www.zdnet.com Open in urlscan Pro
2.18.233.143 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basi...
Effective URL:
https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basi...
Submission: On October 03 via api (October 3rd 2019, 2:47:46 pm UTC) from US

Summary HTTP 442 Redirects Links 45 Behaviour Indicators

Summary

This website contacted 66 IPs in 6 countries across 59 domains to perform 442 HTTP transactions. The main IP is 2.18.233.143, located in Ascension Island and belongs to AKAMAI-AS - Akamai Technologies, Inc., US. The main domain is www.zdnet.com.
TLS certificate: Issued by GeoTrust RSA CA 2018 on April 23rd 2019. Valid for: a year.

This is the only time www.zdnet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
11	2.18.233.143 2.18.233.143	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
52	2a04:4e42:3::444 2a04:4e42:3::444	54113 (FASTLY) (FASTLY - Fastly)
1	23.0.46.190 23.0.46.190	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
16	2a04:4e42:1b:... 2a04:4e42:1b::444	54113 (FASTLY) (FASTLY - Fastly)
3	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
7	104.111.214.229 104.111.214.229	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1 26	172.217.16.162 172.217.16.162	15169 (GOOGLE) (GOOGLE - Google LLC)
1	13.224.196.129 13.224.196.129	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	34.205.11.82 34.205.11.82	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	216.58.205.230 216.58.205.230	15169 (GOOGLE) (GOOGLE - Google LLC)
1	63.32.199.154 63.32.199.154	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	35.190.38.167 35.190.38.167	15169 (GOOGLE) (GOOGLE - Google LLC)
33	2a00:1450:400... 2a00:1450:4001:815::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
14	152.199.23.241 152.199.23.241	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
1	2a01:4a0:1338... 2a01:4a0:1338:28::c38a:ff18	201011 (NETZBETRI...) (NETZBETRIEB-GMBH)
6	2606:4700::68... 2606:4700::6810:a20d	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
9	2606:4700::68... 2606:4700::6810:4fa5	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
5	64.30.230.22 64.30.230.22	6623 (CBSI-1) (CBSI-1 - CBS Interactive Inc.)
3	2606:4700:20:... 2606:4700:20::6819:a322	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 7	34.248.158.173 34.248.158.173	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3	95.100.75.247 95.100.75.247	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	52.44.237.33 52.44.237.33	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 1	104.111.241.32 104.111.241.32	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
2 2	35.190.72.21 35.190.72.21	15169 (GOOGLE) (GOOGLE - Google LLC)
2 2	2.18.233.201 2.18.233.201	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
2 2	18.200.54.67 18.200.54.67	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 3	18.197.149.199 18.197.149.199	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 6	52.31.175.110 52.31.175.110	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
7	151.101.14.133 151.101.14.133	54113 (FASTLY) (FASTLY - Fastly)
1	2600:9000:215... 2600:9000:2156:3000:18:1fcd:349:ca21	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
6	107.23.115.104 107.23.115.104	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
2	52.30.7.139 52.30.7.139	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
6	108.128.130.224 108.128.130.224	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
4	99.80.15.126 99.80.15.126	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
5	37.252.173.62 37.252.173.62	29990 (ASN-APPNEXUS) (ASN-APPNEXUS - AppNexus)
1 4	66.117.28.68 66.117.28.68	15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.)
2 2	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.)
2 2	172.217.18.98 172.217.18.98	15169 (GOOGLE) (GOOGLE - Google LLC)
1 7	2.16.31.65 2.16.31.65	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1 4	52.49.22.89 52.49.22.89	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK - Facebook)
1	104.17.209.240 104.17.209.240	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2600:9000:21f... 2600:9000:21f3:1000:1d:8c8c:47c0:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	2a00:1450:400... 2a00:1450:4001:81f::2001	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:818::2006	15169 (GOOGLE) (GOOGLE - Google LLC)
1	35.227.208.151 35.227.208.151	15169 (GOOGLE) (GOOGLE - Google LLC)
1	23.99.128.52 23.99.128.52	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1 1	2a00:1450:400... 2a00:1450:4001:800::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:81c::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1288:110... 2a00:1288:110:c305::9000	34010 (YAHOO-IRD) (YAHOO-IRD)
2	151.101.112.134 151.101.112.134	54113 (FASTLY) (FASTLY - Fastly)
2	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK - Facebook)
1	35.157.160.140 35.157.160.140	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
5	2600:9000:20e... 2600:9000:20eb:b400:2:42d9:3100:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	2a00:1450:400... 2a00:1450:4001:817::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
59	2.18.235.40 2.18.235.40	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
10	23.37.55.184 23.37.55.184	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
5	69.173.144.140 69.173.144.140	26667 (RUBICONPR...) (RUBICONPROJECT - The Rubicon Project)
3	18.130.64.138 18.130.64.138	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
18	2a00:1450:400... 2a00:1450:4001:81a::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
5	69.173.144.155 69.173.144.155	26667 (RUBICONPR...) (RUBICONPROJECT - The Rubicon Project)
1	18.203.131.207 18.203.131.207	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	34.224.154.10 34.224.154.10	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	2a00:1450:401... 2a00:1450:4013:c03::5e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2.16.186.88 2.16.186.88	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	52.5.99.108 52.5.99.108	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
34	151.101.114.2 151.101.114.2	54113 (FASTLY) (FASTLY - Fastly)
4	151.101.113.181 151.101.113.181	54113 (FASTLY) (FASTLY - Fastly)
14	2.16.186.72 2.16.186.72	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a00:1450:400... 2a00:1450:4001:80b::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a04:4e42:3::621 2a04:4e42:3::621	54113 (FASTLY) (FASTLY - Fastly)
1	2a00:1450:400... 2a00:1450:4001:806::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
442	66

11 2.18.233.143 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-233-143.deploy.static.akamaitechnologies.com

www.zdnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rev.cbsi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

52 2a04:4e42:3::444 (Ascension Island)

ASN54113 (FASTLY - Fastly, US)

zdnet2.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zdnet3.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zdnet4.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.0.46.190 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-0-46-190.deploy.static.akamaitechnologies.com

c.evidon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a04:4e42:1b::444 (Ascension Island)

ASN54113 (FASTLY - Fastly, US)

zdnet1.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.18.234.21 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.111.214.229 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-214-229.deploy.static.akamaitechnologies.com

c.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
0211c812.akstat.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
686eb51a.akstat.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 172.217.16.162 (United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s11-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.196.129 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-224-196-129.fra2.r.cloudfront.net

native.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.205.11.82 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-205-11-82.compute-1.amazonaws.com

l.betrad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.205.230 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s24-in-f230.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.32.199.154 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-63-32-199-154.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.38.167 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 167.38.190.35.bc.googleusercontent.com

urs.zdnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 2a00:1450:4001:815::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 152.199.23.241 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a01:4a0:1338:28::c38a:ff18 (Germany)

