyDwo28eel4INKrp4guVS-fgWIVAqY87vEodgap2-4UmX1QrTwWWhRSr-WzAVGpD-RwSHvMBrg22zHLctEMyvPLB3QYFj9PLzO_Uzuc_mo4m3c8uSpLg4ICl1RdX_hkDocyzGcpcbne3plcFni7fVPIS26LpeLbKgP3zyPG9lxAO9g7M_SuS0PVsEDLWvD670xTRRIiBnS6V-9Z0ILYFf9jhMF7f6lRjcRSRihKkDYzi3MgGrBK-ld35D2&sig=Cg0ArKJSzN5u_XSSPOW2EAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 23:39:49 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
adKit.min.js
rev.cbsi.com/common/js/ Frame 527C
6 KB
2 KB
Script
General
Full URL
https://rev.cbsi.com/common/js/adKit.min.js?2144723292
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
last-modified
Mon, 13 May 2019 18:29:20 GMT
server
Apache
etag
"e524dc608d5c7c30eef57b6ed95dc6a8:1557772160"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
accept-ranges
bytes
content-length
2149
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 527C
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s29-in-f2.1e100.net
Software
sffe /
Resource Hash
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29551
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:49 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 527C
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:49 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=21076
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
imgad
tpc.googlesyndication.com/pagead/ Frame 4D59
17 KB
18 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKDnq4jLywEQARgBMgjX70vz2jfgkw
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
a6d7c4beeaf8bda515ef93af343a3b2e950cd6deb797fc9989c222e775ae8dcf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 17:50:27 GMT
x-content-type-options
nosniff
server
cafe
age
452962
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/png
status
200
cache-control
public, max-age=604800
content-disposition
attachment; filename="image.png"
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17863
x-xss-protection
0
expires
Fri, 18 Oct 2019 17:50:27 GMT
tboptevent.html
widget.perfectmarket.com/opt/ Frame 1A2C
0
0
Document
General
Full URL
https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Varnish /
Resource Hash

Request headers

:method
GET
:authority
widget.perfectmarket.com
:scheme
https
:path
/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/

Response headers

status
404
server
Varnish
retry-after
0
accept-ranges
bytes
date
Wed, 16 Oct 2019 23:39:49 GMT
via
1.1 varnish
x-served-by
cache-fra19168-FRA
x-cache
MISS
x-cache-hits
0
x-timer
S1571269190.518755,VS0,VE0
content-length
0
n.js
geo.moatads.com/ Frame AC18
107 B
282 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571269189570&de=8954893397&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=2&cb=0&ym=0&cu=1571269189570&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745974454%3A138239360957&zMoatPS=nav&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=7&zMoatH=7&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=7x7&zMoatSZPS=7x7%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=953620134&cs=0&callback=MoatSuperV26.gna611267
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.177.62.3 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-177-62-3.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
5631feb1992736b1885154e51c30038287f589edce52a2b64a073d270ce8c025

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
server
TornadoServer/4.5.3
etag
"bf7bc967c376c2b98329e9fb27885e43f8406273"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
107
n.js
geo.moatads.com/
104 B
278 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571269189570&de=8954893397&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=3&cb=0&ym=0&cu=1571269189570&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745974454%3A138239360957&zMoatPS=nav&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=7&zMoatH=7&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=7x7&zMoatSZPS=7x7%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=307559835&cs=0&callback=MoatDataJsonpRequest
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.177.62.3 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-177-62-3.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
ddbc8cbe77dd350d4623eab321a0edb90d3f79605c50acb1dd6cce1151ee771a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
server
TornadoServer/4.5.3
etag
"ebfd886122558eb370554e063d9aa6e0b42c146b"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
104
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571269189570&de=8954893397&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=4&cb=0&ym=0&cu=1571269189570&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745974454%3A138239360957&zMoatPS=nav&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=7&zMoatH=7&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=7x7&zMoatSZPS=7x7%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1564210741&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:49 GMT
283812-15.js
optimized-by.rubiconproject.com/a/9818/59604/ Frame D286
2 KB
2 KB
Script
General
Full URL
https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.07739950790072081&tk_st=1&rf=https%3A//www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/%23ftag%3DRSSbaffb68%7C&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Requested by
Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.142 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
59ebf5f578080d20d13aae7180df577d3fbee37f18d1d791b692c40ac919236f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Content-Encoding
gzip
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Connection
Keep-Alive
Content-Type
text/javascript
Keep-Alive
timeout=5, max=468
Content-Length
1261
Expires
Wed, 17 Sep 1975 21:32:10 GMT
283812-15.js
optimized-by.rubiconproject.com/a/9818/59604/ Frame 068A
2 KB
1 KB
Script
General
Full URL
https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.31938482669414325&tk_st=1&rf=https%3A//www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/%23ftag%3DRSSbaffb68%7C&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Requested by
Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.142 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
dc238e5fe87b2bde85465a623dce5fa2282f496737c5aebd2a1c64a83ab18d3a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Content-Encoding
gzip
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Connection
Keep-Alive
Content-Type
text/javascript
Keep-Alive
timeout=5, max=500
Content-Length
1067
Expires
Wed, 17 Sep 1975 21:32:10 GMT
283812-2.js
optimized-by.rubiconproject.com/a/9818/59604/ Frame 31F6
2 KB
1 KB
Script
General
Full URL
https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.38727487677729844&tk_st=1&rf=https%3A//www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/%23ftag%3DRSSbaffb68%7C&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1
Requested by
Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.142 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
faed137e4045c8b44a7bfb2e0d9e2f19198de1e6a72d3721ac9425e009ff5e59

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Content-Encoding
gzip
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Connection
Keep-Alive
Content-Type
text/javascript
Keep-Alive
timeout=5, max=374
Content-Length
1061
Expires
Wed, 17 Sep 1975 21:32:10 GMT
truncated
/ Frame 4D59
214 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e7f276443e91579cd27b45aaaeb5394166644fbd121d2bf39e8a408ee5fe4e2a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
si
googleads.g.doubleclick.net/pagead/drt/ Frame A012
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si
0
0
Image
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

date
Wed, 16 Oct 2019 23:39:49 GMT
x-content-type-options
nosniff
server
safe
status
302
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/drt/si
cache-control
private
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
246
x-xss-protection
0
/
www.facebook.com/tr/
0
73 B
Other
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundary11XxxGydfDs1PGIv

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
server
proxygen-bolt
date
Wed, 16 Oct 2019 23:39:49 GMT
status
200
content-type
text/plain
access-control-allow-origin
https://www.zdnet.com
access-control-allow-credentials
true
content-length
0
n.js
geo.moatads.com/ Frame 4D59
106 B
281 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571269189666&de=684457879453&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=7&cb=0&ym=0&cu=1571269189666&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=4797955119%3A2608978925%3A5192378298%3A138290277353&zMoatPS=top&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=300&zMoatH=250&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=272662152&cs=0&callback=MoatSuperV26.gna16786
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.177.62.3 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-177-62-3.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
4ba874fecf4fcd9d98e67588c06928ddf325578ddd193fa04f75433511ca5bf1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
server
TornadoServer/4.5.3
etag
"dda7d3044bb0ad4c9f2c6f885948fb1b7d6b6c30"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
106
n.js
geo.moatads.com/ Frame 7D1A
106 B
280 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571269189687&de=191741072377&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=12&cb=0&ym=0&cu=1571269189687&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745189935%3A138239344157&zMoatPS=top&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=11&zMoatH=11&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=11x11&zMoatSZPS=11x11%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=511519157&cs=0&callback=MoatSuperV26.gna178662
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.177.62.3 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-177-62-3.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
08f1d9709c00dfe5e6969607255c40acaad2ed37cf0df70505f54182853f1ab9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
server
TornadoServer/4.5.3
etag
"688ff6ff8069b89aaa4d7c0f18826a8551cdf751"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
106
n.js
geo.moatads.com/ Frame 8C4A
107 B
281 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571269189710&de=179822073388&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=17&cb=0&ym=0&cu=1571269189710&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745327422%3A138239368367&zMoatPS=top&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=641&zMoatH=321&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=641x321&zMoatSZPS=641x321%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=359793000&cs=0&callback=MoatSuperV26.gna694476
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.177.62.3 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-177-62-3.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
e100492d38c333d7ec17dfee06e91973ee8a707dd6f5c5991d2e15ead37243a9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
server
TornadoServer/4.5.3
etag
"c7f02e8dd145d2e213bb34876f335a40e411536a"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
107
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571269189666&de=684457879453&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=9&cb=0&ym=0&cu=1571269189666&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=4797955119%3A2608978925%3A5192378298%3A138290277353&zMoatPS=top&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=300&zMoatH=250&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=724097129&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:49 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame 527C
45 KB
14 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: rev.cbsi.com
URL: https://rev.cbsi.com/common/js/adKit.min.js?2144723292
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s29-in-f2.1e100.net
Software
sffe /
Resource Hash
45ef4c3baad7c9b59f54bbe6ac8f354d9949e0edcccbebc34e4efe8e672feff2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"309 / 49 of 1000 / last-modified: 1571261169"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14542
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:49 GMT
/
track.adform.net/adfscript/ Frame D286
20 KB
10 KB
Script
General
Full URL
https://track.adform.net/adfscript/?bn=31755582;rtbwp=91611D4265535969;rtbdata=MWI3ruWwJuorwkpovOcKC5TmDXxXwJUvQHA2j18qC4a_eij0yRyXNeG5guhgy2z5OXtBYiSWWa0HRm_VWFYjrqYeahbu4upsKSj4pVpVqzoHvQATXC24YnuFi-e6TGphjuqzPFvsIifogQ1VSKlDonlrtqmPrnwklJGlkSRlR6nrj1oPWls6o5Nd01ZYOnXDXpSZjrNs8lFuP1QHlvLWDAU3i-CwUWqXfk-eC5C4twjvbzoUPcUb7wL6RVv8AGe92x3ecUW4bCxvXTpEJLsS17e1Bt0etHA5gGBr4U8NvNCI5wu38H9_rcGGfdK1u63jSvO9w6i4bfk1;OOBClickTrack=http://beacon-nf.rubiconproject.com/beacon/v2/t/51/24d01b5b-066b-43f6-a4e4-d25051d7131b/
Requested by
Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.07739950790072081&tk_st=1&rf=https%3A//www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/%23ftag%3DRSSbaffb68%7C&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.4.41 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
7e7a2884ae62c3de9ca6d0b099456bf815e32764f12eaf66ad09a728fb389395

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
server
nginx
status
200
vary
Accept-Encoding
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
content-type
text/javascript; charset=utf-8
content-length
10098
expires
-1
24d01b5b-066b-43f6-a4e4-d25051d7131b
beacon-eu2.rubiconproject.com/beacon/d/ Frame D286
43 B
268 B
Image
General
Full URL
https://beacon-eu2.rubiconproject.com/beacon/d/24d01b5b-066b-43f6-a4e4-d25051d7131b?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=15&e=6A1E40E384DA563B2EC2347EB2014B6A556B06584390307CB0857C7A6A62F6153D018C351E1CCFA45D336B7FDF778B03172DB22D3B21A9B50006361941D2FCADDBC706D54D3D5FE33A7D0F4B29A16267048080A7B2354B0BCA5842E270D0CC465FAD1C89D6136A38EFF5C7CFD889081ABB4D1DF2CB1B0A9921740913AD42A373BCD9AB1B63E0FFBBADD84CD4C36B4A0E216ECB6769B14D345FC37CF6D5CAAEAF9CC262C162EEE783E6B05C412359DC33520FEADDB621354DCD493D022E89B6C1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.152 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
Rubicon Project /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Cache-Control
private, max-age=0, no-cache
Server
Rubicon Project
Content-Type
image/webp
Content-Length
43
Expires
01 Jan 1970 10:00:00 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 31F6
77 KB
28 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.38727487677729844&tk_st=1&rf=https%3A//www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/%23ftag%3DRSSbaffb68%7C&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
c2ba172469f43f4565ea115e1a6393a6bdb5574cf866b3a5b96ec091af4b64b6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28325
x-xss-protection
0
server
cafe
etag
3465267823836090366
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Wed, 16 Oct 2019 23:39:49 GMT
7e58618c-fb68-4edd-be48-a6db0b0d6888
beacon-eu2.rubiconproject.com/beacon/d/ Frame 31F6
43 B
268 B
Image
General
Full URL
https://beacon-eu2.rubiconproject.com/beacon/d/7e58618c-fb68-4edd-be48-a6db0b0d6888?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=2&e=6A1E40E384DA563BF0CA2F258B5F48DB8FC7A63690436D5388669421080BC2B41C572921C84EE3416517C17818F02964172DB22D3B21A9B5FE1372E4C5A95CA3DBC706D54D3D5FE33A7D0F4B29A162671C45189F33B502F0956270D897C40F9BD6B623991F0C362390E385F9572B9DD5BB4F33CDE214CF90
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.152 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
Rubicon Project /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Cache-Control
private, max-age=0, no-cache
Server
Rubicon Project
Content-Type
image/webp
Content-Length
43
Expires
01 Jan 1970 10:00:00 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 068A
77 KB
28 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.31938482669414325&tk_st=1&rf=https%3A//www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/%23ftag%3DRSSbaffb68%7C&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
c2ba172469f43f4565ea115e1a6393a6bdb5574cf866b3a5b96ec091af4b64b6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28325
x-xss-protection
0
server
cafe
etag
3465267823836090366
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Wed, 16 Oct 2019 23:39:49 GMT
25b07bbf-8edc-4229-852d-c8b6614011c8
beacon-eu2.rubiconproject.com/beacon/d/ Frame 068A
43 B
268 B
Image
General
Full URL
https://beacon-eu2.rubiconproject.com/beacon/d/25b07bbf-8edc-4229-852d-c8b6614011c8?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=15&e=6A1E40E384DA563B5D53D2F39760B0471B79D87765EFB263D9F4A48CEF4F7493A16C0B4E0B3008D64DDA045D71860697172DB22D3B21A9B54FDF40E8720131F3DBC706D54D3D5FE33A7D0F4B29A162671C45189F33B502F0956270D897C40F9B25A6B82D54B2825490E385F9572B9DD5BB4F33CDE214CF90
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.152 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
Rubicon Project /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Cache-Control
private, max-age=0, no-cache
Server
Rubicon Project
Content-Type
image/webp
Content-Length
43
Expires
01 Jan 1970 10:00:00 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=3&fi=1&apd=6&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=4797955119&L2id=2608978925&L3id=5192378298&L4id=138290277353&S1id=23605329&S2id=23619609&ord=1571269189666&r=684457879453&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatPS=top&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:49 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=3&fi=1&apd=6&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=4797955119&L2id=2608978925&L3id=5192378298&L4id=138290277353&S1id=23605329&S2id=23619609&ord=1571269189666&r=684457879453&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatPS=top&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:49 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCICAgKDnq4jLywEQARgBMgjX70vz2jfgkw&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1571269189666&de=684457879453&cu=1571269189666&m=18&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4713&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&as=0&ag=3&an=0&gf=3&gg=0&ix=3&ic=3&ez=1&aj=1&pg=100&pf=0&ib=1&cc=0&bw=3&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=6&cd=0&ah=6&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=4797955119%3A2608978925%3A5192378298%3A138290277353&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=300x250&zMoatPS=top&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatSlotId=mpu-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-plus-top-5da7a047e2cdc&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=870631560&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:49 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571269189687&de=191741072377&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=14&cb=0&ym=0&cu=1571269189687&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745189935%3A138239344157&zMoatPS=top&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=11&zMoatH=11&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=11x11&zMoatSZPS=11x11%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=625676888&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:49 GMT
integrator.js
adservice.google.de/adsid/ Frame 527C
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 527C
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
pubads_impl_2019100301.js
securepubads.g.doubleclick.net/gpt/ Frame 527C
157 KB
58 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
sffe /
Resource Hash
d98e77e558ef5c298f4c28cdd1604914a16a3fcc9249904ba70c57d989fb6aab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 03 Oct 2019 13:06:21 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
58949
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:49 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571269189710&de=179822073388&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=19&cb=0&ym=0&cu=1571269189710&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745327422%3A138239368367&zMoatPS=top&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=641&zMoatH=321&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=641x321&zMoatSZPS=641x321%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=147734453&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:49 GMT
integrator.js
adservice.google.de/adsid/ Frame 31F6
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 31F6
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl_fy2019.js
pagead2.googlesyndication.com/pagead/js/r20191014/r20190131/ Frame 31F6
220 KB
83 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191014/r20190131/show_ads_impl_fy2019.js?cache=bust
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
5e68830dc559aaaff190a56ff90d4b57ced977c79c9e177109bbb913b4443e0f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
84537
x-xss-protection
0
server
cafe
etag
5373409261949809942
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Wed, 16 Oct 2019 23:39:49 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20191014/r20190131/ Frame 1854
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20191014/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20191014/r20190131/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
accept-encoding
gzip, deflate, br
cookie
IDE=AHWqTUktFH59PuSCnoZulNJ3eJsgPzlzlc_cYEsferhK1RCAlx0Y8ry-8OG3DskY; DSID=NO_DATA
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
vary
Accept-Encoding
date
Mon, 14 Oct 2019 14:21:56 GMT
expires
Mon, 28 Oct 2019 14:21:56 GMT
content-type
text/html; charset=UTF-8
etag
8648543205226238674
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
7402
x-xss-protection
0
cache-control
public, max-age=1209600
age
206273
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
analytics.js
s.update.rubiconproject.com/2/873648/ Frame 31F6
0
75 B
Script
General
Full URL
https://s.update.rubiconproject.com/2/873648/analytics.js?si=59604&di=www.zdnet.com&ap=&dm=2&pi=283812&ti=7e58618c-fb68-4edd-be48-a6db0b0d6888&r5=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&dt=8736481428691810142000
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
34.251.154.165 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-251-154-165.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:49 GMT
Content-Length
0
usync.html
eus.rubiconproject.com/ Frame CDD3
0
0
Document
General
Full URL
https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.78.125 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host
eus.rubiconproject.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/