ASN201011 (NETZBETRIEB-GMBH, DE)

iicbsi-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6810:a20d (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdn.viglink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700::6810:4fa5 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.lightboxcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api1.lightboxcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 64.30.230.22 (Fremont, United States)

ASN6623 (CBSI-1 - CBS Interactive Inc., US)
PTR: phx2-dw-cbsi-xw-ext-lb.cnet.com

dw.cbsi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:20::6819:a322 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

tru.am	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
beacon.tru.am	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 34.248.158.173 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 95.100.75.247 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a95-100-75-247.deploy.static.akamaitechnologies.com

www.everestjs.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.44.237.33 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-44-237-33.compute-1.amazonaws.com

in.ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.241.32 (Netherlands) 1 redirects

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-241-32.deploy.static.akamaitechnologies.com

tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.72.21 (Mountain View, United States) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: 21.72.190.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.233.201 (Ascension Island) 2 redirects

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-233-201.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.200.54.67 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-200-54-67.eu-west-1.compute.amazonaws.com

sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.197.149.199 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-197-149-199.eu-central-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.31.175.110 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-31-175-110.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 151.101.14.133 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

vidtech.cbsinteractive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2156:3000:18:1fcd:349:ca21 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

static.chartbeat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 107.23.115.104 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-107-23-115-104.compute-1.amazonaws.com

ping.chartbeat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.30.7.139 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-30-7-139.eu-west-1.compute.amazonaws.com

cbsi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 108.128.130.224 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-108-128-130-224.eu-west-1.compute.amazonaws.com

saa.cbsi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 99.80.15.126 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-99-80-15-126.eu-west-1.compute.amazonaws.com

api.viglink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 37.252.173.62 (Ascension Island)

ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US)
PTR: 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 66.117.28.68 (United States) 1 redirects

ASN15224 (OMNITURE - Adobe Systems Inc., US)

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 66.117.28.86 (United States) 2 redirects

ASN15224 (OMNITURE - Adobe Systems Inc., US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.18.98 (United States) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: zrh04s05-in-f98.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2.16.31.65 (Ascension Island) 1 redirects

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-16-31-65.deploy.static.akamaitechnologies.com

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.49.22.89 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-49-22-89.eu-west-1.compute.amazonaws.com

secure-us.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.209.240 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21f3:1000:1d:8c8c:47c0:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

cdn-magiclinks.trackonomics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:818::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.208.151 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 151.208.227.35.bc.googleusercontent.com

web-sdk.urbanairship.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.99.128.52 (Des Moines, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
PTR: waws-prod-dm1-001.cloudapp.net

lightboxapi2.azurewebsites.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:110:c305::9000 (United Kingdom)

ASN34010 (YAHOO-IRD, GB)

ad.yieldmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.112.134 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

zdnet-1.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f12d:83:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.157.160.140 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-35-157-160-140.eu-central-1.compute.amazonaws.com

www.summerhamster.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:20eb:b400:2:42d9:3100:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

cdn-gl.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:817::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

59 2.18.235.40 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
px.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cbsdfp5832910442.s.moatpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 23.37.55.184 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-37-55-184.deploy.static.akamaitechnologies.com

ads.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 69.173.144.140 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US)

optimized-by.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.130.64.138 (London, United Kingdom)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-130-64-138.eu-west-2.compute.amazonaws.com

geo.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a00:1450:4001:81a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 69.173.144.155 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US)

beacon-eu2.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.203.131.207 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-203-131-207.eu-west-1.compute.amazonaws.com

s.update.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.224.154.10 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-224-154-10.compute-1.amazonaws.com

inqlnfvog763mmf771rou737u.litix.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4013:c03::5e (Groningen, Netherlands)

ASN15169 (GOOGLE - Google LLC, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.186.88 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-88.deploy.static.akamaitechnologies.com

cbsadsales-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.5.99.108 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-5-99-108.compute-1.amazonaws.com

cbsinteractive.hb.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

34 151.101.114.2 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

cdn.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.113.181 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

widget.perfectmarket.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2.16.186.72 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-72.deploy.static.akamaitechnologies.com

techrepublicmedia.akamaized.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:3::621 (Ascension Island)

ASN54113 (FASTLY - Fastly, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
68	cbsistatic.com zdnet2.cbsistatic.com zdnet3.cbsistatic.com zdnet4.cbsistatic.com zdnet1.cbsistatic.com	757 KB
43	moatads.com z.moatads.com geo.moatads.com px.moatads.com	1 MB
34	taboola.com cdn.taboola.com trc.taboola.com images.taboola.com	476 KB
28	doubleclick.net 2 redirects securepubads.g.doubleclick.net ad.doubleclick.net cm.g.doubleclick.net googleads.g.doubleclick.net	206 KB
21	rubiconproject.com ads.rubiconproject.com optimized-by.rubiconproject.com beacon-eu2.rubiconproject.com eus.rubiconproject.com s.update.rubiconproject.com	47 KB
20	googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	982 KB
19	moatpixel.com cbsdfp5832910442.s.moatpixel.com	8 KB
19	googletagservices.com www.googletagservices.com	534 KB
14	akamaized.net techrepublicmedia.akamaized.net	15 MB
14	tiqcdn.com tags.tiqcdn.com	89 KB
12	cbsi.com dw.cbsi.com saa.cbsi.com rev.cbsi.com	14 KB
11	zdnet.com www.zdnet.com urs.zdnet.com	206 KB
10	viglink.com cdn.viglink.com api.viglink.com	112 KB
9	imrworldwide.com 1 redirects secure-us.imrworldwide.com cdn-gl.imrworldwide.com	61 KB
9	lightboxcdn.com www.lightboxcdn.com api1.lightboxcdn.com	159 KB
8	demdex.net 1 redirects dpm.demdex.net cbsi.demdex.net	7 KB
8	ml314.com 1 redirects ml314.com in.ml314.com	16 KB
8	google.com 1 redirects adservice.google.com www.google.com	2 KB
8	google.de adservice.google.de www.google.de	2 KB
7	scorecardresearch.com 1 redirects sb.scorecardresearch.com	4 KB
7	cbsinteractive.com vidtech.cbsinteractive.com	445 KB
6	everesttech.net 3 redirects pixel.everesttech.net cm.everesttech.net	3 KB
6	chartbeat.net ping.chartbeat.net	1008 B
5	adnxs.com secure.adnxs.com	6 KB
4	perfectmarket.com widget.perfectmarket.com	94 KB
4	omtrdc.net cbsinteractive.hb.omtrdc.net	1 KB
4	go-mpulse.net c.go-mpulse.net	58 KB
3	facebook.net connect.facebook.net	120 KB
3	akstat.io 0211c812.akstat.io 686eb51a.akstat.io	909 B
3	eyeota.net 2 redirects ps.eyeota.net	1 KB
3	everestjs.net www.everestjs.net	8 KB
3	tru.am tru.am beacon.tru.am	14 KB
2	google-analytics.com www.google-analytics.com	18 KB
2	gstatic.com csi.gstatic.com fonts.gstatic.com	13 KB
2	litix.io inqlnfvog763mmf771rou737u.litix.io	698 B
2	googleapis.com imasdk.googleapis.com fonts.googleapis.com	440 B
2	facebook.com www.facebook.com	323 B
2	disqus.com zdnet-1.disqus.com	2 KB
2	2mdn.net s0.2mdn.net	102 KB
2	casalemedia.com as-sec.casalemedia.com	1 KB
2	crwdcntrl.net 2 redirects sync.crwdcntrl.net	2 KB
2	mathtag.com 2 redirects pixel.mathtag.com	1 KB
2	rlcdn.com 2 redirects idsync.rlcdn.com	439 B
2	akamaihd.net iicbsi-a.akamaihd.net cbsadsales-a.akamaihd.net	272 B
2	betrad.com l.betrad.com	240 B
1	jsdelivr.net cdn.jsdelivr.net	2 KB
1	summerhamster.com www.summerhamster.com	181 B
1	yieldmanager.com ad.yieldmanager.com	341 B
1	googleadservices.com 1 redirects www.googleadservices.com	306 B
1	azurewebsites.net lightboxapi2.azurewebsites.net	503 B
1	urbanairship.com web-sdk.urbanairship.com	17 KB
1	trackonomics.net cdn-magiclinks.trackonomics.net	18 KB
1	qualtrics.com zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com	15 KB
1	chartbeat.com static.chartbeat.com	23 KB
1	bluekai.com 1 redirects tags.bluekai.com	856 B
1	adsrvr.org match.adsrvr.org	536 B
1	sharethrough.com native.sharethrough.com	118 KB
1	indexww.com js-sec.indexww.com	26 KB
1	evidon.com c.evidon.com	512 B
442	59

	Domain	Requested by
29	px.moatads.com
24	images.taboola.com	cdn.taboola.com z.moatads.com
21	zdnet2.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com
19	cbsdfp5832910442.s.moatpixel.com
19	www.googletagservices.com	www.zdnet.com securepubads.g.doubleclick.net rev.cbsi.com pagead2.googlesyndication.com
19	securepubads.g.doubleclick.net	www.zdnet.com securepubads.g.doubleclick.net www.googletagservices.com
18	pagead2.googlesyndication.com	optimized-by.rubiconproject.com pagead2.googlesyndication.com www.zdnet.com
18	zdnet3.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com zdnet3.cbsistatic.com
16	zdnet1.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com zdnet3.cbsistatic.com
14	techrepublicmedia.akamaized.net	vidtech.cbsinteractive.com
14	tags.tiqcdn.com	zdnet2.cbsistatic.com tags.tiqcdn.com
13	zdnet4.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com zdnet3.cbsistatic.com
11	z.moatads.com	securepubads.g.doubleclick.net
10	www.zdnet.com	zdnet3.cbsistatic.com vidtech.cbsinteractive.com
8	www.lightboxcdn.com	www.zdnet.com www.lightboxcdn.com
7	googleads.g.doubleclick.net	1 redirects pagead2.googlesyndication.com
7	sb.scorecardresearch.com	1 redirects tags.tiqcdn.com cdn.taboola.com widget.perfectmarket.com
7	vidtech.cbsinteractive.com	zdnet2.cbsistatic.com vidtech.cbsinteractive.com
7	ml314.com	1 redirects tags.tiqcdn.com ml314.com www.zdnet.com
7	adservice.google.com	securepubads.g.doubleclick.net www.googletagservices.com pagead2.googlesyndication.com
7	adservice.google.de	securepubads.g.doubleclick.net www.googletagservices.com pagead2.googlesyndication.com
6	trc.taboola.com	cdn.taboola.com
6	saa.cbsi.com	tags.tiqcdn.com vidtech.cbsinteractive.com
6	ping.chartbeat.net	www.zdnet.com
6	dpm.demdex.net	1 redirects www.zdnet.com tags.tiqcdn.com vidtech.cbsinteractive.com
6	cdn.viglink.com	tags.tiqcdn.com www.zdnet.com
5	eus.rubiconproject.com	www.zdnet.com
5	beacon-eu2.rubiconproject.com	www.zdnet.com
5	optimized-by.rubiconproject.com	ads.rubiconproject.com
5	ads.rubiconproject.com	www.zdnet.com
5	cdn-gl.imrworldwide.com	vidtech.cbsinteractive.com cdn-gl.imrworldwide.com
5	secure.adnxs.com	js-sec.indexww.com
5	dw.cbsi.com	tags.tiqcdn.com www.zdnet.com
4	widget.perfectmarket.com	cdn.taboola.com widget.perfectmarket.com
4	cdn.taboola.com	zdnet2.cbsistatic.com cdn.taboola.com
4	cbsinteractive.hb.omtrdc.net	vidtech.cbsinteractive.com
4	secure-us.imrworldwide.com	1 redirects
4	pixel.everesttech.net	1 redirects
4	api.viglink.com	cdn.viglink.com
4	c.go-mpulse.net	www.zdnet.com c.go-mpulse.net zdnet1.cbsistatic.com
3	geo.moatads.com	z.moatads.com
3	connect.facebook.net	tags.tiqcdn.com connect.facebook.net
3	ps.eyeota.net	2 redirects www.zdnet.com
3	www.everestjs.net	tags.tiqcdn.com www.everestjs.net
2	www.google-analytics.com	widget.perfectmarket.com
2	inqlnfvog763mmf771rou737u.litix.io	vidtech.cbsinteractive.com
2	686eb51a.akstat.io	c.go-mpulse.net zdnet1.cbsistatic.com
2	www.facebook.com	connect.facebook.net
2	zdnet-1.disqus.com	zdnet2.cbsistatic.com zdnet-1.disqus.com
2	s0.2mdn.net	zdnet2.cbsistatic.com s0.2mdn.net
2	tpc.googlesyndication.com	securepubads.g.doubleclick.net
2	cm.everesttech.net	2 redirects
2	as-sec.casalemedia.com	js-sec.indexww.com
2	cbsi.demdex.net	tags.tiqcdn.com
2	sync.crwdcntrl.net	2 redirects
2	pixel.mathtag.com	2 redirects
2	idsync.rlcdn.com	2 redirects
2	tru.am	tags.tiqcdn.com tru.am
2	l.betrad.com	www.zdnet.com
1	fonts.gstatic.com	www.lightboxcdn.com
1	cdn.jsdelivr.net	www.lightboxcdn.com
1	fonts.googleapis.com	www.lightboxcdn.com
1	cbsadsales-a.akamaihd.net
1	csi.gstatic.com	s0.2mdn.net
1	s.update.rubiconproject.com	www.zdnet.com
1	rev.cbsi.com	www.zdnet.com
1	imasdk.googleapis.com	s0.2mdn.net
1	www.summerhamster.com
1	ad.yieldmanager.com
1	www.google.de
1	www.google.com	1 redirects
1	www.googleadservices.com	1 redirects
1	api1.lightboxcdn.com	www.lightboxcdn.com
1	lightboxapi2.azurewebsites.net	www.lightboxcdn.com
1	web-sdk.urbanairship.com	zdnet3.cbsistatic.com
1	cdn-magiclinks.trackonomics.net	tags.tiqcdn.com
1	zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com	tags.tiqcdn.com
1	cm.g.doubleclick.net	1 redirects
1	0211c812.akstat.io	zdnet1.cbsistatic.com
1	beacon.tru.am	tru.am
1	static.chartbeat.com	zdnet2.cbsistatic.com
1	tags.bluekai.com	1 redirects
1	in.ml314.com	ml314.com
1	iicbsi-a.akamaihd.net	tags.tiqcdn.com
1	urs.zdnet.com	zdnet2.cbsistatic.com
1	match.adsrvr.org	js-sec.indexww.com
1	ad.doubleclick.net	www.zdnet.com
1	native.sharethrough.com	www.zdnet.com
1	js-sec.indexww.com	www.zdnet.com
1	c.evidon.com	www.zdnet.com
442	90