Response headers

Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified
Mon, 14 Oct 2019 17:50:03 GMT
Content-Encoding
gzip
Content-Length
7684
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=47042
Expires
Thu, 17 Oct 2019 12:43:51 GMT
Date
Wed, 16 Oct 2019 23:39:49 GMT
Connection
keep-alive
Vary
Accept-Encoding
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571269189756&de=167423375535&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=23&cb=0&ym=0&cu=1571269189756&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4825966980%3A138247024569&zMoatPS=top&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=371&zMoatH=771&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=371x771&zMoatSZPS=371x771%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=20007359&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:49 GMT
integrator.js
adservice.google.de/adsid/ Frame 068A
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 068A
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20191014/r20190131/ Frame 068A
238 KB
88 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191014/r20190131/show_ads_impl.js?cache=bust
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
44ac654a5d74e0f55d383818e9fb4782ea064fdc7cac8e5a4bcb71a011cad952
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
89450
x-xss-protection
0
server
cafe
etag
1429027213900407418
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Wed, 16 Oct 2019 23:39:49 GMT
analytics.js
s.update.rubiconproject.com/2/873648/ Frame 068A
0
75 B
Script
General
Full URL
https://s.update.rubiconproject.com/2/873648/analytics.js?si=59604&di=www.zdnet.com&ap=&dm=15&pi=283812&ti=25b07bbf-8edc-4229-852d-c8b6614011c8&r5=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&dt=8736481428691810142000
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
34.251.154.165 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-251-154-165.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:49 GMT
Content-Length
0
usync.html
eus.rubiconproject.com/ Frame 51F9
0
0
Document
General
Full URL
https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.78.125 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host
eus.rubiconproject.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/

Response headers

Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified
Mon, 14 Oct 2019 17:50:03 GMT
Content-Encoding
gzip
Content-Length
7684
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=47042
Expires
Thu, 17 Oct 2019 12:43:51 GMT
Date
Wed, 16 Oct 2019 23:39:49 GMT
Connection
keep-alive
Vary
Accept-Encoding
truncated
/ Frame 31F6
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ade36abde8e9d7490a53be5bdb0e7f91e1e7d3e73d51f307342a3a5aed21ec9b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=6&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1571269189858&r=815994461614&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatPS=bottom&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:49 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=6&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1571269189858&r=815994461614&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatPS=bottom&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:49 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571269189858&de=815994461614&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=27&cb=0&ym=0&cu=1571269189858&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25299489%3A251370729%3A253246569%3A75374362809&zMoatPS=bottom&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=728&zMoatH=90&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=728x90&zMoatSZPS=728x90%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=2064995158&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:49 GMT
bootstrap.js
s1.adform.net/stoat/619/s1.adform.net/ Frame D286
31 KB
15 KB
Script
General
Full URL
https://s1.adform.net/stoat/619/s1.adform.net/bootstrap.js
Requested by
Host: track.adform.net
URL: https://track.adform.net/adfscript/?bn=31755582;rtbwp=91611D4265535969;rtbdata=MWI3ruWwJuorwkpovOcKC5TmDXxXwJUvQHA2j18qC4a_eij0yRyXNeG5guhgy2z5OXtBYiSWWa0HRm_VWFYjrqYeahbu4upsKSj4pVpVqzoHvQATXC24YnuFi-e6TGphjuqzPFvsIifogQ1VSKlDonlrtqmPrnwklJGlkSRlR6nrj1oPWls6o5Nd01ZYOnXDXpSZjrNs8lFuP1QHlvLWDAU3i-CwUWqXfk-eC5C4twjvbzoUPcUb7wL6RVv8AGe92x3ecUW4bCxvXTpEJLsS17e1Bt0etHA5gGBr4U8NvNCI5wu38H9_rcGGfdK1u63jSvO9w6i4bfk1;OOBClickTrack=http://beacon-nf.rubiconproject.com/beacon/v2/t/51/24d01b5b-066b-43f6-a4e4-d25051d7131b/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.73 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
1ef3b2018460f499847215358ad588852cdf72c969234ab0e2674eb9c5890737

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:49 GMT
content-encoding
gzip
last-modified
Tue, 01 Oct 2019 08:04:35 GMT
server
nginx
status
200
x-cache-status
HIT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=100000
expires
Fri, 18 Oct 2019 02:45:34 GMT
truncated
/ Frame 068A
216 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
39b4cee6999629da4c3341a1c6c94d0c9b3e31c0805b530298793b32c1d2e30a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=286&fi=1&apd=289&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=4797955119&L2id=2608978925&L3id=5192378298&L4id=138290277353&S1id=23605329&S2id=23619609&ord=1571269189666&r=684457879453&t=hdn&os=1&fi2=0&div1=0&ait=142&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatPS=top&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:49 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=286&fi=1&apd=289&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=4797955119&L2id=2608978925&L3id=5192378298&L4id=138290277353&S1id=23605329&S2id=23619609&ord=1571269189666&r=684457879453&t=nht&os=1&fi2=0&div1=0&ait=142&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatPS=top&zMoatPT=article&bedc=1&q=4&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:49 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame 527C
29 KB
7 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1653378457507435&correlator=1533495298189130&output=ldjh&impl=fifs&adsid=NT&vrg=2019100301&guci=1.2.0.0.2.2.0.0&plat=1%3A536903688%2C2%3A536903688%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20191016&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=372x142%2C372x142&prev_scp=env%3Dprod%26session%3Dg%26subses%3D5%26ptype%3Darticle%26vguid%3D463420f8-d49a-4522-9502-39fc1d0f882c%7Cenv%3Dprod%26session%3Dg%26subses%3D5%26ptype%3Darticle%26vguid%3D463420f8-d49a-4522-9502-39fc1d0f882c&cookie=ID%3D9af2ce8731e25245%3AT%3D1571269189%3AS%3DALNI_MaVJaUPo7wGY7iWS2TN_IiMvsYuUw&cdm=www.zdnet.com&bc=31&abxe=1&lmt=1571269189&dt=1571269189970&dlt=1571269189481&idt=484&frm=23&biw=1585&bih=1200&isw=371&ish=771&oid=3&adxs=-12245933%2C-12245933&adys=-12245933%2C-12245933&adks=3261246841%2C3261246840&ucis=xtmavjy0d8kw%7Cxujkiv244iw6&ifi=1&ifk=398374515&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F&top=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&dssz=16&icsg=10888&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0%7C0x0&msz=0x0%7C0x0&ga_vid=1471392966.1571269190&ga_sid=1571269190&ga_hid=1642039761&fws=384%2C384&ohw=0%2C0
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
af555826a22f2633fbf3d4bae51859965a38a16f7869aeab49a30a008044dc43
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
7083
x-xss-protection
0
google-lineitem-id
4746066197,4746066197
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138239479696,138239468731
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2019100301.js
securepubads.g.doubleclick.net/gpt/ Frame 527C
63 KB
24 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
sffe /
Resource Hash
33e7cfb629c6fc28bec6f0039c2b843ac7d63cb54a883599ca33ce2384e251fa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 03 Oct 2019 13:06:21 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
24653
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:50 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ Frame 527C
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=3&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1571269189982&r=563960246666&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatPS=bottom&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:49 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=3&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1571269189982&r=563960246666&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatPS=bottom&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:49 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame 1217
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=1742708726&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&ea=0&flash=0&wgl=1&adsid=NT&dt=1571269189787&bpp=11&bdt=312&fdt=212&idt=212&shv=r20191014&cbv=r20190131&saldr=sa&correlator=7975166544755&frm=23&ife=5&pv=2&ga_vid=1691836487.1571269190&ga_sid=1571269190&ga_hid=1330339269&ga_fc=0&iag=3&icsg=173464&nhd=1&dssz=21&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3497&biw=1585&bih=1200&isw=728&ish=90&ifk=1211492856&scr_x=0&scr_y=0&eid=20040031&oid=3&pvsid=3521079985367303&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.dmyed0z1vr0m&fsb=1&dtd=227
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191014/r20190131/show_ads_impl_fy2019.js?cache=bust
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=1742708726&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&ea=0&flash=0&wgl=1&adsid=NT&dt=1571269189787&bpp=11&bdt=312&fdt=212&idt=212&shv=r20191014&cbv=r20190131&saldr=sa&correlator=7975166544755&frm=23&ife=5&pv=2&ga_vid=1691836487.1571269190&ga_sid=1571269190&ga_hid=1330339269&ga_fc=0&iag=3&icsg=173464&nhd=1&dssz=21&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3497&biw=1585&bih=1200&isw=728&ish=90&ifk=1211492856&scr_x=0&scr_y=0&eid=20040031&oid=3&pvsid=3521079985367303&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.dmyed0z1vr0m&fsb=1&dtd=227
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
accept-encoding
gzip, deflate, br
cookie
IDE=AHWqTUktFH59PuSCnoZulNJ3eJsgPzlzlc_cYEsferhK1RCAlx0Y8ry-8OG3DskY; DSID=NO_DATA
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Wed, 16 Oct 2019 23:39:50 GMT
server
cafe
content-length
46
x-xss-protection
0
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
osd.js
www.googletagservices.com/activeview/js/current/ Frame 31F6
77 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191014/r20190131/show_ads_impl_fy2019.js?cache=bust
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s29-in-f2.1e100.net
Software
sffe /
Resource Hash
f425f66d90f1150499b36ab47b56fa6fb1a68136e4f42befca20a920ff85306b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29055
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:50 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame EAA6
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=1742708724&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&ea=0&flash=0&wgl=1&dt=1571269189811&bpp=8&bdt=345&fdt=216&idt=216&shv=r20191014&cbv=r20190131&saldr=sa&correlator=7975166544755&frm=23&ife=5&pv=1&ga_vid=1029052592.1571269190&ga_sid=1571269190&ga_hid=562241255&ga_fc=0&iag=3&icsg=173464&nhd=1&dssz=21&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=3197&biw=1585&bih=1200&isw=300&ish=250&ifk=1466335409&scr_x=0&scr_y=0&eid=20040030&oid=3&pvsid=1810468466022061&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.fyrh3qrj94h5&fsb=1&dtd=227
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191014/r20190131/show_ads_impl.js?cache=bust
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=1742708724&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&ea=0&flash=0&wgl=1&dt=1571269189811&bpp=8&bdt=345&fdt=216&idt=216&shv=r20191014&cbv=r20190131&saldr=sa&correlator=7975166544755&frm=23&ife=5&pv=1&ga_vid=1029052592.1571269190&ga_sid=1571269190&ga_hid=562241255&ga_fc=0&iag=3&icsg=173464&nhd=1&dssz=21&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=3197&biw=1585&bih=1200&isw=300&ish=250&ifk=1466335409&scr_x=0&scr_y=0&eid=20040030&oid=3&pvsid=1810468466022061&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.fyrh3qrj94h5&fsb=1&dtd=227
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
accept-encoding
gzip, deflate, br
cookie
IDE=AHWqTUktFH59PuSCnoZulNJ3eJsgPzlzlc_cYEsferhK1RCAlx0Y8ry-8OG3DskY; DSID=NO_DATA
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Wed, 16 Oct 2019 23:39:50 GMT
server
cafe
content-length
46
x-xss-protection
0
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
osd.js
www.googletagservices.com/activeview/js/current/ Frame 068A
77 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191014/r20190131/show_ads_impl.js?cache=bust
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s29-in-f2.1e100.net
Software
sffe /
Resource Hash
f425f66d90f1150499b36ab47b56fa6fb1a68136e4f42befca20a920ff85306b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29055
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:50 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=https%3A%2F%2Fbeacon-eu2.rubiconproject.com%2Fbeacon%2Fd%2F7e58618c-fb68-4edd-be48-a6db0b0d6888&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1571269189858&de=815994461614&cu=1571269189858&m=15&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=3912&le=1&lf=0&lg=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A-%3A-&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=0&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=6&cd=0&ah=6&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A75374362809&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=728x90&zMoatPS=bottom&zMoatSZPS=728x90%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=728&zMoatH=90&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatSlotId=leader-plus-bottom&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-bottom-5da7a047e2cdc&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-bottom&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=2080581311&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:50 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:50 GMT
json
trc.taboola.com/cbsinteractive-zdnet/trc/3/
13 KB
5 KB
Script
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/trc/3/json?tim=01%3A39%3A50.054&lti=deflated&data=%7B%22id%22%3A723%2C%22ii%22%3A%22%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22vi%22%3A1571269190052%2C%22cv%22%3A%2220191016-8-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22cmps%22%3A3%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1585%2C%22dh%22%3A3912%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A8%2C%22uim%22%3A%22alternating-thumbnails-a%3Aabp%3D0%22%2C%22uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22orig_uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22cd%22%3A2179%2C%22mw%22%3A770%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22deflated%22%7D
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191016-8-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
03713e48481d844910efc220e469cdc55a73118915880ff5782b63937dedcc9d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
content-encoding
gzip
server
nginx
x-timer
S1571269190.059094,VS0,VE110
status
200
x-served-by
cache-fra19139-FRA
vary
Accept-Encoding
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
access-control-allow-credentials
true
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
via
1.1 varnish
x-cache-hits
0
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=218&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1571269189858&r=815994461614&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatPS=bottom&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:50 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:50 GMT
/
track.adform.net/wpf/v2/Vla44j1c.lY5BNvcKyAdMUDFBpBeA0fUm7qKFz0Xnj3wMvsD7z5meTuCUMz_WMXWMYGzXJJIneGffLMC7EZ3QHPBirTYKUowRslzRQqwSM2dFqwomevLNDrhO3f9p_nH1u_eH3BhxUC550ialT0iakiEocEcEJ1w.CxUC541jlS7s... Frame D286
5 KB
3 KB
Script
General
Full URL
https://track.adform.net/wpf/v2/Vla44j1c.lY5BNvcKyAdMUDFBpBeA0fUm7qKFz0Xnj3wMvsD7z5meTuCUMz_WMXWMYGzXJJIneGffLMC7EZ3QHPBirTYKUowRslzRQqwSM2dFqwomevLNDrhO3f9p_nH1u_eH3BhxUC550ialT0iakiEocEcEJ1w.CxUC541jlS7spjt3Q9cUVlOrXTAxw63UYOKES5jfzmkflFflczl998tp7ppfAaZ6m1CdC5MQjGejuTDRNziCvTDfWocQTPOKSfB6QqgXK_Pmtd0UbUV8afuyPBAhqvnMtrUm2DdYejftckuyPBDjaY2ftckkCoq75uQ0IH_J2gMfqv0IRhk6Hb9LarUqUdHz16rgPtFFg4Jh5DtIMk.Nk4JkL3sgdmX6QStMuTnwEQsZPuVr914VecL57GY5BNv_uY5BNkOmqw0GY5aw7vrNidNc1lF4XVA4.L9.gJ0Nc0KXV4.hL9.KHpNc5jaYZtNc5jaYZtNc1KelF1VLf4.ATjV.6oP/adfserve/?CC=1&bn=31755582;rtbwp=91611D4265535969;rtbdata=MWI3ruWwJuorwkpovOcKC5TmDXxXwJUvQHA2j18qC4a_eij0yRyXNeG5guhgy2z5OXtBYiSWWa0HRm_VWFYjrqYeahbu4upsKSj4pVpVqzoHvQATXC24YnuFi-e6TGphjuqzPFvsIifogQ1VSKlDonlrtqmPrnwklJGlkSRlR6nrj1oPWls6o5Nd01ZYOnXDXpSZjrNs8lFuP1QHlvLWDAU3i-CwUWqXfk-eC5C4twjvbzoUPcUb7wL6RVv8AGe92x3ecUW4bCxvXTpEJLsS17e1Bt0etHA5gGBr4U8NvNCI5wu38H9_rcGGfdK1u63jSvO9w6i4bfk1;oobclicktrack=http%3a%2f%2fbeacon-nf.rubiconproject.com%2fbeacon%2fv2%2ft%2f51%2f24d01b5b-066b-43f6-a4e4-d25051d7131b%2f;js=1;adfxid=1x;3690;set=en-US|en-US|1600X1200|0|300|250|24|8|3|7|0|0;fd=2|2&CREFURL=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/619/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.4.41 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
63def73233b7444bbddf916536d934c84b6c56b3e5704a1c42940243eea31576