This site contains links to these domains. Also see Links.

Domain
www.zdnet.com.cn
www.zdnet.fr
www.zdnet.de
www.zdnet.co.kr
japan.zdnet.com
www.techrepublic.com
downloads.zdnet.com
www.youtube.com
www.cnet.com
blog.avast.com
popup.taboola.com
trf.greatviews.de
de.slow-watches.com
taongafarm.com
om.elvenar.com
www.holzkern.com
www.schnellesangebot.de
www.austria.info
www.remind.me
cbsi.force.com
www.cbsinteractive.com
cbsi.secure.force.com
cbslnk.cbsileads.com
www.facebook.com
twitter.com
www.linkedin.com
legalterms.cbsinteractive.com
narratives.zdnet.com
academy.zdnet.com

Subject Issuer	Validity	Valid
www.cbs.com GeoTrust RSA CA 2018	`2019-04-23` - `2020-07-22`	a year	crt.sh
*.cbsistatic.com DigiCert SHA2 High Assurance Server CA	`2019-02-22` - `2021-02-26`	2 years	crt.sh
*.evidon.com DigiCert ECC Secure Server CA	`2019-02-01` - `2020-05-02`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2019-07-17` - `2020-03-09`	8 months	crt.sh
akstat.io DigiCert SHA2 Secure Server CA	`2019-04-16` - `2020-06-14`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2019-09-05` - `2019-11-28`	3 months	crt.sh
*.sharethrough.com Go Daddy Secure Certificate Authority - G2	`2018-09-18` - `2019-11-17`	a year	crt.sh
l.betrad.com Go Daddy Secure Certificate Authority - G2	`2019-04-25` - `2021-06-24`	2 years	crt.sh
*.doubleclick.net GTS CA 1O1	`2019-09-05` - `2019-11-28`	3 months	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
*.zdnet.com DigiCert SHA2 High Assurance Server CA	`2017-12-12` - `2020-12-15`	3 years	crt.sh
*.google.com GTS CA 1O1	`2019-09-17` - `2019-12-10`	3 months	crt.sh
*.tiqcdn.com DigiCert SHA2 Secure Server CA	`2017-10-25` - `2020-05-13`	3 years	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2019-08-13` - `2020-08-12`	a year	crt.sh
ssl418259.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-08-10` - `2020-02-16`	6 months	crt.sh
ssl516460.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-08-24` - `2020-03-01`	6 months	crt.sh
*.cbsi.com DigiCert SHA2 High Assurance Server CA	`2017-11-07` - `2021-02-04`	3 years	crt.sh
ssl389962.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-09-11` - `2020-03-19`	6 months	crt.sh
*.ml314.com Amazon	`2019-03-16` - `2020-04-16`	a year	crt.sh
www.everestjs.net DigiCert SHA2 Secure Server CA	`2018-10-15` - `2020-10-15`	2 years	crt.sh
*.eyeota.net Let's Encrypt Authority X3	`2019-09-19` - `2019-12-18`	3 months	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
vidtech.cbsinteractive.com DigiCert SHA2 High Assurance Server CA	`2018-12-13` - `2020-12-17`	2 years	crt.sh
*.chartbeat.com Gandi Standard SSL CA 2	`2019-04-10` - `2020-04-10`	a year	crt.sh
*.chartbeat.net Thawte RSA CA 2018	`2018-12-20` - `2020-01-01`	a year	crt.sh
saa.cbsi.com DigiCert SHA2 High Assurance Server CA	`2019-06-23` - `2020-09-25`	a year	crt.sh
viglink.com Amazon	`2019-02-09` - `2020-03-09`	a year	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.everesttech.net DigiCert SHA2 Secure Server CA	`2017-04-13` - `2020-04-17`	3 years	crt.sh
*.scorecardresearch.com COMODO RSA Organization Validation Secure Server CA	`2018-11-28` - `2019-12-26`	a year	crt.sh
*.imrworldwide.com DigiCert SHA2 Secure Server CA	`2019-02-25` - `2020-02-25`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2019-09-22` - `2019-12-20`	3 months	crt.sh
*.qualtrics.com DigiCert SHA2 Secure Server CA	`2018-10-08` - `2021-01-06`	2 years	crt.sh
*.trackonomics.net Go Daddy Secure Certificate Authority - G2	`2018-12-22` - `2020-02-20`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2019-09-05` - `2019-11-28`	3 months	crt.sh
*.urbanairship.com DigiCert ECC Secure Server CA	`2018-06-20` - `2020-06-24`	2 years	crt.sh
*.azurewebsites.net Microsoft IT TLS CA 5	`2019-09-24` - `2021-09-24`	2 years	crt.sh
www.google.de GTS CA 1O1	`2019-09-17` - `2019-12-10`	3 months	crt.sh
*.ads.yahoo.com DigiCert SHA2 High Assurance Server CA	`2019-06-27` - `2019-12-24`	6 months	crt.sh
*.disqus.com DigiCert SHA2 Secure Server CA	`2018-03-28` - `2020-04-27`	2 years	crt.sh
*.summerhamster.com Let's Encrypt Authority X3	`2019-09-30` - `2019-12-29`	3 months	crt.sh
*.googleapis.com GTS CA 1O1	`2019-09-17` - `2019-12-10`	3 months	crt.sh
moatads.com DigiCert ECC Secure Server CA	`2018-11-10` - `2020-02-09`	a year	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-02-13` - `2021-02-17`	2 years	crt.sh
*.moatads.com DigiCert SHA2 Secure Server CA	`2019-03-12` - `2021-06-10`	2 years	crt.sh
kazfv.com Sectigo ECC Domain Validation Secure Server CA	`2019-06-05` - `2020-06-04`	a year	crt.sh
*.litix.io Amazon	`2019-01-22` - `2020-02-22`	a year	crt.sh
*.hb.omtrdc.net DigiCert SHA2 Secure Server CA	`2017-12-22` - `2020-01-03`	2 years	crt.sh
f2.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-07-30` - `2020-07-25`	a year	crt.sh
p.ssl.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-09-03` - `2021-02-22`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-09-05` - `2019-11-28`	3 months	crt.sh
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-05-29` - `2020-04-23`	a year	crt.sh