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 23:39:50 GMT
content-encoding
gzip
server
nginx
status
200
vary
Accept-Encoding
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
content-type
text/javascript; charset=utf-8
content-length
2625
expires
-1
view
securepubads.g.doubleclick.net/pcs/ Frame 4300
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssGffFTS2LBe50qLJy2FHcF5D1HurVbuD0QfK3j8chqdr6_j4PWv9CUSq82Hjzt95tkH2f6M7RZ5DNXBHK1R_T14zixCKFXdCHiRcoiMa6d_JEtOF6xYkNtiLamvthhdR0J7_qguAFDwG-niAh1mdiG4_HK-xBb265Z3Z8NIweOTip0VbW4dI6Z3KxyamEVsaZVoQ0mSGTES7ZNzbpUV4_7dPQC_0lbo3hYfQBv5wZKsZs5GbT2pasqVFPMdXOC00g14bL3YciO&sig=Cg0ArKJSzPWJFd9M_tkEEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 23:39:50 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 4300
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s29-in-f2.1e100.net
Software
sffe /
Resource Hash
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29551
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:50 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 4300
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:50 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=21075
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
view
securepubads.g.doubleclick.net/pcs/ Frame D1B1
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuQtXKbzAs2ZxF_cB_zrXO02cjRke8YSUuie99sn9lb8xaiVzRc-jE2UW0_Ohrr6gi17W-6mbcRTXhULAjZiq1UtzsBPnKvxFBH_We9Af9CeAi2FpCeLH9BvwOscBGgW8efMVWIV7pMKmGJL-x_wtlz0WFuqmWVTUFexszMiHr9RT6Xn-c9hxtIEAq2Nujts80ElJKXuh5JpbNESnrHilCr2tmUWt23G2nizOnlBUCZb8E7PFwkTPiNkYvmrVMlB50YqdHSVpqs&sig=Cg0ArKJSzKOnevvkgAeoEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 23:39:50 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame D1B1
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s29-in-f2.1e100.net
Software
sffe /
Resource Hash
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29551
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:50 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame D1B1
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:50 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=21075
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
osd.js
www.googletagservices.com/activeview/js/current/ Frame 527C
77 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s29-in-f2.1e100.net
Software
sffe /
Resource Hash
f425f66d90f1150499b36ab47b56fa6fb1a68136e4f42befca20a920ff85306b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29055
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:50 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 527C
0
114 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_sz&r=372x142&w=372&h=142
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 23:39:50 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
204
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571269189982&de=563960246666&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=31&cb=0&ym=0&cu=1571269189982&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25299489%3A251370729%3A253246569%3A75375443409&zMoatPS=bottom&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=300&zMoatH=250&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=2106250595&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:50 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:50 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=https%3A%2F%2Fbeacon-eu2.rubiconproject.com%2Fbeacon%2Fd%2F25b07bbf-8edc-4229-852d-c8b6614011c8&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1571269189982&de=563960246666&cu=1571269189982&m=10&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=3912&le=1&lf=0&lg=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A-%3A-&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=0&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=3&cd=0&ah=3&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A75375443409&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=300x250&zMoatPS=bottom&zMoatSZPS=300x250%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatSlotId=mpu-bottom&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-bottom-5da7a047e2cdc&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-bottom&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1865413613&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:50 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:50 GMT
usync.html
eus.rubiconproject.com/ Frame B092
0
0
Document
General
Full URL
https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.78.125 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host
eus.rubiconproject.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/

Response headers

Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified
Mon, 14 Oct 2019 17:50:03 GMT
Content-Encoding
gzip
Content-Length
7684
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=47041
Expires
Thu, 17 Oct 2019 12:43:51 GMT
Date
Wed, 16 Oct 2019 23:39:50 GMT
Connection
keep-alive
Vary
Accept-Encoding
truncated
/ Frame D286
212 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a7343f033fb47a3ea727b24c745fb107b51caae3490bc38d0da831f4a91d0949

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571269190161&de=497570260437&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=35&cb=0&ym=0&cu=1571269190161&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25299489%3A251370729%3A241984809%3A75375443409&zMoatPS=middle&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=300&zMoatH=250&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=middle&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20middle&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1792178905&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:50 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:50 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=4&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1571269190161&r=497570260437&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatPS=middle&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:50 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:50 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=4&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1571269190161&r=497570260437&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatPS=middle&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:50 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:50 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=224&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1571269189982&r=563960246666&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatPS=bottom&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:50 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:50 GMT
Standard
s1.adform.net/stoat/619/s1.adform.net/load/v/0.0.178/e/.wSBgkG/i/8IC-4gAAAAKAA/r:AdConstructor:contents/ImageTag:types/ Frame D286
85 KB
36 KB
Script
General
Full URL
https://s1.adform.net/stoat/619/s1.adform.net/load/v/0.0.178/e/.wSBgkG/i/8IC-4gAAAAKAA/r:AdConstructor:contents/ImageTag:types/Standard
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/619/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.73 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
c5e15cb93124bb13cf2285e749dd3c269bea0b8d633f64acdebf84c2eb8eafb9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
content-encoding
gzip
last-modified
Tue, 01 Oct 2019 08:04:35 GMT
server
nginx
status
200
x-cache-status
HIT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=100000
expires
Fri, 18 Oct 2019 03:14:26 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=https%3A%2F%2Fbeacon-eu2.rubiconproject.com%2Fbeacon%2Fd%2F24d01b5b-066b-43f6-a4e4-d25051d7131b&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1571269190161&de=497570260437&cu=1571269190161&m=12&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=3912&le=1&lf=0&lg=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A-%3A-&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=0&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4&cd=0&ah=4&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=25299489%3A251370729%3A241984809%3A75375443409&bo=23605329&bp=23619609&bd=middle&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=300x250&zMoatPS=middle&zMoatSZPS=300x250%20%7C%20middle&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatSlotId=mpu-middle&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-middle-5da7a047e2cdc&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-middle&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=911381882&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:50 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:50 GMT
userx.20191016-8-RELEASE.es6.js
cdn.taboola.com/libtrc/
22 KB
8 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/userx.20191016-8-RELEASE.es6.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
306b51051ebea8416357b56cdce1ec444b4e9c5892dd8001b9d921c48cf75818

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
BzODgiCc1vJqtgZc.7GO_svGJCrjubS_
content-encoding
gzip
etag
"cf8913b66c7e5c7fabf5d712ff832037"
age
97
x-cache
HIT
status
200
x-amz-replication-status
COMPLETED
content-length
7736
x-amz-id-2
JJUkbxadpebRRm7Afgz7VcbGsb5ha7jbcj/n7ka9EeadxlWpTPrjRb5OMIpkUYNwA457gMpwhSM=
x-served-by
cache-fra19139-FRA
last-modified
Wed, 16 Oct 2019 12:01:44 GMT
server
AmazonS3
x-timer
S1571269190.264976,VS0,VE0
date
Wed, 16 Oct 2019 23:39:50 GMT
vary
Accept-Encoding
x-amz-request-id
252F558C652AD66E
via
1.1 varnish
cache-control
private,max-age=14400
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
62
x-cache-hits
24
social
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
83 B
Image
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=deflated&ri=772a19bc95d826b311054f7ab80d22c7&sd=v2_582650137ef938b114fddfa9f7bb1c8c_3821f2b5-a390-4c7a-b640-21914f60d323-tuct4a12fc6_1571269190_1571269190_CNawjgYQzro_GKTDxLfdLSABKAEwODib4wlAgooQSJjEF1Cl7BBYAWAA&pi=/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&wi=3175979704400722675&pt=text&vi=1571269190052&st=social-available&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22ctx%22%2C%22ism%22%3Afalse%2C%22srx%22%3A1600%2C%22sry%22%3A1200%2C%22pd%22%3Anull%2C%22tpl%22%3A%22%22%2C%22url%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%22%2C%22rref%22%3A%22%22%2C%22sref%22%3A%22_sessionPending_%22%2C%22hdl%22%3A%22%22%2C%22sec%22%3A%22%22%2C%22aut%22%3A%22%22%2C%22img%22%3A%22%22%2C%22v%22%3A13%7D%5D%7D&tim=01%3A39%3A50.277&id=4405&llvl=1&cv=20191016-8-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 23:39:50 GMT
via
1.1 varnish
server
nginx
x-timer
S1571269190.281258,VS0,VE9
x-served-by
cache-fra19139-FRA
status
204
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
content-type
image/gif
x-cache-hits
0
social
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
54 B
Image
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=deflated&ri=772a19bc95d826b311054f7ab80d22c7&sd=v2_582650137ef938b114fddfa9f7bb1c8c_3821f2b5-a390-4c7a-b640-21914f60d323-tuct4a12fc6_1571269190_1571269190_CNawjgYQzro_GKTDxLfdLSABKAEwODib4wlAgooQSJjEF1Cl7BBYAWAA&pi=/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&wi=3175979704400722675&pt=text&vi=1571269190052&st=social-visible&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A1%2C%22ln%22%3A%22below-fold%22%2C%22lx%22%3A336%2C%22ly%22%3A705%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%2C%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A1%2C%22ln%22%3A%22below-fold%22%2C%22lx%22%3A592%2C%22ly%22%3A705%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%5D%7D&tim=01%3A39%3A50.277&id=6967&llvl=1&cv=20191016-8-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 23:39:50 GMT
via
1.1 varnish
server
nginx
x-timer
S1571269190.281250,VS0,VE9
x-served-by
cache-fra19139-FRA
status
204
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
content-type
image/gif
x-cache-hits
0
available
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
72 B
XHR
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/available?route=AM%3AAM%3AV&lti=deflated
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191016-8-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 23:39:50 GMT
via
1.1 varnish
server
nginx
x-timer
S1571269190.286066,VS0,VE9
x-served-by
cache-fra19139-FRA
status
204
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
content-type
image/gif
x-cache-hits
0
6fb8416b363c8dc8867876859d95e714.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
22 KB
22 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/6fb8416b363c8dc8867876859d95e714.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
3086f9d9c136567afd2329681740df73662a2630beeac697695c5f84c89cfcf1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
via
1.1 varnish, 1.1 varnish
age
1187431
edge-cache-tag
355624323117692569059618948474045935360,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sat, 26 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/6fb8416b363c8dc8867876859d95e714.jpg
content-length
22358
x-served-by
cache-iad2144-IAD, cache-fra19139-FRA
last-modified
Wed, 25 Sep 2019 09:21:35 GMT
server
cloudinary
x-timer
S1571269190.295023,VS0,VE0
etag
"ae42beacabc3743abe987c43304efa74"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
e1dc055e96ffa3bc7b76147d1c9942e0.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
6 KB
6 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/e1dc055e96ffa3bc7b76147d1c9942e0.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
9da65a11eb20988f4e0e7d0d31f2ed47e2fcf6a80b38abf33fb71ae3fa0e8776

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
via
1.1 varnish, 1.1 varnish
age
504744
edge-cache-tag
333928480706380655334798130253981954117,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Mon, 14 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/e1dc055e96ffa3bc7b76147d1c9942e0.png
content-length
6156
x-served-by
cache-fra19137-FRA, cache-fra19139-FRA
last-modified
Fri, 13 Sep 2019 20:38:15 GMT
server
cloudinary
x-timer
S1571269190.295050,VS0,VE0
etag
"06ffd459a494d6dbd6c9812f237472f0"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 1
1a1ac15271660f3d945b4904ef437371.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
5 KB
6 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1a1ac15271660f3d945b4904ef437371.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
2f179c0918ddb8af28b17040e1822625ffa2635a08e4fa98521d0a95dc9a554b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
via
1.1 varnish, 1.1 varnish
age
950240
edge-cache-tag
616089906201828448420340560109273106143,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Wed, 16 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1a1ac15271660f3d945b4904ef437371.jpg
content-length
5431
x-served-by
cache-fra19142-FRA, cache-fra19139-FRA
last-modified
Sun, 15 Sep 2019 13:12:03 GMT
server
cloudinary
x-timer
S1571269190.295040,VS0,VE0
etag
"033e210ecc99607a94af83829efcf625"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 8
ade884edba3047506d3f23011821f040.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
7 KB
8 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ade884edba3047506d3f23011821f040.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
1f181fa4df39fdf7461203d84d56a132780ec04c417ef226f11dbb4c25dbfb93

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
via
1.1 varnish, 1.1 varnish
age
2499131
edge-cache-tag
421663935176379570917553637215074505719,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sat, 21 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ade884edba3047506d3f23011821f040.png
content-length
7297
x-served-by
cache-fra19157-FRA, cache-fra19139-FRA
last-modified
Wed, 21 Aug 2019 02:50:12 GMT
server
cloudinary
x-timer
S1571269190.295063,VS0,VE0
etag
"be764ef12f992d5b012965ec6b005427"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
ccbc6c965f4bc1e1e7c8a47980c863c9.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
14 KB
14 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ccbc6c965f4bc1e1e7c8a47980c863c9.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
f763112ed36675dd240650c54aaae41a860760ef21a9c0f98cd7bc3a508d893f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
via
1.1 varnish, 1.1 varnish
age
1713052
edge-cache-tag
412707102093361656283059009812149686356,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Tue, 08 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ccbc6c965f4bc1e1e7c8a47980c863c9.jpg
content-length
14400
x-served-by
cache-fra19131-FRA, cache-fra19139-FRA
last-modified
Sat, 07 Sep 2019 14:36:16 GMT
server
cloudinary
x-timer
S1571269190.295035,VS0,VE1
etag
"a92a10ec995f22e0b017405ca7cba53b"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
75255266c0c20daa45930381e05f3fe4.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
13 KB
13 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/75255266c0c20daa45930381e05f3fe4.jpeg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
04a7a7de0c5c1593d1851c1c07fb072ef5eb167c96935a73cd6b7c74b25548cc

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
via
1.1 varnish, 1.1 varnish
age
689615
edge-cache-tag
612019019561551783998521653221200615189,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Mon, 14 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/75255266c0c20daa45930381e05f3fe4.jpeg
content-length
13096
x-served-by
cache-fra19145-FRA, cache-fra19139-FRA
last-modified
Fri, 13 Sep 2019 20:40:06 GMT
server
cloudinary
x-timer
S1571269190.294874,VS0,VE1
etag
"3d744804deef4d27ec85fb6547cda7ed"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 1
261cc41c40dd7b2d361e2190c37a91ae.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
15 KB
15 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/261cc41c40dd7b2d361e2190c37a91ae.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
de3f545646517dfc453eac0eccc65d47cd44120c2d56acfdd8ed0060a4b02e04

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
via
1.1 varnish, 1.1 varnish
age
1727040
edge-cache-tag
447993804836861741518017692616274489175,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sat, 19 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/261cc41c40dd7b2d361e2190c37a91ae.jpg
content-length
14859
x-served-by
cache-fra19155-FRA, cache-fra19139-FRA
last-modified
Wed, 18 Sep 2019 08:57:48 GMT
server
cloudinary
x-timer
S1571269190.305039,VS0,VE1
etag
"9a316abac985341a40e6dd7d7fdef527"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
cb4e875bb1d2e915c95202b364799edb.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
9 KB
10 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/cb4e875bb1d2e915c95202b364799edb.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
8b03b46424d2e66f1d79c0e0a6e7a284c103c937fa4efba31fadb89eaedeef36

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
via
1.1 varnish, 1.1 varnish
age
675480
edge-cache-tag
483494632291498733667052070264370579903,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sun, 27 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/cb4e875bb1d2e915c95202b364799edb.jpg
content-length
9441
x-served-by
cache-fra19169-FRA, cache-fra19139-FRA
last-modified
Thu, 26 Sep 2019 00:54:23 GMT
server
cloudinary
x-timer
S1571269190.305107,VS0,VE0
etag
"4c2718e20b5dd7d2a0fd8fdf4946cf31"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571269190178&de=462187430507&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=39&cb=0&ym=0&cu=1571269190178&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4746066197%3A138239479696&zMoatPT=article&zMoatW=372&zMoatH=142&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=-&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=372x142&zMoatPS=Not%20Specified&zMoatSZPS=Not%20Specified&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1122164586&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:50 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:50 GMT
/
track.adform.net/csimpr/ Frame D286
35 B
422 B
Other
General
Full URL
https://track.adform.net/csimpr/?bn=31755582&csi=wwak6D6_gcTFRm0llcIufo1MpKV3jRpxEurxgd9wMzJNBB91lsK-cfNB3BGFtbz8RYvW2Twyv0Gs7A9yGzt-n2I2SaJEkJyXbuQ8anSF0XGcD_vjBU7LOQ2
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/619/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.4.41 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 23:39:50 GMT
server
nginx
status
200
access-control-max-age
86400
access-control-allow-methods
GET, POST
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
content-type
image/gif
access-control-allow-headers
Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires
-1
33614154.png
s1.adform.net/Banners/33614154/ Frame D286
21 KB
21 KB
Image
General
Full URL
https://s1.adform.net/Banners/33614154/33614154.png?bv=2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.73 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
f5721efa8525b22dd894257d9e675e6b60245527ea85e1f4833ca3f58cbfde16
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
last-modified
Tue, 06 Aug 2019 09:54:38 GMT
server
nginx
status
200
etag
"5d494e5e-540e"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
21518
f539211219b796ffbb49949997c764f0.png
cdn.taboola.com/libtrc/static/thumbnails/
254 B
718 B
Image
General
Full URL
https://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191016-8-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC
via
1.1 varnish
etag
"dfa7b52c86e56bd67fa4002f6ed19854"
age
13666
x-cache
HIT
status
200
x-amz-replication-status
COMPLETED
content-length
254
x-amz-id-2
Vjnfq2okxpLEG/cBVxSfv3DOOCGN7KTpixt29L7DwUhoZL6eRlgDSODZqhfatrYL58q01gaLKf4=
x-served-by
cache-fra19139-FRA
last-modified
Wed, 24 Jun 2015 07:14:11 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567
x-timer
S1571269190.325941,VS0,VE0
date
Wed, 16 Oct 2019 23:39:50 GMT
x-amz-request-id
F6D91014AAA6CDC4
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
image/png
abp
62
x-cache-hits
8453
domains
api.viglink.com/api/
68 B
513 B
XHR
General
Full URL
https://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
5680dab22eb8f0902c5f26cca262a05c56a412340304615a0f4150e5d9bd4298

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:49 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
68
Expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571269190190&de=405437863049&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=43&cb=0&ym=0&cu=1571269190190&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4746066197%3A138239468731&zMoatPT=article&zMoatW=372&zMoatH=142&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=-&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=372x142&zMoatPS=Not%20Specified&zMoatSZPS=Not%20Specified&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1337842139&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:50 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:50 GMT
6fb8416b363c8dc8867876859d95e714.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
22 KB
22 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/6fb8416b363c8dc8867876859d95e714.jpg
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
3086f9d9c136567afd2329681740df73662a2630beeac697695c5f84c89cfcf1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
via
1.1 varnish, 1.1 varnish
age
1187432
edge-cache-tag
355624323117692569059618948474045935360,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sat, 26 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/6fb8416b363c8dc8867876859d95e714.jpg
content-length
22358
x-served-by
cache-iad2144-IAD, cache-fra19139-FRA
last-modified
Wed, 25 Sep 2019 09:21:35 GMT
server
cloudinary
x-timer
S1571269190.411713,VS0,VE0
etag
"ae42beacabc3743abe987c43304efa74"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 3
1a1ac15271660f3d945b4904ef437371.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
5 KB
6 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1a1ac15271660f3d945b4904ef437371.jpg
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
2f179c0918ddb8af28b17040e1822625ffa2635a08e4fa98521d0a95dc9a554b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
via
1.1 varnish, 1.1 varnish
age
950240
edge-cache-tag
616089906201828448420340560109273106143,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Wed, 16 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1a1ac15271660f3d945b4904ef437371.jpg
content-length
5431
x-served-by
cache-fra19142-FRA, cache-fra19139-FRA
last-modified
Sun, 15 Sep 2019 13:12:03 GMT
server
cloudinary
x-timer
S1571269190.411896,VS0,VE0
etag
"033e210ecc99607a94af83829efcf625"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 9
75255266c0c20daa45930381e05f3fe4.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
13 KB
13 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/75255266c0c20daa45930381e05f3fe4.jpeg
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
04a7a7de0c5c1593d1851c1c07fb072ef5eb167c96935a73cd6b7c74b25548cc

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
via
1.1 varnish, 1.1 varnish
age
689615
edge-cache-tag
612019019561551783998521653221200615189,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Mon, 14 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/75255266c0c20daa45930381e05f3fe4.jpeg
content-length
13096
x-served-by
cache-fra19145-FRA, cache-fra19139-FRA
last-modified
Fri, 13 Sep 2019 20:40:06 GMT
server
cloudinary
x-timer
S1571269190.411871,VS0,VE0
etag
"3d744804deef4d27ec85fb6547cda7ed"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 2
e1dc055e96ffa3bc7b76147d1c9942e0.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
6 KB
6 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/e1dc055e96ffa3bc7b76147d1c9942e0.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
9da65a11eb20988f4e0e7d0d31f2ed47e2fcf6a80b38abf33fb71ae3fa0e8776

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
via
1.1 varnish, 1.1 varnish
age
504744
edge-cache-tag
333928480706380655334798130253981954117,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Mon, 14 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/e1dc055e96ffa3bc7b76147d1c9942e0.png
content-length
6156
x-served-by
cache-fra19137-FRA, cache-fra19139-FRA
last-modified
Fri, 13 Sep 2019 20:38:15 GMT
server
cloudinary
x-timer
S1571269190.413287,VS0,VE0
etag
"06ffd459a494d6dbd6c9812f237472f0"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 2
ade884edba3047506d3f23011821f040.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
7 KB
8 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ade884edba3047506d3f23011821f040.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
1f181fa4df39fdf7461203d84d56a132780ec04c417ef226f11dbb4c25dbfb93

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
via
1.1 varnish, 1.1 varnish
age
2499131
edge-cache-tag
421663935176379570917553637215074505719,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sat, 21 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ade884edba3047506d3f23011821f040.png
content-length
7297
x-served-by
cache-fra19157-FRA, cache-fra19139-FRA
last-modified
Wed, 21 Aug 2019 02:50:12 GMT
server
cloudinary
x-timer
S1571269190.413514,VS0,VE0
etag
"be764ef12f992d5b012965ec6b005427"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
ccbc6c965f4bc1e1e7c8a47980c863c9.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
14 KB
14 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ccbc6c965f4bc1e1e7c8a47980c863c9.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
f763112ed36675dd240650c54aaae41a860760ef21a9c0f98cd7bc3a508d893f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
via
1.1 varnish, 1.1 varnish
age
1713052
edge-cache-tag
412707102093361656283059009812149686356,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Tue, 08 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ccbc6c965f4bc1e1e7c8a47980c863c9.jpg
content-length
14400
x-served-by
cache-fra19131-FRA, cache-fra19139-FRA
last-modified
Sat, 07 Sep 2019 14:36:16 GMT
server
cloudinary
x-timer
S1571269190.413506,VS0,VE0
etag
"a92a10ec995f22e0b017405ca7cba53b"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=249&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1571269190161&r=497570260437&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatPS=middle&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:50 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:50 GMT
cb4e875bb1d2e915c95202b364799edb.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
9 KB
10 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/cb4e875bb1d2e915c95202b364799edb.jpg
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
8b03b46424d2e66f1d79c0e0a6e7a284c103c937fa4efba31fadb89eaedeef36

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
via
1.1 varnish, 1.1 varnish
age
675480
edge-cache-tag
483494632291498733667052070264370579903,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sun, 27 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/cb4e875bb1d2e915c95202b364799edb.jpg
content-length
9441
x-served-by
cache-fra19169-FRA, cache-fra19139-FRA
last-modified
Thu, 26 Sep 2019 00:54:23 GMT
server
cloudinary
x-timer
S1571269190.421348,VS0,VE0
etag
"4c2718e20b5dd7d2a0fd8fdf4946cf31"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
261cc41c40dd7b2d361e2190c37a91ae.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
15 KB
15 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/261cc41c40dd7b2d361e2190c37a91ae.jpg
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
de3f545646517dfc453eac0eccc65d47cd44120c2d56acfdd8ed0060a4b02e04

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:50 GMT
via
1.1 varnish, 1.1 varnish
age
1727040
edge-cache-tag
447993804836861741518017692616274489175,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sat, 19 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/261cc41c40dd7b2d361e2190c37a91ae.jpg
content-length
14859
x-served-by
cache-fra19155-FRA, cache-fra19139-FRA
last-modified
Wed, 18 Sep 2019 08:57:48 GMT
server
cloudinary
x-timer
S1571269190.422381,VS0,VE0
etag
"9a316abac985341a40e6dd7d7fdef527"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
activeview
pagead2.googlesyndication.com/pcs/ Frame A012
42 B
115 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssgmITWv0gE8Iho-Tc1rzsV9lCvvbEz59Zb7guVujfaXDAQh-y35aXBrQ_Uu0rV0YVwphTZaBJf7GRCHrPmtVYBoFT3GC22AyT9NYARohfr935ftWRDOY_yZn-MyzLKrAyEZUaZ2ymBQR4u&sai=AMfl-YQAi26Y2CCQFRBCEiJN2ES6gdPTXO0vOS2Ve6wOED1HG6V24bYAvLSAWQkQXCfZLEG9ybpGIcwNXIR5aKzOKYvS2yPsIELqx7y8GlRgmqgx2_ajbengJLdd0oo8&sig=Cg0ArKJSzM6cHbDW9qTXEAE&cid=CAASF-RoyxP3vkq-QQA9ipRH_DW-UloXupJF&id=ampim&o=308,420&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,0,1000,1000&tos=0,0,0,1000,0&tfs=194&tls=1194&g=100&h=100&pt=317&tt=1194&rpt=317&rst=1571269189433&r=v&adk=3173884068&avms=ampa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 23:39:50 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1571269189666&de=684457879453&cu=1571269189666&m=1157&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=3912&le=1&lf=81&lg=1&lh=53&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1150&an=3&gi=1&gf=1150&gg=3&ix=1150&ic=1150&ez=1&ck=1150&kw=952&aj=1&pg=100&pf=100&ib=1&cc=1&bw=1150&bx=3&ci=1150&jz=952&dj=1&aa=1&ad=1006&cn=0&gn=1&gk=1006&gl=0&ik=1006&co=1006&cp=952&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=952&cd=6&ah=952&am=6&rf=0&re=1&ft=1006&fv=0&fw=1006&wb=1&cl=0&at=0&d=4797955119%3A2608978925%3A5192378298%3A138290277353&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=300x250&zMoatPS=top&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatSlotId=mpu-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-plus-top-5da7a047e2cdc&hv=CBS%20Attribute&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1235856603&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:50 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:50 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=952&tet=1150&fi=1&apd=1153&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=4797955119&L2id=2608978925&L3id=5192378298&L4id=138290277353&S1id=23605329&S2id=23619609&ord=1571269189666&r=684457879453&t=iv&os=1&fi2=0&div1=1&ait=1006&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatPS=top&zMoatPT=article&bedc=1&q=5&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:50 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:50 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 4D59
42 B
110 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstTgaZ-Jtu1kd6F2yk-SP2ad3KPVSMwM_vDLTaCqpsWWldcR-NTVZRBRIjOfelRMexsg1D_dZJYSoRm6pfFDQ8Y0wOw5iVPy57i3TGw-MU&sig=Cg0ArKJSzKlr6NMk6GBKEAE&adk=730226395&tt=-1&bs=1585%2C1200&mtos=1088,1088,1088,1088,1088&tos=1088,0,0,0,0&p=700,1043,950,1343&cm=1&mcvt=1088&rs=0&ht=0&tfs=118&tls=1206&mc=1&lte=1&bas=0&bac=0&met=mue&avms=nio&exg=1&md=2&lm=2&rst=1571269189453&dlt=0&rpt=172&isd=0&msd=0&xdi=0&xosd=1&ps=1585%2C3912&ss=1600%2C1200&pt=-1&bin=4&deb=1-0-0-1-11-3-10-10-0-0-0&tvt=1205&is=300%2C250&iframe_loc=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F&r=v&id=osdim&vs=4&uc=11&upc=1&tgt=DIV&cl=1&cec=1&clc=1&cac=1&cd=0x0&itpl=19&v=20191014
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 23:39:50 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1571269189666&de=684457879453&cu=1571269189666&m=1158&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=3912&le=1&lf=81&lg=1&lh=53&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1150&an=1150&gi=1&gf=1150&gg=1150&ix=1150&ic=1150&ez=1&ck=1150&kw=952&aj=1&pg=100&pf=100&ib=1&cc=1&bw=1150&bx=1150&ci=1150&jz=952&dj=1&aa=1&ad=1006&cn=1006&gn=1&gk=1006&gl=1006&ik=1006&co=1006&cp=952&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=952&cd=952&ah=952&am=952&rf=0&re=1&ft=1006&fv=1006&fw=1006&wb=1&cl=0&at=0&d=4797955119%3A2608978925%3A5192378298%3A138290277353&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=300x250&zMoatPS=top&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatSlotId=mpu-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-plus-top-5da7a047e2cdc&hv=CBS%20Attribute&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=2118480175&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:50 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:50 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1571269189666&de=684457879453&cu=1571269189666&m=1159&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=3912&le=1&lf=81&lg=1&lh=53&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1150&an=1150&gi=1&gf=1150&gg=1150&ix=1150&ic=1150&ez=1&ck=1150&kw=952&aj=1&pg=100&pf=100&ib=1&cc=1&bw=1150&bx=1150&ci=1150&jz=952&dj=1&aa=1&ad=1006&cn=1006&gn=1&gk=1006&gl=1006&ik=1006&co=1006&cp=952&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=952&cd=952&ah=952&am=952&rf=0&re=1&ft=1006&fv=1006&fw=1006&wb=1&cl=0&at=0&d=4797955119%3A2608978925%3A5192378298%3A138290277353&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=300x250&zMoatPS=top&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatSlotId=mpu-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-plus-top-5da7a047e2cdc&hv=CBS%20Attribute&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1814732753&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:50 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:50 GMT
settings.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/variation/var-8bfb225b-f103-49ab-955c-32d3183cf24c/
7 KB
5 KB
Script
General
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/variation/var-8bfb225b-f103-49ab-955c-32d3183cf24c/settings.js?cb=637048605067352348
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637057951420142886
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fe074214a9c301f8c3ba319d4bab7cba8d65164dcc2077272a9cacedf8941ae2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 16 Oct 2019 23:39:53 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
2VqL9ACwktkYsY/Ec2Z++Q==
age
190436
cf-polished
origSize=7074
status
200
last-modified
Mon, 23 Sep 2019 18:34:57 GMT
x-ms-lease-status
unlocked
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
x-ms-request-id
7084f032-801e-009d-7b3d-722f81000000
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
526ddfe8b8168c74-VIE
expires
Thu, 15 Oct 2020 23:39:53 GMT
lightbox_builder.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame CA4D
200 KB
27 KB
Script
General
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=637048605067352348
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637057951420142886
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
35f3de772fc88b09b9f866de6d38f50d8716aecc446bb10456585f61834ae2c8