This page contains 40 frames:

Primary Page: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Frame ID: F6FF7B1726525C928F5BAA67C0552D4B
Requests: 329 HTTP requests in this frame

Frame: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Frame ID: A7998B98ECCB8D781FB9C98D45BB5778
Requests: 2 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1570114048993&lv=1
Frame ID: D4FD3D745E752C846F17FE004B8640AD
Requests: 2 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637048605067352348
Frame ID: F114E2C5BCA8C401C79283E5F79DCB83
Requests: 1 HTTP requests in this frame

Frame: https://cbsi.demdex.net/dest5.html?d_nsid=undefined
Frame ID: D57245BC7625767522810436DE1BCB96
Requests: 1 HTTP requests in this frame

Frame: https://www.everestjs.net/static/pixel_details.html
Frame ID: E6CBA823322945E7CCB4F8ACED9C39BE
Requests: 1 HTTP requests in this frame

Frame: https://cbsi.demdex.net/dest5.html?d_nsid=0
Frame ID: 7B6E8B1B5E87F620E9ABF14AB02F8201
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.337.0_en.html
Frame ID: 7B87E95C76205A6533CDAB7B48E16C91
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsttBA72nc3CfxawVLPg1EkAIVOLukceSa3QazTV1Cq5X7z3mT6X_Gim-J7Dti_ItffxmnRIGeyL4EjaSCbj1tSYkBDow8w4w0ZFugYQ0R5oXaq2-ymqaSJXT5IbhWux705OXbsBPXtCAPsNgnnaeTb-Df-NB9ojk8frcapzQW0vwZHR5C7y2gsF3UiA3W4eClFoZqGQUh8w_O4sgjwCe87NJS71FFRYDaQKxnnjxfmgC8vxkZj3UobyaFz9Xyt353NdzEJZ-8TQ&sai=AMfl-YSUDZDA8PKiilVoqvOY4FcVq7DrpJNHGX0GgHL9dH6XFTzdEhWvjyfoPFP4Rsk8PamPSLUUW0Q4ODgTVAQXTaXWVMdO5goOqYPKTomss7H7VVrezXPaxOZmZpA1js8T&sig=Cg0ArKJSzN4Lb7V6YJlGEAE&urlfix=1&adurl=
Frame ID: FD410A1A072744897093C21F4667C014
Requests: 4 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuOG5EuBdHgyztXy8YXqWbgaLxUyeDF_xV58_3GrEzmdCB9F19QCNlnrk0wvGbbnhN5HQ9q59RLpShwl8UK38Ra_4VbYa_H1Z77d330wAQqGCvx2toJwE_XBoX3_RT3RZiiOKtRBlyWtMpUoN_1Noq-6yHNhjHuLTd3CmNEqHv0x-UPknWTgdP_IrvRBFTL8cM5uBHJHcZCuH_Sre2eqZnF7UEDw-ICowyuT5a2Yso50tEEBXXkut542e-Wzth3W9sOL3M&sai=AMfl-YSNBlcmxUB6Sukb6jLL3ziOGNJHwtRTpmXN3sDB1CgcTOwGJISBgQMtWwNipTe_rrtO9WDR1xws6buVo0m9uqw15raZkNg0ogqoAD7Mu9cjYCMICNho_qmuFlMRpGu0&sig=Cg0ArKJSzHIEtk1g8Fk3EAE&urlfix=1&adurl=
Frame ID: D8BF88D09EFE52AD0F59C3059B2B46BD
Requests: 13 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu8FQwfoFfmZ_EoMhyOZH7XMcTRF2wIDr6KLLI_LyCOfLsn-Lvb0GSyaxlYc4Gvs9IfAIwYvQaHRdTV1LfbEvLUJRvMyz7rq2AiIvcsqOWRdgAWwGYb58CXWStAUF2o2VpFDnDhrGd8iPP6my_jRrIHwOACwIk0XSZnbpLVQHPq1wz0UxY9z3JCl86TPEEEegENqkAKuRdGQi-Eteolc3I-CJtJ_pN0mrX2pBQQ_wRTQ4MZxQZZ-IDYdyvOe13p-rXTk_M&sai=AMfl-YRrs0Vi-3FyIDT3xqbf-ATvTgV1_M-QYn7yyuFKfbRvL73bBJtohrBZhlqAg0MqAFc5oOWwL9lTxhX4WKIeiiR5CRQEiEVYzwpZs836f8_TMvC2SS-nqC_Cb2QQtGbV&sig=Cg0ArKJSzJBWMEOx7tO7EAE&urlfix=1&adurl=
Frame ID: 03374E11B9DA82EC47DD20EC3D746607
Requests: 14 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstkdoh_xZ_But_GvDmcI71XGPCZEwHeTEjNyX0p-DFJzEMEYGxPnCCYecBLTOxluOqJP3yyUeDyTCt8VrxN1CyylpUbsx46LEukY7mMnhQbVGyKpZfE5CdyngYkGqkAp_oV8GMYIZPLsVempP_O_pUlMFqUUiACHJ14o5JEi8dEKkFLiTOhfEzSfGEXNcr1LdxDs04eXbGUiwBLxG_ZPqqRIl2s5__vK45VL1fauz3l45qPhDuTxIfkbWylwN4yX-CSNyU&sai=AMfl-YSIVM32U0sLsETaDDWTHperiq5_vp3Y5vY4yDc2wMrBFiO5YeO-MHV0CDw8l10RBLuDOd8HjTLy2WtwbrZ6YIdyiDC-y7BMTiHLVWhZ8VqMOimNwgA9a62X3Kqz-I-7&sig=Cg0ArKJSzJsBVdIgAeQPEAE&urlfix=1&adurl=
Frame ID: F1BA1B754E5E7D9612E12E1037B71F78
Requests: 12 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstJeCsXo5Yzg3t-DDum1Gfp-9jA_asBdWGT6lVHEHN1hrZvpJ-LgzpNCNvIP9unXlRjh92dDH0evpk8fbNIgSejqB46dCbL8BY_zodRZuu2emIe-_S3kM_bYyU3hUXxtBdMUpKpWt_mkFWgIE_-TXDhQz0HyiUedvZ69G68jYEnHHZN6G2Fz8NEGzpwKk2m4hetPA6CrYy1LVJx9WZAhLAOWuKEpTRoonIDoMUy7hwxBDIGhU1ZON6XNtG9cgmqxPOUdck&sai=AMfl-YR3sARJIRfoJlGiPMpz1JV-RZ63zi7ivHYyUIpGYTvmGaUTkflN3RFU_mrYcZf3L8913OLIjP42-UqqbZyHT9AOlVNnMYbRAJyNYC0r7apoSssP2XOqKvvo8yBf8ATT&sig=Cg0ArKJSzM0OwaqHl0RiEAE&urlfix=1&adurl=
Frame ID: 19D3B68A1D9A1CA973428200985A3324
Requests: 12 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvR76S1oTN05OQgn02BLkzB8hL129WzPlmUppHRbVSGxsq_7qP6JQ4V_K_dtpPLNnE6WMig473ks8QRDIzIfBGqIeSFlFsBVYJRS_oEVZ2vPHvdq41UiInxDU0HBb_m47bhsqycotKhSoFl5YRFowuRjmsUBN9QHh-I9XXwan40McKOXH_reA-v5eqFyEj4y41Ewjg0nd-hyx6dC_ONeGTOG9UvQZcbjfpyKYe_YwjPMmbe0jokdlrEV4zUFNLyN-iWPMI&sai=AMfl-YTd9rtiNLPEoAnfemHRi3CqPTVHJdHDzT92Ik156_N5t_xpkV05N5R9m_fa1R3uDEenJByihsvW7gfTWEDcrtRsQTkggmZxfIbXlavzUFIxhOAcf_dfpxWCSdNAzMEg&sig=Cg0ArKJSzCpkKZXX-HnDEAE&urlfix=1&adurl=
Frame ID: E907F45CB73CC80A95D91242E85C8BA1
Requests: 12 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssQrx0I4VHg807bEETRizojvlSNMfU9KBMF5c5YeU1eU-LlLXK4JbvowJ1B356n3pg9tcvMpuEMzzqHh4bLtSLznJ2anXGz_ruGJKATkEUnwpXA8yGct8Gn2rwD_1aZaJ97awecVCBKTHd5xr4f68uSOekK_H_eJQClQY2zFqelKtcUKy05hpAw6kq-5BR-yuLa-M6XM8UlzcODF9go2RuCYCekSvX7Tz1X7D0Thq-eW4Jg3ZBD39fHtMDWUks9TVHlrs_Df0dO&sai=AMfl-YRNsTwkYt37I49-dnLNl-xhAj5cBkLUO5hVuMgdYOt0wujWeq2gNAGhBXdA5lUwlDNUfg0eBB9EFQpYMzsjjG-A990P2DYN7RYe0MOsS4Y-Anql_cvmYGyyRgqjdTmO&sig=Cg0ArKJSzCCmAZy6--NhEAE&urlfix=1&adurl=
Frame ID: DBB71F546FC7007A885E52DE1EF1AAF1
Requests: 14 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 25BE7A45609C2E3A4F8FDBA03CAD4B60
Requests: 1 HTTP requests in this frame