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 16 Oct 2019 23:39:53 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
DPY02gsPpNVzBSyytYwMZw==
age
190935
cf-polished
origSize=326600
status
200
last-modified
Mon, 23 Sep 2019 18:35:06 GMT
x-ms-lease-status
unlocked
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
x-ms-request-id
3afa8c39-501e-0131-7d3d-724843000000
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
526ddfe8b8198c74-VIE
expires
Thu, 15 Oct 2020 23:39:53 GMT
css
fonts.googleapis.com/ Frame CA4D
783 B
716 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Raleway
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=637048605067352348
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
3147026ff99804131affcb3cadbdfd49c0a07583682aefcc1198f57e2614d5b0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 16 Oct 2019 23:39:53 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Wed, 16 Oct 2019 23:39:53 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
expires
Wed, 16 Oct 2019 23:39:53 GMT
fancybox_sprite.png
cdn.jsdelivr.net/fancybox/2.1.5/
1 KB
1 KB
Image
General
Full URL
https://cdn.jsdelivr.net/fancybox/2.1.5/fancybox_sprite.png
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637057951420142886
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::621 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
b9d6fddb0988440902fcfc72f371ecfa80ee2eb36073f9eebc17449ee41c886f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
status
200
etag
W/"552-F98Z+XYo53vgnDUr8nQl+uokglE"
vary
Accept-Encoding
x-cache
HIT, HIT
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
date
Wed, 16 Oct 2019 23:39:53 GMT
accept-ranges
bytes
timing-allow-origin
*
content-length
1362
x-served-by
cache-ams21048-AMS, cache-fra19152-FRA
1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2
fonts.gstatic.com/s/raleway/v14/ Frame CA4D
13 KB
13 KB
Font
General
Full URL
https://fonts.gstatic.com/s/raleway/v14/1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637057951420142886
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Raleway
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 19:19:03 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 03:48:04 GMT
server
sffe
age
188450
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
13428
x-xss-protection
0
expires
Tue, 13 Oct 2020 19:19:03 GMT
t.gif
www.lightboxcdn.com/z9g/
35 B
191 B
Image
General
Full URL
https://www.lightboxcdn.com/z9g/t.gif?c=1571269193700&h=www.zdnet.com&e=i&u=40913&b=193988&v=2544&s=empty
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 16 Oct 2019 23:39:53 GMT
cf-cache-status
HIT
content-md5
KNaBTzCeoon4R8ac+RGUxg==
age
1096718
cf-polished
status=not_needed
x-ms-meta-cbmodifiedtime
Tue, 26 Feb 2019 00:59:40 GMT
status
200
content-length
35
x-ms-lease-status
unlocked
last-modified
Tue, 26 Feb 2019 01:15:02 GMT
server
cloudflare
etag
0x8D69B87D5A1B25F
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
x-ms-request-id
48b7eafb-401e-010c-457d-f6fd65000000
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
526ddfeca9068c74-VIE
cf-bgj
imgq:85
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1571269189666&de=684457879453&cu=1571269189666&m=5008&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=3912&le=1&lf=81&lg=1&lh=53&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=5000&an=1150&gi=1&gf=5000&gg=1150&ix=5000&ic=5000&ez=1&ck=1150&kw=952&aj=1&pg=100&pf=100&ib=1&cc=1&bw=5000&bx=1150&ci=1150&jz=952&dj=1&aa=1&ad=4856&cn=1006&gn=1&gk=4856&gl=1006&ik=4856&co=1006&cp=952&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4803&cd=952&ah=4803&am=952&rf=0&re=1&ft=4856&fv=1006&fw=1006&wb=2&cl=0&at=0&d=4797955119%3A2608978925%3A5192378298%3A138290277353&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=300x250&zMoatPS=top&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatSlotId=mpu-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-plus-top-5da7a047e2cdc&hv=CBS%20Attribute&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1924072792&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:54 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:54 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1571269189858&de=815994461614&cu=1571269189858&m=5369&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=3912&le=1&lf=0&lg=1&lh=92&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A0%3A-&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&aj=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&dj=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&cq=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5162&cd=6&ah=5162&am=6&rf=0&re=1&wb=1&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A75374362809&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=728x90&zMoatPS=bottom&zMoatSZPS=728x90%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=728&zMoatH=90&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatSlotId=leader-plus-bottom&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-bottom-5da7a047e2cdc&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-bottom&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=417535608&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:55 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:55 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1571269189982&de=563960246666&cu=1571269189982&m=5296&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=3912&le=1&lf=0&lg=1&lh=62&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A0%3A-&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&aj=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&dj=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&cq=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5091&cd=3&ah=5091&am=3&rf=0&re=1&wb=1&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A75375443409&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=300x250&zMoatPS=bottom&zMoatSZPS=300x250%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatSlotId=mpu-bottom&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-bottom-5da7a047e2cdc&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-bottom&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1353779030&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:55 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:55 GMT
/
track.adform.net/serving/unload/ Frame D286
35 B
413 B
Other
General
Full URL
https://track.adform.net/serving/unload/?version=15&unload=-4415780301758472783@@31755582,6443843213183443631,0|0|0|0|0|0|0|0|0||0|0|31|7be63f12d762bfcb0e0a3c99697a1c8e964963a8_1|||1|0|0|WKX6_e4d2aDtM-qxezg3lTifZiyUxSvbY6ixth2LPSG03_m_NalikgDCyA2L_VipmVKB6saG2-41|||11|0
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/619/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.4.41 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 23:39:55 GMT
server
nginx
status
200
access-control-max-age
86400
access-control-allow-methods
GET, POST
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
content-type
image/gif
access-control-allow-headers
Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires
-1
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1571269190161&de=497570260437&cu=1571269190161&m=5313&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=3912&le=1&lf=0&lg=1&lh=39&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A0%3A-&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&aj=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&dj=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&cq=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5106&cd=4&ah=5106&am=4&rf=0&re=1&wb=1&cl=0&at=0&d=25299489%3A251370729%3A241984809%3A75375443409&bo=23605329&bp=23619609&bd=middle&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=300x250&zMoatPS=middle&zMoatSZPS=300x250%20%7C%20middle&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatSlotId=mpu-middle&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-middle-5da7a047e2cdc&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-middle&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=2084598482&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:55 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:55 GMT
count-data.js
zdnet-1.disqus.com/
185 B
727 B
Script
General
Full URL
https://zdnet-1.disqus.com/count-data.js?1=28d0a422-cfea-4d23-bae1-2b6eaf0a254f
Requested by
Host: zdnet-1.disqus.com
URL: https://zdnet-1.disqus.com/count.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.134 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
1ad83ff2abdfe406a3b5e5c903c2a7f31b8993e4f2ff542b2bc49a8ab212827a
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 23:39:55 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
nginx
Age
586
X-Frame-Options
SAMEORIGIN
Connection
keep-alive
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Vary
Accept-Encoding
Cache-Control
public, max-age=600
Strict-Transport-Security
max-age=300; includeSubdomains
Content-Type
application/javascript; charset=UTF-8
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length
164
X-XSS-Protection
1; mode=block
/
www.zdnet.com/homepage/xhr/
249 KB
27 KB
XHR
General
Full URL
https://www.zdnet.com/homepage/xhr/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1824-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
3265971579bf8eb858aaad978c88df12c0c0525e9f4fafc6592ed3226b0fa6ab
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
26819
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 16 Oct 2019 23:19:51 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 16 Oct 2019 23:39:59 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
088b87c7-f73c-41ea-a12b-1082c07d58eb
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Thu, 17 Oct 2019 00:49:51 GMT
ring.gif
zdnet4.cbsistatic.com/fly/1571249270-fly/bundles/zdnetcss/images/logos/
16 KB
9 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/fly/1571249270-fly/bundles/zdnetcss/images/logos/ring.gif
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet1.cbsistatic.com/fly/1824-fly/css/core/main-d833df87ab-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
18662
status
200
vary
Accept-Encoding
content-length
9039
x-xss-protection
1; mode=block
last-modified
Wed, 16 Oct 2019 18:07:50 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da75c76-3f75"
strict-transport-security
max-age=31536000
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 23 Oct 2019 18:28:56 GMT
ZDLogoMicroRed-x2.png
zdnet4.cbsistatic.com/fly/1571249270-fly/bundles/zdnetcss/images/logos/
2 KB
2 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/fly/1571249270-fly/bundles/zdnetcss/images/logos/ZDLogoMicroRed-x2.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet1.cbsistatic.com/fly/1824-fly/css/core/main-d833df87ab-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
18663
status
200
vary
Accept-Encoding
content-length
1513
x-xss-protection
1; mode=block
last-modified
Wed, 16 Oct 2019 18:07:50 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da75c76-6fa"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 23 Oct 2019 18:28:56 GMT
ZDLogoMicroWhite-x2.png
zdnet4.cbsistatic.com/fly/1571249270-fly/bundles/zdnetcss/images/logos/
2 KB
1 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/fly/1571249270-fly/bundles/zdnetcss/images/logos/ZDLogoMicroWhite-x2.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1824-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet1.cbsistatic.com/fly/1824-fly/css/core/main-d833df87ab-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
18664
status
200
vary
Accept-Encoding
content-length
1398
x-xss-protection
1; mode=block
last-modified
Wed, 16 Oct 2019 18:07:50 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da75c76-691"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 23 Oct 2019 18:28:49 GMT
river-time-ago-f2210a157b-rev.js
zdnet4.cbsistatic.com/fly/js/components/
753 B
544 B
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/js/components/river-time-ago-f2210a157b-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
2d3e9015bb665cc4e62a0aada26a74311bf87ba40e12b896724f447a98e68a89
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
323236
status
200
vary
Accept-Encoding
content-length
426
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:13 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d9e3581-2f1"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 20 Oct 2019 05:52:42 GMT
tr-premium-promo-49ebdaab89-rev.js
zdnet2.cbsistatic.com/fly/js/components/
461 B
416 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/tr-premium-promo-49ebdaab89-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f0c8ad030a90f1ee3cdcd5910587eab25da7bb0ec6f942d979bba4d506b38380
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
56898
status
200
vary
Accept-Encoding
content-length
287
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:32:11 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5da4bf2b-1cd"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 23 Oct 2019 07:51:40 GMT
image-gallery-modal-e49526b449-rev.js
zdnet1.cbsistatic.com/fly/js/components/
5 KB
2 KB
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/components/image-gallery-modal-e49526b449-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f5b52ad70c5d645388b52d2fadaf8a5311aee9a01436866ab9b3e2c5f02e1c22
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
228380
status
200
vary
Accept-Encoding
content-length
1909
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:13 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e3581-13d0"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 21 Oct 2019 08:13:38 GMT
load-more-34f6119ea4-rev.js
zdnet3.cbsistatic.com/fly/js/components/
5 KB
2 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/load-more-34f6119ea4-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f1f493f2418d851d9c9d5a6522417b0faa8e54fc93255abe5939b309a6e1465e
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
154612
status
200
vary
Accept-Encoding
content-length
1803
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:32:11 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da4bf2b-12a2"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 22 Oct 2019 04:43:06 GMT
/
www.zdnet.com/newsletter/xhr/widget-login/
2 KB
2 KB
XHR
General
Full URL
https://www.zdnet.com/newsletter/xhr/widget-login/?topic=
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1824-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
be4496637183dcca24f933007088e2b7334d431bab5996611d62228f5a04bfed
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
736
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 16 Oct 2019 23:39:59 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
bc4e9978-fe71-4c8c-ad63-3aaab8eb3af2
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Wed, 16 Oct 2019 23:39:59 GMT
/
www.zdnet.com/m3d0s1/xhr/horizontal/
14 KB
3 KB
XHR
General
Full URL
https://www.zdnet.com/m3d0s1/xhr/horizontal/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1824-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
66609bfd788742d91f308c26160fdb0233e99f457fcc0d73a81e38920bd1945b
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
1697
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 16 Oct 2019 23:39:59 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
192a5276-755a-4e50-b45a-4055129f379f
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Wed, 16 Oct 2019 23:39:59 GMT
/
www.zdnet.com/components/tr-promo-asset/xhr/
2 KB
2 KB
XHR
General
Full URL
https://www.zdnet.com/components/tr-promo-asset/xhr/?topic=0
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1824-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e3fc7b1888e27c5c730f715e45bccf35a7b2365cef3e203e1ff840d2fe668cfb
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
623
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 16 Oct 2019 23:23:33 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 16 Oct 2019 23:39:59 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
c02aa7e5-32d6-4b51-8ecb-404cdca084b3
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Thu, 17 Oct 2019 00:53:33 GMT
load-more-1.0.js
zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/
8 KB
3 KB
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/load-more-1.0.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1824-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
106356
status
200
vary
Accept-Encoding
content-length
2472
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:31:01 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da4bee5-1f51"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 22 Oct 2019 18:07:22 GMT
trp-promo-thumb.jpg
zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/core/
4 KB
4 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/core/trp-promo-thumb.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
41e1b82b530a565f139da63948d96402471dadea6e3e912578cc2de4426bbe41
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1788822
status
200
vary
Accept-Encoding
content-length
3552
x-xss-protection
1; mode=block
last-modified
Wed, 25 Sep 2019 14:07:41 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d8b74ad-f53"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 03 Oct 2019 06:46:06 GMT
vglnk.js
cdn.viglink.com/api/
78 KB
27 KB
Script
General
Full URL
https://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a10d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:59 GMT
content-encoding
gzip
cf-cache-status
HIT
age
188667
cf-ray
526de0114ba3cbb4-VIE
status
200
content-length
27719
x-amz-id-2
HNEV4caKoOdziBrXGZIDp4CzG6boiBMb4TLu65nU6otYm4+p2OQwr1vWix1CX0FBodMy916W6w4=
last-modified
Mon, 16 Sep 2019 19:15:01 GMT
server
cloudflare
etag
"1545d811432c0074356408ee8f6c1e23"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
FB54A2C70C0BB866
cache-control
public, max-age=1800
accept-ranges
bytes
content-type
text/javascript
expires
Thu, 17 Oct 2019 00:09:59 GMT
0.6295340296062926
saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/
43 B
209 B
Image
General
Full URL
https://saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/0.6295340296062926?AQB=1&ce=UTF%2D8&events=event66&v0=ftag_cd:LGN22ef1e6&v2=en&v3=desktop&v4=horizontal&v5=zdnet&v10=article&v20=cyberbit+discovers+international+airport+riddled+with+bitcoin-mining+malware&v22=content_article&v23=&v24=463420f8-d49a-4522-9502-39fc1d0f882c&v30=28d0a422-cfea-4d23-bae1-2b6eaf0a254f&v60=3684265,33165454,177510,33055835&v64=2150&v69=&c0=D%3Dv0&c2=D%3Dv2&c3=D%3Dv3&c4=D%3Dv4&c5=D%3Dv5&c10=D%3Dv10&c20=D%3Dv20&c22=D%3Dv22&c23=D%3Dv23&c24=D%3Dv24&c30=D%3Dv30&c60=D%3Dv60&c64=D%3Dv64&c69=D%3Dv69&pe=lnk_o&pev2=medusa_impression&vid=201910163-leadgen-zdnet&mid=90240133173074011141898988208131324462&aid=2D535D450507F28B-40000106A0001145&AQE=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.188.31.119 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-15-188-31-119.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:59 GMT
x-content-type-options
nosniff
x-c
master-1047.I1d1c81.M0-302
p3p
CP="This is not a P3P policy"
status
200
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Thu, 17 Oct 2019 23:39:59 GMT
server
jag
xserver
anedge-95484cfc6-v29h5
etag
3374274911543853056-4613667660508837469
vary
*
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Tue, 15 Oct 2019 23:39:59 GMT
e.gif
dw.cbsi.com/levt/ria/
43 B
369 B
Image
General
Full URL
https://dw.cbsi.com/levt/ria/e.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=28d0a422-cfea-4d23-bae1-2b6eaf0a254f&assettitle=cyberbit%20discovers%20international%20airport%20riddled%20with%20bitcoin-mining%20malware&assettype=content_article&pubdate=2019-10-16%2022%3A54%3A13&viewguid=463420f8-d49a-4522-9502-39fc1d0f882c&devicetype=desktop&sitetype=responsive%20web&author=tom%20foremski&authorid=a2cf5ea4-8175-11e2-9d12-0018fe8a00b0&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&s8=cnetzdnetglobalsite&v23=cnetzdnetglobalsite&v19=article&v17=113c25b6-ec91-11e3-95d2-02911863765e&v20=28d0a422-cfea-4d23-bae1-2b6eaf0a254f&v16=463420f8-d49a-4522-9502-39fc1d0f882c&riaevent=impression&comptyp=spot&mapp=medusa_app&objtyp=medusa&eventt=log&v18=security&comp=ucwc&ts=1571269199560&tcset=utf8&im=dsjs&title=Cyberbit%20discovers%20international%20airport%20riddled%20with%20Bitcoin-mining%20malware%20%7C%20ZDNet&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:59 GMT
Server
Apache/2.4.25
Vary
*
Content-Type
image/gif
Cache-Control
no-cache, must-revalidate, no-transform
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=80, max=839
Content-Length
43
Expires
Fri, 23 Jan 1970 12:12:12 GMT
json
trc.taboola.com/cbsinteractive-zdnet/trc/3/
7 KB
4 KB
Script
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/trc/3/json?tim=01%3A39%3A59.722&lti=deflated&data=%7B%22id%22%3A439%2C%22ii%22%3A%22%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22vi%22%3A1571269190052%2C%22cv%22%3A%2220191016-8-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22cmps%22%3A3%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1585%2C%22dh%22%3A8429%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A4%2C%22uim%22%3A%22thumbnails-a%3Aabp%3D0%22%2C%22uip%22%3A%22ZDNETfront_doorDesktop%2FTablet-Bottom%20Page%20Thumbnails%22%2C%22orig_uip%22%3A%22ZDNETfront_doorDesktop%2FTablet-Bottom%20Page%20Thumbnails%22%2C%22cd%22%3A7547.125%2C%22mw%22%3A770%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_2%22%2C%22lt%22%3A%22deflated%22%7D
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191016-8-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
19742aee7a6e5fe6d32a6ab59fef4d8ecb17a20d8bafdec6937538dc65b15b1d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:59 GMT
content-encoding
gzip
server
nginx
x-timer
S1571269200.726556,VS0,VE98
status
200
x-served-by
cache-fra19139-FRA
vary
Accept-Encoding
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
access-control-allow-credentials
true
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
via
1.1 varnish
x-cache-hits
0
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1571269189666&de=684457879453&cu=1571269189666&m=10063&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=8429&le=1&lf=81&lg=1&lh=53&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=10057&an=5000&gi=1&gf=10057&gg=5000&ix=10057&ic=10057&ez=1&ck=1150&kw=952&aj=1&pg=100&pf=100&ib=1&cc=1&bw=10057&bx=5000&ci=1150&jz=952&dj=1&aa=1&ad=9913&cn=4856&gn=1&gk=9913&gl=4856&ik=9913&co=1006&cp=952&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=9831&cd=4803&ah=9831&am=4803&rf=0&re=1&ft=4958&fv=4856&fw=1006&wb=2&cl=0&at=0&d=4797955119%3A2608978925%3A5192378298%3A138290277353&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=300x250&zMoatPS=top&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=463420f8-d49a-4522-9502-39fc1d0f882c&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fcyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware&zMoatDev=Desktop&zMoatSlotId=mpu-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-plus-top-5da7a047e2cdc&hv=CBS%20Attribute&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1332258245&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 23:39:59 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 23:39:59 GMT
available
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
276 B
XHR
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/available?route=AM%3AAM%3AV&lti=deflated
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191016-8-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 23:39:59 GMT
via
1.1 varnish
server
nginx
x-timer
S1571269200.863403,VS0,VE9
x-served-by
cache-fra19139-FRA
status
204
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
content-type
image/gif
x-cache-hits
0
1a1ac15271660f3d945b4904ef437371.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
5 KB
6 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1a1ac15271660f3d945b4904ef437371.jpg
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191016-8-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
2f179c0918ddb8af28b17040e1822625ffa2635a08e4fa98521d0a95dc9a554b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:59 GMT
via
1.1 varnish, 1.1 varnish
age
950250
edge-cache-tag
616089906201828448420340560109273106143,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Wed, 16 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1a1ac15271660f3d945b4904ef437371.jpg
content-length
5431
x-served-by
cache-fra19142-FRA, cache-fra19139-FRA
last-modified
Sun, 15 Sep 2019 13:12:03 GMT
server
cloudinary
x-timer
S1571269200.866089,VS0,VE0
etag
"033e210ecc99607a94af83829efcf625"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 10
6fb8416b363c8dc8867876859d95e714.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
22 KB
22 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/6fb8416b363c8dc8867876859d95e714.jpg
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191016-8-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
3086f9d9c136567afd2329681740df73662a2630beeac697695c5f84c89cfcf1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:59 GMT
via
1.1 varnish, 1.1 varnish
age
1187441
edge-cache-tag
355624323117692569059618948474045935360,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sat, 26 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/6fb8416b363c8dc8867876859d95e714.jpg
content-length
22358
x-served-by
cache-iad2144-IAD, cache-fra19139-FRA
last-modified
Wed, 25 Sep 2019 09:21:35 GMT
server
cloudinary
x-timer
S1571269200.866244,VS0,VE0
etag
"ae42beacabc3743abe987c43304efa74"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 4
6b5398ed435cd68b93af163afb9d5d4a.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
16 KB
17 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/6b5398ed435cd68b93af163afb9d5d4a.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
06358c575122bf806a3c153f5e0a7ff58b74fbe89f92f50a878074807469153e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:59 GMT
via
1.1 varnish, 1.1 varnish
age
2140229
edge-cache-tag
621128875091461120968739223005804308353,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Mon, 21 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/6b5398ed435cd68b93af163afb9d5d4a.jpg
content-length
16877
x-served-by
cache-fra19128-FRA, cache-fra19139-FRA
last-modified
Fri, 20 Sep 2019 05:25:52 GMT
server
cloudinary
x-timer
S1571269200.866618,VS0,VE1
etag
"ff50bdfa496f59086787617014ba4ace"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 1
ade884edba3047506d3f23011821f040.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
7 KB
8 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ade884edba3047506d3f23011821f040.png
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191016-8-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
1f181fa4df39fdf7461203d84d56a132780ec04c417ef226f11dbb4c25dbfb93