Frame: https://cdn-gl.imrworldwide.com/novms/html/ls.html
Frame ID: 2EE2D023E7C924B0B46A5E358679463C
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js
Frame ID: 582DCB3B3C0ED44B83850E72138231C4
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20190926/r20190131/zrt_lookup.html
Frame ID: DC923EFD96B3A35D7504AA0F11A633A3
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: F4A50D9A4769DC4A00F23A94FF939757
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js
Frame ID: 668E28AF8CAFAB709B93A9245A01DC70
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: F7C04694E731D4DFAD2E5A723799B0B9
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js
Frame ID: 7F36F6D98F5E4A92BB4F877C276FD2CE
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: 1BB13CA665E2652D954781C507474F41
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js
Frame ID: 86A1F65E70E28F6745D9B4401308A57F
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: BD190BEC53E94164F05A1D1A899337F2
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js
Frame ID: 46FAEB82724361D3D5FD1DE2CB971593
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: E91C111E5447274A621E22406318CDA9
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=3677162154&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&ea=0&flash=0&wgl=1&dt=1570114050977&bpp=19&bdt=389&fdt=304&idt=305&shv=r20190926&cbv=r20190131&saldr=sa&correlator=4015125597002&frm=23&ife=5&pv=2&ga_vid=1683325362.1570114051&ga_sid=1570114051&ga_hid=1963743742&ga_fc=0&iag=3&icsg=10600&nhd=1&dssz=18&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=478&biw=1585&bih=1200&isw=728&ish=90&ifk=369059093&scr_x=0&scr_y=0&eid=20199336&oid=3&pvsid=4257512088716&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.wr0oaug1l1t1&fsb=1&dtd=319
Frame ID: DB556A0173F6FF990F99FB32ECEDBBF2
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=2269224025&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&ea=0&flash=0&wgl=1&dt=1570114050998&bpp=52&bdt=398&fdt=328&idt=328&shv=r20190926&cbv=r20190131&saldr=sa&correlator=4015125597002&frm=23&ife=5&pv=1&ga_vid=616540103.1570114051&ga_sid=1570114051&ga_hid=1666782239&ga_fc=0&iag=3&icsg=10600&nhd=1&dssz=18&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=1576&biw=1585&bih=1200&isw=300&ish=250&ifk=3336104388&scr_x=0&scr_y=0&eid=20199336%2C410075105&oid=3&pvsid=3948966053522083&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.sug06hioq5xm&fsb=1&dtd=334
Frame ID: B02C6A2D535AD4E2E8D0F55469C9BAE8
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=2269224027&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&ea=0&flash=0&wgl=1&dt=1570114051072&bpp=17&bdt=394&fdt=306&idt=306&shv=r20190926&cbv=r20190131&saldr=sa&correlator=4015125597002&frm=23&ife=5&pv=1&ga_vid=1942722069.1570114051&ga_sid=1570114051&ga_hid=605504939&ga_fc=0&iag=3&icsg=10600&nhd=1&dssz=18&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3861&biw=1585&bih=1200&isw=728&ish=90&ifk=2035717831&scr_x=0&scr_y=0&eid=21064611&oid=3&pvsid=1711340371638494&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.oy772ysvk2lb&fsb=1&dtd=312
Frame ID: 0F1B8B1187C396D31DC5F6C6755525EF
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=3677162153&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&ea=0&flash=0&wgl=1&dt=1570114051054&bpp=15&bdt=460&fdt=338&idt=338&shv=r20190926&cbv=r20190131&saldr=sa&correlator=4015125597002&frm=23&ife=5&pv=1&ga_vid=1928066393.1570114051&ga_sid=1570114051&ga_hid=990488501&ga_fc=0&iag=3&icsg=42392&nhd=1&dssz=20&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=598&biw=1585&bih=1200&isw=300&ish=250&ifk=1246925581&scr_x=0&scr_y=0&oid=3&pvsid=3786444974863214&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.q16gbeh58p6i&fsb=1&dtd=348
Frame ID: 08436D8ABA5A82E24FEFD8D4236E10AA
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstfLGZrljtoeO4BBT7l1OGTGRs4bLcjGdgR-fSHWuyWcRUPgXtFL9PxOPFb7da34OHxN0hhK73ws8tPwOweYEUsvoDRoWTCXjbIhn-s6Lbbj2sxN1bw-ObXAf9fCp-FM0JQfg2vEDh4o9yzX6JghpGtPi-qCrEmQQvmWEK_O2WePTPu2qzloZhZrIUH4M7hvO_-btFbplMlVufwqpQdj6qi2EcZGiJ_tfFeOmUmCo0cUSCDl5DDsdCCMlHync2TfAbkGkMVUh5U&sai=AMfl-YSthnML0Pt5PZYL7w1T8Vrzx0YkwlXetKRxrp2ntll0srt15XthvvOxkHbT9c2ZXoYylkBNU0SjRp2wHLrkLsPW6efE8K9lsgecEeDgDo4I9rRke7hYiMD1A2cmZvfG&sig=Cg0ArKJSzNT62hPxGziTEAE&urlfix=1&adurl=
Frame ID: 5229806A562BAAB20D0A1A5535DFD5A5
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvWe-QYSJIs5omT31f5yEd631nEy0j0EZu6ZpXEUKMmBYe06VxPMBjFjn8LzIK3ixDy4VnP6ITpP95ztixupYKAjhrEyyj8Z2YF2rgv32L-G_ssMgzh2N-Bf6QlfbTUw5RgI-4sdfmahjD7n3wNHF_hmg3mcI5D2SIEydVNtnrxNA4zVUvzGi2JrDp2wTN3msJoaYZlqan7l0jU8YCWt_eYvDlbDb2zz2HGYfiAlUHaIYygfK7Co7yLn1sCYgfCKhWHF6urHg8N&sai=AMfl-YQfvNRaQ0QFjBl8EhunnE8Bs_kXm7YepFGxrLIP7-LRse_pDiQt0Lue0yRrIbZKvThYTTH4uHmWIlOjwlkKH8bVQPZw-E06CDlwc5CawtOo58RRpMYuxw4iPXNNmuaa&sig=Cg0ArKJSzIAm-7U4vLP8EAE&urlfix=1&adurl=
Frame ID: 305BB0F7C54610C24C07D197A16F329C
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=2269224024&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&ea=0&flash=0&wgl=1&dt=1570114051217&bpp=12&bdt=548&fdt=376&idt=376&shv=r20190926&cbv=r20190131&saldr=sa&correlator=4015125597002&frm=23&ife=5&pv=1&ga_vid=93375021.1570114052&ga_sid=1570114052&ga_hid=1175174461&ga_fc=0&iag=3&icsg=10600&nhd=1&dssz=18&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=2577&biw=1585&bih=1200&isw=300&ish=250&ifk=594379831&scr_x=0&scr_y=0&eid=20199336%2C21064654&oid=3&pvsid=1055331794180263&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.t4scx2mh2cu7&fsb=1&dtd=384
Frame ID: D3CF32572E1625DFFB08E5E191FF25C9
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuJ8THpBm7XlMl-f9lidMnOjEE5-G-EMgbV02f_iCb-3NJ7uaoGLnRD5C0ZXD_mBSAO12VriX_IJHm7DcuskbvFCAk2q32-bL5mqV6Xe4LLbYoyLJ9IdgP5V_pgwCTOpaTNlaBHzaVP1T4pqFLOK3cq4gpXX2QJTC87z7Kt0thhn2pfj-VjQ6ZZ6bXZP1gd4fwVju-S9o_cOAzl9T9OMvQhrYJ3F3t3G0-ogotr66ZX4g0cfJp7jwhM9lLpMqEr5Wiw3DxsIx9M&sai=AMfl-YRKOYxoyEmpzRQW167DdaWZ60rjQQbVrfQTMnLaysEl9Ovsr5lEiCGfGsdETeRtJs1eoe3jFQ5v9VZxEApB94IjwrtHdf5qysgFltGqn4ga4fOonhDjGC_Dd_abrgFr&sig=Cg0ArKJSzHJqNikXdMW8EAE&urlfix=1&adurl=
Frame ID: 4F6F833B33992AB480A0508F44BD0D99
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv5oKje55AfMPbUdbxmlr-2KAYs8mplCG14_6bePxMNO6xOuG6ZpqsT9A2DWtZt1w7PmbFtVO_6u21ZMBLBAPquGCjF9MLzQXfcpk1rkIc4X2Q6MZoh2BehrdNeK2T6J7yC1Cnhgvr_yLivIQnEY6CjmWQ58JmrGmUaRf8qBEYoTx2b_3PI0V418mbahJU-UfKEkG-h7NMqG9eZoTAVQ0uNZ6dwzakVJHiRk2ArwL2NrrHGBN1zALwgpKgINoARyYTzA9d-RSu-&sai=AMfl-YSZF3SFk6k78LDYYDMyiXZccn9NVNhh2PV-iKXdJ3wzzI7RwzYJmLRZuqr3NPxE76Hd3KNojrOSeidkDj3G9MTBJA1UWqJD3JTwMLlWFJQDAUX9GcjOpwXHTUeu_uK1&sig=Cg0ArKJSzJdH-GG9rAvpEAE&urlfix=1&adurl=
Frame ID: B08583F1C67D6EE02D190804A66892C0
Requests: 3 HTTP requests in this frame