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:59 GMT
via
1.1 varnish, 1.1 varnish
age
2499141
edge-cache-tag
421663935176379570917553637215074505719,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sat, 21 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ade884edba3047506d3f23011821f040.png
content-length
7297
x-served-by
cache-fra19157-FRA, cache-fra19139-FRA
last-modified
Wed, 21 Aug 2019 02:50:12 GMT
server
cloudinary
x-timer
S1571269200.866782,VS0,VE0
etag
"be764ef12f992d5b012965ec6b005427"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 3
1a1ac15271660f3d945b4904ef437371.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
5 KB
6 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1a1ac15271660f3d945b4904ef437371.jpg
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
2f179c0918ddb8af28b17040e1822625ffa2635a08e4fa98521d0a95dc9a554b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:59 GMT
via
1.1 varnish, 1.1 varnish
age
950250
edge-cache-tag
616089906201828448420340560109273106143,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Wed, 16 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1a1ac15271660f3d945b4904ef437371.jpg
content-length
5431
x-served-by
cache-fra19142-FRA, cache-fra19139-FRA
last-modified
Sun, 15 Sep 2019 13:12:03 GMT
server
cloudinary
x-timer
S1571269200.882840,VS0,VE0
etag
"033e210ecc99607a94af83829efcf625"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 11
6fb8416b363c8dc8867876859d95e714.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
22 KB
22 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/6fb8416b363c8dc8867876859d95e714.jpg
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
3086f9d9c136567afd2329681740df73662a2630beeac697695c5f84c89cfcf1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:59 GMT
via
1.1 varnish, 1.1 varnish
age
1187441
edge-cache-tag
355624323117692569059618948474045935360,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sat, 26 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/6fb8416b363c8dc8867876859d95e714.jpg
content-length
22358
x-served-by
cache-iad2144-IAD, cache-fra19139-FRA
last-modified
Wed, 25 Sep 2019 09:21:35 GMT
server
cloudinary
x-timer
S1571269200.883206,VS0,VE0
etag
"ae42beacabc3743abe987c43304efa74"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 5
6b5398ed435cd68b93af163afb9d5d4a.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
16 KB
17 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/6b5398ed435cd68b93af163afb9d5d4a.jpg
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
06358c575122bf806a3c153f5e0a7ff58b74fbe89f92f50a878074807469153e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:59 GMT
via
1.1 varnish, 1.1 varnish
age
2140229
edge-cache-tag
621128875091461120968739223005804308353,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Mon, 21 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/6b5398ed435cd68b93af163afb9d5d4a.jpg
content-length
16877
x-served-by
cache-fra19128-FRA, cache-fra19139-FRA
last-modified
Fri, 20 Sep 2019 05:25:52 GMT
server
cloudinary
x-timer
S1571269200.883224,VS0,VE0
etag
"ff50bdfa496f59086787617014ba4ace"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 2
ade884edba3047506d3f23011821f040.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
7 KB
8 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ade884edba3047506d3f23011821f040.png
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
1f181fa4df39fdf7461203d84d56a132780ec04c417ef226f11dbb4c25dbfb93

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 23:39:59 GMT
via
1.1 varnish, 1.1 varnish
age
2499141
edge-cache-tag
421663935176379570917553637215074505719,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sat, 21 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ade884edba3047506d3f23011821f040.png
content-length
7297
x-served-by
cache-fra19157-FRA, cache-fra19139-FRA
last-modified
Wed, 21 Aug 2019 02:50:12 GMT
server
cloudinary
x-timer
S1571269200.883250,VS0,VE0
etag
"be764ef12f992d5b012965ec6b005427"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 4