Frame: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
Frame ID: 6B7B81A12A8F9EA13635CFF7784377F2
Requests: 1 HTTP requests in this frame

Frame: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
Frame ID: D472A7A8CE9450399DA15068E54E26D5
Requests: 1 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=637048605067352348
Frame ID: 54F7106DE5AB8FCB9FF24B476C053B15
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

442
Requests

100 %
HTTPS

32 %
IPv6

59
Domains

90
Subdomains

66
IPs

6
Countries

20830 kB
Transfer

32421 kB
Size

3
Cookies

45 Outgoing links

These are links going to different origins than the main page.

URL: http://www.zdnet.com.cn/
Title: ZDNet China

Search URL Search Domain Scan URL

URL: http://www.zdnet.fr/
Title: ZDNet France

Search URL Search Domain Scan URL

URL: http://www.zdnet.de/
Title: ZDNet Germany

Search URL Search Domain Scan URL

URL: http://www.zdnet.co.kr/
Title: ZDNet Korea

Search URL Search Domain Scan URL

URL: http://japan.zdnet.com/
Title: ZDNet Japan

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/resource-library/whitepapers/
Title: White Papers

Search URL Search Domain Scan URL

URL: https://downloads.zdnet.com/
Title: Downloads

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/forums/
Title: TechRepublic Forums

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=HmBFoZbKfMA
Title: Ransomware: Why paying the ransom is a bad idea for everyone in the long run (ZDNet YouTube)

Search URL Search Domain Scan URL

URL: https://www.cnet.com/how-to/the-best-home-security-systems-of-2019/?ftag=CMG-01-10aaa1b
Title: Best home security of 2019: Professional monitoring and DIY (CNET)

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/article/most-fortune-500-companies-still-opaque-about-security-measures/?ftag=CMG-01-10aaa1b
Title: Most Fortune 500 companies still opaque about security measures (TechRepublic)

Search URL Search Domain Scan URL

URL: https://blog.avast.com/avast-researcher-helps-expose-banking-botnet-geost
Title: detailed their findings