Verdicts & Comments Add Verdict or Comment

322 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| soastaTracking object| ZdnetPageVars object| ZdnetFunctions boolean| gdprConsent object| evidon object| _sf_async_config number| _sf_startpt object| _cbq object| knownServiceWorkers object| cbsiGptDivIds function| UUIDv4 string| __tealium_data_guid object| utag_data function| requirejs function| require function| define number| BOOMR_lstart object| _sp_ function| $ function| jQuery object| headertag object| googletag function| headertag_render object| pbjs object| BOOMR object| BOOMR_mq object| ggeac object| closure_memoize_cache_ object| googleToken object| googleIMState object| google_js_reporting_queue function| processGoogleToken object| __core-js_shared__ function| setImmediate function| clearImmediate function| UUIDv1 function| clamp object| STR undefined| UUID object| Audit function| renderAdCallback function| blankAdCallback object| jQuery1830019769033214110054 number| google_srt undefined| google_measure_js_timing object| utag_err boolean| utag_condload function| getCookieValue object| isInternal object| js object| s object| adData string| adCookieName undefined| adCookieData undefined| adRegion function| parseJson object| match object| utag function| runInternalUserFuncs function| cbsiInternal function| _tealium_old_error boolean| isEuUser object| vglnk object| omnitureMgr object| dwMgr object| om number| BOOMR_configt object| _ml object| _bmrEvents function| lightboxjs function| lightboxlib object| EF function| dw_callback function| AppMeasurement_Module_AudienceManagement function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq function| doSiteCatalystTag object| headID object| newScript object| s_c_il number| s_c_in function| Visitor object| visitor function| DIL number| s_objectID number| s_giq object| __ql string| path string| host object| scriptTags boolean| __v5k function| vl_cB function| vl_disable function| vglnk_15712691880426 object| DIGIOH_API object| LIGHTBOX_API undefined| easyXDM object| AudEng object| URS object| Modernizr function| Waypoint number| _sf_endpt object| debug string| firstpgvar object| CryptoJS object| mPulseApp object| _cb_shared object| pSUPERFLY_mab object| pSUPERFLY undefined| _ function| Hls undefined| uuid function| addResizeListener function| removeResizeListener object| cvui object| uvpjs function| Class object| mpulseUserTiming object| TRUE_ANTHEM object| DW function| dw_anonc object| DW_anonc object| optimizely string| f0 object| omMgr undefined| vglnk_15712691885437 object| s_i_cnetzdnetglobalsite undefined| vglnk_15712691887059 number| BOOMR_onload string| adBlockCookieValue object| $tealium boolean| google_noFetch number| __google_ad_urls_id object| ret boolean| searchOpen object| $lastFocusedInput string| pageType string| waypointContextKey function| udm_ function| ns_order object| ns_ object| ns_p string| ZN_3xeBFJDuSs0SRW5_ed string| ZN_3xeBFJDuSs0SRW5_sampleRate string| ZN_3xeBFJDuSs0SRW5_url function| fbq function| _fbq object| UA undefined| jQuery17109358820109853059_1571269188111 number| google_unique_id object| google_reactive_ads_global_state object| gaGlobal object| TRC object| _tblConsole object| _taboola object| _comscore undefined| msg string| pm_pgtp number| _rnd string| __prot object| __i string| disqus_shortname object| trx object| QSI object| COMSCORE function| __trcCopyProps function| __trcFromError function| __trcClientTimestamp function| __trcLog function| __trcError function| __trcDebug function| __trcInfo function| __trcWarn function| __trcDOMWalker function| __trcPurgeEventHandlers function| __trcJSONify function| __trcUnJSONify function| __trcGetMargins function| __trcAttachResize function| __trcDetachResize function| __trcTrim function| __trcGetElementsByClass function| __trcToArray function| __trcObjectCreate function| PageManager function| addHashParam object| params number| trc_debug_level string| trc_article_id string| trc_item_url object| TRCImpl function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter string| pm_ppy string| pm_geo string| _pmep string| _pmep_geo string| _pmpmk boolean| _pmasync boolean| _pmoptimization boolean| _pmoptimizationmanipulation boolean| _pmhp boolean| _pmsb function| _pmloadfile object| bbVer object| pmk object| pmglb object| pmfa object| pmad object| pmdebug_c object| _pmenv undefined| _tb_d undefined| _tb_rand function| getBBVersion function| _tb_getUrlParameter object| _pm_mcm function| pmws_request_done object| _tb_ext_xp object| _pmk function| TBWidgetStorage function| TBWidgetPersonalization function| TBWidgetWhatsApp function| TBWidgetGawkerComments function| TBWidgetGawkerPersonalization function| TBWidgetWeatherStories function| TBWidgetFBCommentPersonalization function| TBWidgetDisqusPersonalization function| TBWidgetFacebookComments function| TBWidgetCommentButton function| TBWidgetMsnTsb function| TBClickToPlayVideo function| TBClickToPlayVideoElem function| TBWidgetVideoPlayer function| TBGenericVideoModule function| TBOtherPlayer function| TBVideoMetaData function| TBKalturaPlayer function| TBBrightcovePlayer function| TBOoYalaPlayer function| TBMSNPlayer function| TBWidgetMsnTsbPersonalization function| TBVideoCarousel function| TBVideoRightRail function| TBWidgetVideoPersonalization function| TBWidgetFPORunner function| PMTargeting function| PMTracking function| PMUniversalGA function| PMMdotLabs function| PMComScore function| PMPublisher function| TBOptimization function| TBWidgetFacebook function| TBWidgetTwitter function| TBWidgetAddThis function| TBWidgetShareThis function| TBWidgetDisqus function| TBWidgetGigya function| TBWidgetReddit function| TBWidgetPinterest function| TBWidgetSC function| TBWidgetSTPPersonalization function| TBWidgetSCPersonalization function| _comcast_fn function| PMRetry function| PMGlobal function| PMIdentifier function| pmws_getlocation_done object| pmdebug object| pmws object| xq string| GoogleAnalyticsObject function| ga object| _pm_mcg object| tbopt function| PMAd function| openx_ad_request_done function| pm_image_onload_done object| google_tag_data object| gaplugins object| gaData undefined| vglnk_157126918942110 object| __google_ad_urls object| ampInaboxIframes object| ampInaboxPendingMessages boolean| google_osd_loaded boolean| google_onload_fired object| __AMP_LOG object| __AMP_ERRORS boolean| ampInaboxInitialized object| __AMP_MODE function| __AMP_REPORT_ERROR object| ampInaboxPositionObserver object| ampInaboxFrameOverlayManager object| AMP function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| Moat#G26 boolean| Moat#EVA object| MoatSuperV26 object| MoatDataJsonpRequest object| google_jobrunner object| google_ad_modifications number| google_global_correlator object| google_prev_clients number| taboola_view_id object| jQuery17109358820109853059 object| Adform boolean| __adform_onload function| ADFReload function| ADFCall function| ADFcall undefined| vglnk_157126919040111 object| DISQUSWIDGETS undefined| disqus_domain string| $time object| o

43 Cookies

Domain/Path Name / Value
.demdex.net/ Name: demdex
Value: 00120815331763341403966649282315108448
.lightboxcdn.com/ Name: a1583f50-579b-41d0-8c4e-1cd1790d945c
Value: N4Ig-mBGAeDGCuAnRIBcwC-AacVoAdEBTANzUxwhlKIDsAXAZ3O1xlgEsATNEAZlgAGAGwBGAKwAOACwBaAJyRI42dNEBDUbMii-fWevXTJfSeL4B2LkWGyJF0QCZh80ZMnzh4kBiA__
.zdnet.com/ Name: _gat__pm_ga
Value: 1
.lightboxcdn.com/ Name: __bxtest
Value: IYIwxgHgngXkA___
.zdnet.com/ Name: _gid
Value: GA1.2.1144629424.1571269189
.zdnet.com/ Name: _ga
Value: GA1.2.301950735.1571269189
www.zdnet.com/ Name: _tb_t_ppg
Value: https%3A//www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/%23ftag%3DRSSbaffb68%7C
www.zdnet.com/ Name: _tb_sess_r
Value:
.zdnet.com/ Name: adblock_status
Value: not_adblocking
.zdnet.com/ Name: ak_bmsc
Value: D108CE8429D5FD7468A0E65F48E67AF10210BA848E1A000045AAA75D0B6BCF5D~plkoc34dGPMunIxTuMsS30iDEB9Utn3w8ZuYvizTSJ/S8CzyDQAVjh7Arf0D0kzVz4uEZqDTyCi6KRf6BrzS6I3kyqlvLr1XiYxGVMQY14C6Df0cupPBLLIdhl0NPljIIwm+Ktj7eerIuVy8633oJmItWaj7TXHeZ3hsfLSqZsD8CiT/twMciBkugj/5DzTzVvQ5ykIIcoqTGHR3EsPu4poBcQ+GJSAAuWpVNCG0jg9fA=
.zdnet.com/ Name: RT
Value: "sl=1&ss=1571269186961&tt=1919&obo=0&bcn=%2F%2F686eb704.akstat.io%2F&sh=1571269188883%3D1%3A0%3A1919&dm=zdnet.com&si=8743ee20-1e3e-4044-b5a9-f65c9fed896d&ld=1571269188883"
.zdnet.com/ Name: utag_main
Value: v_id:016dd6f1197e0013470557437a9f00079007c07100b08$_sn:1$_ss:0$_st:1571270988869$ses_id:1571269187967%3Bexp-session$_pn:1%3Bexp-session$linktag:undefined%3Bexp-session
.zdnet.com/ Name: s_cc
Value: true
.demdex.net/ Name: dextp
Value: 269-1-1571269188676|477-1-1571269188777|771-1-1571269188877|22052-1-1571269188978|30646-1-1571269189079|121998-1-1571269189180
www.zdnet.com/ Name: viewGuid
Value: 463420f8-d49a-4522-9502-39fc1d0f882c
.zdnet.com/ Name: AMCVS_10D31225525FF5790A490D4D%40AdobeOrg
Value: 1
.zdnet.com/ Name: s_invisit
Value: true
.zdnet.com/ Name: aam_uuid
Value: 00120815331763341403966649282315108448
.zdnet.com/ Name: s_lv_zdnet_s
Value: First%20Visit
www.zdnet.com/ Name: _cb_svref
Value: null
.zdnet.com/ Name: upid_534571976
Value: 1
www.zdnet.com/ Name: LDCLGFbrowser
Value: 60cce569-6e45-4d3d-8a53-82fe282cef2d
.zdnet.com/ Name: s_vnum
Value: 1573861188508%26vn%3D1
.zdnet.com/ Name: first_page_today
Value: false
www.zdnet.com/ Name: _chartbeat2
Value: .1571269188222.1571269188222.1.DvwFL-BTlf6CVPgzEWp_KzCy5vqW.1
.zdnet.com/ Name: _fbp
Value: fb.1.1571269189101.680434797
www.zdnet.com/ Name: _cb_ls
Value: 1
.zdnet.com/ Name: zdnet_ad
Value: %7B%22type%22%3A%22gpt%22%2C%22region%22%3A%22uk%22%2C%22session%22%3A%22g%22%2C%22subSession%22%3A%225%22%7D
www.zdnet.com/ Name: XCLGFbrowser
Value: Z1Z/hF2nqkTNkiKAXp8
.zdnet.com/ Name: nemo_highlander-sharebar
Value: sharebar%3a1%3aexclude
.zdnet.com/ Name: fly_geo
Value: {"countryCode": "de"}
www.zdnet.com/ Name: _ccmaid
Value: 3605384201481224220
.zdnet.com/ Name: s_getNewRepeat
Value: 1571269188509-New
.zdnet.com/ Name: AMCV_10D31225525FF5790A490D4D%40AdobeOrg
Value: -894706358%7CMCMID%7C00352975121889695403989015476005537048%7CMCAAMLH-1571873988%7C6%7CMCAAMB-1571873988%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1571276388s%7CNONE%7CMCAID%7C2ED3D5227FFF8000-40143FF1A05629F0%7CvVersion%7C2.3.0
.zdnet.com/ Name: fly_default_edition
Value: eu
www.zdnet.com/ Name: _cb
Value: CBsVclBNMQ75Cj1H29
.zdnet.com/ Name: fly_device
Value: desktop
.zdnet.com/ Name: s_lv_zdnet
Value: 1571269188509
www.zdnet.com/ Name: _ccmsi
Value: 1571269188161_5qeqbv4gn|1571269188161
.zdnet.com/ Name: fly_preferred_edition
Value: eu
.lightboxcdn.com/ Name: __cfduid
Value: d540e67ed172818f6b66ea8c726d47c961571269188
.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware Name: CBS_INTERNAL
Value: 0
www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware Name: zdnet_ad_ftag
Value: RSSbaffb68%7C

60 Console Messages

Source Level URL
Text
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service pending (GDPR consent not granted): script_indexexchange
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service pending (GDPR consent not granted): script_mpulse
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service pending (GDPR consent not granted): script_sourcepoint
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service pending (GDPR consent not granted): script_gpt
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 792)
Message:
ADS: queuing nav-ad-5da7a047e2cdc for display
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 1262)
Message:
ADS: queuing intromercial-5da7a047e2cdc for display
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 1331)
Message:
ADS: queuing leader-plus-top-5da7a047e2cdc for display
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 1459)
Message:
ADS: queuing inpage-video-top-5da7a047e2cdc for display
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 1469)
Message:
ADS: queuing sharethrough-top-5da7a047e2cdc for display
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 1592)
Message:
ADS: queuing mpu-plus-top-5da7a047e2cdc for display
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 1696)
Message:
ADS: queuing dynamic-showcase-top-5da7a047e2cdc for display
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 1703)
Message:
ADS: queuing mpu-middle-5da7a047e2cdc for display
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 1958)
Message:
ADS: queuing mpu-bottom-5da7a047e2cdc for display
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 1975)
Message:
ADS: queuing leader-plus-bottom-5da7a047e2cdc for display
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service pending (GDPR consent not granted): script_sharethrough
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
GDPR consent granted
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent finally granted): script_indexexchange
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent finally granted): script_mpulse
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent finally granted): script_sourcepoint
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent finally granted): script_gpt
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent finally granted): script_sharethrough
console-api log URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js(Line 357)
Message:
Evidon -- evidon-notice-link not found on page, cant display the consent link.
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 9)
Message:
Missing adCookieData!
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_mpulse
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): _injectQueryStringGCP
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_chartbeat
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_ad
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804(Line 177)
Message:
Service: sitecatalyst
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_sharebar
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_sharebar
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_taboola
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_async_load
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_urban_airship
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_disqus_count
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_disqus_count
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet
console-api log (Line 61)
Message:
blank creative loaded: 138239360957 (7 x 7, pos=nav)
console-api log (Line 17)
Message:
GIF/JPG: 138290277353 (300 x 250)
console-api log (Line 61)
Message:
blank creative loaded: 138239344157 (11 x 11, pos=top)
console-api log (Line 61)
Message:
blank creative loaded: 138239368367 (641 x 321, pos=top)
console-api info URL: https://cdn.ampproject.org/rtv/011909241711100/amp4ads-v0.js(Line 527)
Message:
Powered by AMP ⚡ HTML – Version 1909241711100 https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 164)
Message:
Dynamic Showcase Center container ::: creative id = 138247024569
console-api log (Line 61)
Message:
blank creative loaded: 138239479696 (372 x 142, pos=)
console-api log (Line 61)
Message:
blank creative loaded: 138239468731 (372 x 142, pos=)
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_taboola
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_async_load
console-api log URL: https://www.zdnet.com/article/cyberbit-discovers-international-airport-riddled-with-bitcoin-mining-malware/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

686eb704.akstat.io
ad.doubleclick.net
ad.yieldmanager.com
ads.rubiconproject.com
adservice.google.com
adservice.google.de
api.viglink.com
api1.lightboxcdn.com
as-sec.casalemedia.com
beacon-eu2.rubiconproject.com
beacon.tru.am
c.evidon.com
c.go-mpulse.net
cbsdfp5832910442.s.moatpixel.com
cbsi.demdex.net
cdn-magiclinks.trackonomics.net
cdn.ampproject.org
cdn.jsdelivr.net
cdn.taboola.com
cdn.viglink.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
dpm.demdex.net
dw.cbsi.com
eus.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
geo.moatads.com
googleads.g.doubleclick.net
idsync.rlcdn.com
iicbsi-a.akamaihd.net
images.taboola.com
in.ml314.com
js-sec.indexww.com
l.betrad.com
lightboxapi1.azurewebsites.net
match.adsrvr.org
ml314.com
native.sharethrough.com
optimized-by.rubiconproject.com
pagead2.googlesyndication.com
ping.chartbeat.net
pixel.everesttech.net
pixel.mathtag.com
ps.eyeota.net
px.moatads.com
rev.cbsi.com
s.update.rubiconproject.com
s1.adform.net
saa.cbsi.com
sb.scorecardresearch.com
secure-us.imrworldwide.com
secure.adnxs.com
securepubads.g.doubleclick.net
static.chartbeat.com
sync.crwdcntrl.net
tags.bluekai.com
tags.tiqcdn.com
tpc.googlesyndication.com
track.adform.net
trc.taboola.com
tru.am
urs.zdnet.com
vidtech.cbsinteractive.com
web-sdk.urbanairship.com
widget.perfectmarket.com
www.everestjs.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagservices.com
www.lightboxcdn.com
www.summerhamster.com
www.zdnet.com
z.moatads.com
zdnet-1.disqus.com
zdnet1.cbsistatic.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
zdnet4.cbsistatic.com
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
104.109.78.125
104.17.208.240
13.224.196.40
15.188.31.119
151.101.12.134
151.101.13.181
151.101.14.133
151.101.14.2
152.199.23.241
172.217.16.162
172.217.18.162
172.217.23.162
18.195.251.148
184.31.90.90
2.18.233.143
2.18.233.201
2.18.234.21
2.18.235.40
2.19.38.84
2.19.43.224
216.58.205.230
23.32.243.235
23.45.108.200
23.67.136.71
23.99.128.52
2600:9000:200c:d400:18:1fcd:349:ca21
2600:9000:20eb:d800:1d:8c8c:47c0:93a1
2606:4700:20::6819:a222
2606:4700:20::6819:a322
2606:4700::6810:4ea5
2606:4700::6810:4fa5
2606:4700::6810:a10d
2a00:1288:110:c305::9000
2a00:1450:4001:800::2002
2a00:1450:4001:816::2003
2a00:1450:4001:81a::2003
2a00:1450:4001:81d::2002
2a00:1450:4001:81e::2001
2a00:1450:4001:81e::200a
2a00:1450:4001:820::2004
2a00:1450:4001:821::2002
2a00:1450:4001:824::2001
2a00:1450:4001:825::200e
2a02:26f0:6c00::210:ba12
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a04:4e42:3::444
2a04:4e42:3::621
3.225.45.120
34.193.242.172
34.205.11.82
34.251.154.165
34.251.227.160
35.157.160.140
35.177.62.3
35.190.38.167
35.190.72.21
35.227.208.151
37.157.4.41
37.157.5.73
37.252.172.250
52.212.172.70
52.30.105.51
52.31.175.110
52.49.44.242
52.51.104.248
64.30.230.22
66.117.28.68
66.117.28.86
69.173.144.142
69.173.144.152
99.80.15.126
03713e48481d844910efc220e469cdc55a73118915880ff5782b63937dedcc9d
042aa3b7f3ed24c885142293890e15da8988c020ba059266095fa6cb67cfd4d1
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
04a7a7de0c5c1593d1851c1c07fb072ef5eb167c96935a73cd6b7c74b25548cc
0629946fe142c676784daa479fe86526051bfa44bdeb5e3f4608fa22b8e153ae
06358c575122bf806a3c153f5e0a7ff58b74fbe89f92f50a878074807469153e
06b5e37405eb20ef6b93a33900acf3727c556133767f8ca396eaf2011ee6e21a
07178558c596bc2fe33d99750a349d5413fa4571fc778cefbe4f4f367404f6d6
08f1d9709c00dfe5e6969607255c40acaad2ed37cf0df70505f54182853f1ab9
09e9d28bdae69a0df75ad726e351543a6ec6a23bcf95e56971c388d828f06506
0b9028c7ecccf4f31fafcfca176cd6ed38197d7b3d6ea4c107b98af8eecc525b
0ccfac17392f8b1cf81dccfde9b89171db92f42c6d7ceeef294dac3e04f206df
0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017
0e2d486038ed4137fb69a8e69fa1bf8b43ce75792f45b7762cb0caf0fe83c72c
0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d
0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae
10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c
19742aee7a6e5fe6d32a6ab59fef4d8ecb17a20d8bafdec6937538dc65b15b1d
197c294e1520b32d787d2678660c02fd195c1c93fee3441de596ef22c34ed425
1a5c7c13fdda65e67781664a8350542028b989008d773b768ef5e2a695e6f276
1ad83ff2abdfe406a3b5e5c903c2a7f31b8993e4f2ff542b2bc49a8ab212827a
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9
1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1
1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53
1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b
1ef3b2018460f499847215358ad588852cdf72c969234ab0e2674eb9c5890737
1f181fa4df39fdf7461203d84d56a132780ec04c417ef226f11dbb4c25dbfb93
1f7311d5849534d0cbe2bfebb7740f327b9c99dc4ffb84ccef58cf4f9523cea0
24afd9816a9512461bcd633855ec499112a8392d95a3ce1e0cbed2b8ceaab773
24f7451ae040188b7b4fca25ef6ea8312f287d07a88d00fc9b1dabe327bed115
26d5f8b2eea728749535bb49cd51009762976f81e38b33df53254d7546d6b28b
27fd5e8a820292a54692372abbdfc1e4ad717bb09e0cf1dbfc10d165a35c4f83
2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff
2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab
2d3e9015bb665cc4e62a0aada26a74311bf87ba40e12b896724f447a98e68a89
2f179c0918ddb8af28b17040e1822625ffa2635a08e4fa98521d0a95dc9a554b
306b51051ebea8416357b56cdce1ec444b4e9c5892dd8001b9d921c48cf75818
3086f9d9c136567afd2329681740df73662a2630beeac697695c5f84c89cfcf1
309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6
30eb3b695efa6bafee22c83f473bac04cad5a1ce3b77ab8593ed70b29d6a1bb2
3147026ff99804131affcb3cadbdfd49c0a07583682aefcc1198f57e2614d5b0
3265971579bf8eb858aaad978c88df12c0c0525e9f4fafc6592ed3226b0fa6ab
32c2c694bf33100bf116d6a571e3c3be1e914fd47aec0d05051a5cb077b9fc9c
32eb2fea0269f7de785c491d3f5e9f5707e87055ecc21ae29f56e2dd92ef6e22
33e7cfb629c6fc28bec6f0039c2b843ac7d63cb54a883599ca33ce2384e251fa
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
348d4be6afe7f85e7a4ff9078bf986a08f093749008d312fccba7ac9637db002
35f3de772fc88b09b9f866de6d38f50d8716aecc446bb10456585f61834ae2c8
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
3624e97a6a4f6fb481369929e579039d00be03b0a2e5d1f5f961c44dfd98940c
37a8b06eab08134f2037c797f4596c7688dd564a8395cb7e072577f371d8f993
37f9d5b661c87dd04811525cb9364ffa350f9d63d0c860abd864ffb2bdc7504e
39b4cee6999629da4c3341a1c6c94d0c9b3e31c0805b530298793b32c1d2e30a
39f0e13a96fd029965b5b5fd3504853b6fe6ded07b4dd8862a0e033be626e655
3c4e5d9190758a17654ffba0d04c5a820ba6ed162cd10807e9ccdcb2c20662e6
3c9bb3631896aee1e930e140eb8fcbb4ad9cd9b96ec259b88b4b2fce0a55e805
3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22
409998ea7cd82b19af10cafff130e45dd95a8b4dc901123644639035d81d3e5d
40d2dae0209b964e6ceb2607faafc02bb3d6efa0d73f47a4ab2a17279f642b91
41e1b82b530a565f139da63948d96402471dadea6e3e912578cc2de4426bbe41
431ebbd4137063ecc5dfadb726e7f4f9b5eeafa66d015427b3e2972e270c4b2f
44ac654a5d74e0f55d383818e9fb4782ea064fdc7cac8e5a4bcb71a011cad952
45ef4c3baad7c9b59f54bbe6ac8f354d9949e0edcccbebc34e4efe8e672feff2
4a9174ab8670879484f0dc42afea0ccaa3803217a9700ef9e1fb8262aa68c651
4ba874fecf4fcd9d98e67588c06928ddf325578ddd193fa04f75433511ca5bf1
4bb0f33f40b38593e1cba1c8b2f15703d33753bbd80f30511dd9c464a959afe7
4c6270cff1039574ff4269d0333ad2630d80518dc66bf4b9fd9e06493e98d87f
4d565f67641c732365c3180ec1e37c7a987825faad3e8632de8a07a9101feedd
4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13
53b5d7825dc08f9b395c39b5c05f5b2440b898b4617111d59a94aa5e4e26c8a4
54b4196e11ec4792c458b7740634a09c7656a5bc2bb289f857e1ac1fed39da46
55799d8028d831643ba65704f93b5935686ff8307f27c47228496f9fcbff6a5c
5631feb1992736b1885154e51c30038287f589edce52a2b64a073d270ce8c025
5680dab22eb8f0902c5f26cca262a05c56a412340304615a0f4150e5d9bd4298
57e1e8e64fe95a0acc0822d690633b9450b26919fcedc32958ebcf7d39393181
59ebf5f578080d20d13aae7180df577d3fbee37f18d1d791b692c40ac919236f
5e68830dc559aaaff190a56ff90d4b57ced977c79c9e177109bbb913b4443e0f
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3
5ecc6a93ec2939faa8dbf80084346c7d940f5a2181ee69343810da52902eb92d
63def73233b7444bbddf916536d934c84b6c56b3e5704a1c42940243eea31576
64cfd2a647408273e2609b638b29d1f10370824f0169ee4db637edac660dfb66
66609bfd788742d91f308c26160fdb0233e99f457fcc0d73a81e38920bd1945b
66ef1b7581d8ef7b82bfe2ca363a612a479d89b808e2241f68d3e8c75f4f06d4
682499050894dd63171c826837903d1e3f19ef897b51e51979635d7e8b7904d8
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
6b58782f772eaeb73d36b47159ed802f146182cf5d8fe4cfd838e6e629e6bd1a
6d157866400e2e50e077448f9cf06a9f29f70e031612ad6679d3626909a4c4e5
6de73873dd441f953668e77030299f082e0f3e6335bf944d88d44978162e6609
763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313
78f602a77cadacf7f6825a039e9e0e8901e42ea5c674837351ce82d5f58b7dea
791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac
7b19a58671987586f4e0e0dba3f1ee7b040cdb52ae402789a977ed0402bbece7
7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082
7e7a2884ae62c3de9ca6d0b099456bf815e32764f12eaf66ad09a728fb389395
7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8
7ed632d778129f27ac2cc7499ce3accb5eec4c08d95154ca65e1325cb26201bd
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8208aba4a966a8881e913a09da3224fdf2d13bd4db81cabbb11373e76bb18ab1
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
851bb3ccde04ff1534b092c1963f531370779481ed36b3dab692cc98a299c430
87895fd04b827870be986cdc2be363c503a6b7eca1ab786a789b471b3652b6c7
885fb8b9c3d2738bd627def3899f26d4d42641bbb868cc99d1fbc16f0ed9f4c6
8998e68f9bb1686ca1e03fcf3f0d6ea669c32d1f3554aeea809f1b1824ff6625
89ab6386d6c3daa4576d9a7b4ec1d18bb80004f57d69d9290a2a6c77ca2e6ec0
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8ae4e392521897a8b9f08d3af545ddfde937f7ed60c8ef860f637baa6280e970
8b03b46424d2e66f1d79c0e0a6e7a284c103c937fa4efba31fadb89eaedeef36
9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b
95ec4dea002be118a633dc5070c23358d10e179ad3de44f23ac97578c6971df7
95effe867db89e11e734c3042e1a4463222db03972c75c257906b83b1ad6f847
98eb2463be19049566aa96149eafffe28130fcdf38a3df7274dd77bd4741471a
992e73adb3e1f6f91021aec811784c5c06708c938bc3843583f56ea3fac5c1a2
99fd27cd410417b5633d3fc37196751afc4b3f9ffa5853dedb73cfcb3e810d7c
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
9c6af299685617864c257472040f437ef951afec994720a24781931cc3527017
9da65a11eb20988f4e0e7d0d31f2ed47e2fcf6a80b38abf33fb71ae3fa0e8776
9db8bd3e641dc88d54edf476a148e75e29b4e8ccd040cb340404d557578dcfbd
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a4e826cd575126b72bc4e8ee65a10d69136d4d70dacb39d1d852407c51cfda14
a6d7c4beeaf8bda515ef93af343a3b2e950cd6deb797fc9989c222e775ae8dcf
a7343f033fb47a3ea727b24c745fb107b51caae3490bc38d0da831f4a91d0949
ad7ed17bf4c8d9dd2511e7254670822d0f90c8fb89187f860cfbcb91821abc84
ade36abde8e9d7490a53be5bdb0e7f91e1e7d3e73d51f307342a3a5aed21ec9b
af555826a22f2633fbf3d4bae51859965a38a16f7869aeab49a30a008044dc43
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b
b2ab8784d5ca4bc5e4e1990ba55c6d9f041b8fe8cf41ad9afa37bc1c3dd12756
b4bd1eef3a1c0a2375f4dee3471baf1369289cbbecce839600e3f74dbfcb8b25
b574b50087aa11d4270c0fd5f62fe1d0051cc3e68a63982e318553f759add31d
b5b4495171988d7e52c138e391c7beb196ee9fd1ed6d416467e59a88d197fdd2
b801741390d0087dafca6ddd145ead69628e42ed4e3a4e0a662c96bac969e6fe
b8c15c61feffdfe68b168cf2ac8cf58867f38547da3b15d7971a75c44f16bc26
b9d6fddb0988440902fcfc72f371ecfa80ee2eb36073f9eebc17449ee41c886f
be4496637183dcca24f933007088e2b7334d431bab5996611d62228f5a04bfed
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
c2ba172469f43f4565ea115e1a6393a6bdb5574cf866b3a5b96ec091af4b64b6
c42f6df0eebb3d51bb3fc43ec77055bc09cdf808d26db3b5d75ccf65868b9cb2
c5e15cb93124bb13cf2285e749dd3c269bea0b8d633f64acdebf84c2eb8eafb9
caab9bbec165591d5214448b624dae44a3cbc575721ba71da2f7130bbbcbc6dc
cad94e550873129e54995a8a38cc720a5e14eb9d7a4fccaf4dcad20798f71a25
cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41
d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c
d603253cfb5d658c9f70b949fa0fee7e2cf73a522b0758ee6e32a55084bd388a
d696da403b0169c2191d0ec0b0fcdaa85487b21b19fd58f4b1fb5b9edf40b153
d6a75907d2f5e09455d3cdd4197c508ef0d05ab6a77c6eac4fdebdbaf900bfd4
d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e
d701acedff5a52204a1033ddcb13ee4cfa9d03777fc0d71ef94eaab9f954daea
d98e77e558ef5c298f4c28cdd1604914a16a3fcc9249904ba70c57d989fb6aab
da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016
dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dc238e5fe87b2bde85465a623dce5fa2282f496737c5aebd2a1c64a83ab18d3a
dc7b283c3bf79da4c932fe5c404d5d582873ef3c753143e81ffce2d98029a6c9
dd787044f07fb551657e198707ea27bfddcf6cf53bd6e8bf5efd6322a5273cba
ddbc8cbe77dd350d4623eab321a0edb90d3f79605c50acb1dd6cce1151ee771a
de3f545646517dfc453eac0eccc65d47cd44120c2d56acfdd8ed0060a4b02e04
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb
e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f
e100492d38c333d7ec17dfee06e91973ee8a707dd6f5c5991d2e15ead37243a9
e1887a901d847a6cbd14a5e5e33005b67a51ea5ccb5ddecd90e2f1da213b89dc
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3fc7b1888e27c5c730f715e45bccf35a7b2365cef3e203e1ff840d2fe668cfb
e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e59c8c655db8c097ed0067789aeb44ed58f25f8c68a5772bbb3f1fdc18e5e336
e5e3c735c1b1f62eab17d6352aca62faba788d6e14442f3df924e393e21c7dd2
e692d2f4ffcf80a868f605627e06aadec70e3f0a26666dd991245feaec9e09f9
e7f276443e91579cd27b45aaaeb5394166644fbd121d2bf39e8a408ee5fe4e2a
e8d98c9b6e89759e0df4f47e53b267d161c6096e0252641223fac82919e29fe7
e9861478977dbf62d4a69be6936c96a1534a62caf67dcd476299ab89fe0c9f19
eb07b53d262575cef96004e2be725ac235db39262e9bb8466a2a9b85cf532aa8
eed2b7b85bfd84ebdcda3f2d24b5b4566dc77d0340efb27b20e00a5b6085af2e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0c8ad030a90f1ee3cdcd5910587eab25da7bb0ec6f942d979bba4d506b38380
f1f493f2418d851d9c9d5a6522417b0faa8e54fc93255abe5939b309a6e1465e
f425f66d90f1150499b36ab47b56fa6fb1a68136e4f42befca20a920ff85306b
f444da05001f14ded9b611a70579edc66ea57225af5d25273094a0141bc92340
f5721efa8525b22dd894257d9e675e6b60245527ea85e1f4833ca3f58cbfde16
f5b52ad70c5d645388b52d2fadaf8a5311aee9a01436866ab9b3e2c5f02e1c22
f6460a62bcb64a288196db0162ebd1ea5e2bbc95b3725ed6ca7c08eed129d767
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9
f763112ed36675dd240650c54aaae41a860760ef21a9c0f98cd7bc3a508d893f
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
f92514f4e39c16da9037f964148a09a79419744b77d611860ffc81c86aeace0a
f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee
fa33d1db535d783b0baf4e74bdc7ce9e54633f87a03669b2803e567088d64ccb
faed137e4045c8b44a7bfb2e0d9e2f19198de1e6a72d3721ac9425e009ff5e59
fe074214a9c301f8c3ba319d4bab7cba8d65164dcc2077272a9cacedf8941ae2
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097
ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5