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/resource-library/whitepapers/a-winning-strategy-for-cybersecurity-free-pdf/?ftag=CMG-01-10aaa1b
Title: Download the report as a PDF

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/article/500k-android-users-hit-with-malware-and-what-to-do-if-youre-infected/?ftag=CMG-01-10aaa1b
Title: 500K Android users hit with malware, and what to do if you're infected

Search URL Search Domain Scan URL

URL: https://www.cnet.com/how-to/how-to-check-your-android-phone-for-malicious-apps/?ftag=CMG-01-10aaa1b
Title: How to check your Android phone for malicious apps

Search URL Search Domain Scan URL

URL: https://popup.taboola.com/en/?template=colorbox&utm_source=cbsinteractive-zdnet&utm_medium=referral&utm_content=alternating-thumbnails-a:ZDNETarticleDesktop/Tablet-Below%20Article%20Thumbnails:
Title: by Taboola

Search URL Search Domain Scan URL

URL: https://trf.greatviews.de/cl?m315=c&q=aFUUw6mSc5Ze4CxaaHxSj4lQ&pscode=01_100_42648_1020_2187_0007_00_AFsite_cbsinteractive-zdnet_cid_172452228ID_GV00ID
Title: Parship

Search URL Search Domain Scan URL

URL: https://de.slow-watches.com/de/?utm_source=taboola_cbsinteractive-zdnet&utm_content=145625765&utm_medium=native&utm_campaign=TABO-DE-desk
Title: slow-watches.com

Search URL Search Domain Scan URL

URL: https://taongafarm.com/de/landings/gp/6/?ref=ads_W_040119_DE_Click_Image&mng=DK&utm_source=taboola&utm_term=1039694_cbsinteractive-zdnet&utm_content=275672693
Title: Taonga: Die tropische Farm

Search URL Search Domain Scan URL

URL: https://om.elvenar.com/ox/de/?ref=tab_de_dach_incubator&&external_param=281115997&pid=cbsinteractive-zdnet&bid=281115997
Title: Elvenar

Search URL Search Domain Scan URL

URL: https://www.holzkern.com/de/neuigkeiten/der-holzkern-friends-rabatt.html?utm_source=taboola&utm_medium=cbsinteractive-zdnet&utm_campaign=2742836
Title: Holzkern

Search URL Search Domain Scan URL

URL: https://www.schnellesangebot.de/treppenlift/?utm_content=4446-im_200-ad_sparen_bei_einem_tr-bs_re&utm_img=200-104-nrs-sta_gen-np-nt-nb-not&utm_source=taboola&utm_medium=cpc&utm_campaign=sta_gen-2002154-de-pr-prp_compare_prices&utm_ctype=disp&utm_term=1039694
Title: schnellesangebot.de

Search URL Search Domain Scan URL

URL: https://www.austria.info/de/aktivitaten/radfahren/rad-urlaub-in-osterreich/genussradfahren/neusiedler-see-radweg?utm_source=taboola&utm_medium=cbsinteractive-zdnet&utm_campaign=BER1902002_tk_rad_genuss_r0702&utm_content=r0702-D
Title: austria.info

Search URL Search Domain Scan URL

URL: https://www.remind.me/lp/seien-auch-sie-automatisch-immer-im-besten-stromtarif?utm_medium=cbsinteractive-zdnet_1_1039694_1_2019-10-03+14%3A47%3A33_1_2832531_1_276015840_1_http%3A%2F%2Fcdn.taboola.com%2Flibtrc%2Fstatic%2Fthumbnails%2F98acfa7a2cedb3b3cd2a93d242ebb05b.jpg_1_Stromkosten%3A+Mit+diesem+Trick+mehrere+hundert+Euro+sparen&utm_source=taboola&utm_campaign=mediumCTR-mediumCPC-diversityUnique-seperateLP-Desk_1_Desktop_1_zdnet.com
Title: remind.me

Search URL Search Domain Scan URL

URL: http://cbsi.force.com/CBSi/zdnetcommunityfaq
Title: Community Guidelines

Search URL Search Domain Scan URL

URL: http://www.cbsinteractive.com/legal/cbsi/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://cbsi.secure.force.com/CBSi/articles/FAQ/Privacy-Policy?categories=CBS_Interactive%3AmPrivacy&template=template_mobilePrivacy&referer=mobileprivacy.com&data=&cfs=default
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://cbsi.secure.force.com/CBSi/articles/FAQ/mThird-Party-Social-Networking-Services?template=template_mobilepp&referer=mobilepp.com&data=&cfs=default
Title: Video Services Policy

Search URL Search Domain Scan URL

URL: https://cbslnk.cbsileads.com/redir?edition=en&ursuid=&devicetype=desktop&pagetype=article&assettitle=this+huge+android+trojan+malware+campaign+was+discovered+after+the+gang+behind+it+made+basic+security+mistakes&assettype=content_article&topicguid=&viewguid=eaa95f35-b837-473b-90a5-6449462fcf2d&docid=33161585&promo=2150&ftag_cd=LGN22ef1e6&spotname=right-rail&destUrl=https%3A%2F%2Fwww.techrepublic.com%2Fresource-library%2Fwhitepapers%2Fit-security-and-privacy-concerns-initiatives-and-predictions-techrepublic-premium%2F%3Fpromo%3D2150%26ftag%3DLGN22ef1e6%26cval%3Dright-rail%26source%3Dzdnet&ctag=medc-right-rail&siteId=2&rsid=cnetzdnetglobalsite&sl=en&sc=&assetguid=1b0217ac-3a72-470b-9289-742af80ceb70&q=&cval=33161585;2150&ttag=&bhid=
Title: IT security and privacy: Concerns, initiatives, and predictions (TechRepublic Premium)

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/resource-library/company/techrepublic-premium/
Title: TechRepublic Premium

Search URL Search Domain Scan URL

URL: https://cbslnk.cbsileads.com/redir?edition=en&ursuid=&devicetype=desktop&pagetype=article&assettitle=this+huge+android+trojan+malware+campaign+was+discovered+after+the+gang+behind+it+made+basic+security+mistakes&assettype=content_article&topicguid=&viewguid=eaa95f35-b837-473b-90a5-6449462fcf2d&docid=177482&promo=2150&ftag_cd=LGN22ef1e6&spotname=right-rail&destUrl=https%3A%2F%2Fwww.techrepublic.com%2Fresource-library%2Fwhitepapers%2Fconfigure-the-windows-xp-firewall-to-allow-remote-desktop-access%2F%3Fpromo%3D2150%26ftag%3DLGN22ef1e6%26cval%3Dright-rail%26source%3Dzdnet&ctag=medc-right-rail&siteId=2&rsid=cnetzdnetglobalsite&sl=en&sc=&assetguid=1b0217ac-3a72-470b-9289-742af80ceb70&q=&cval=177482;2150&ttag=&bhid=
Title: Configure the Windows XP Firewall to allow Remote Desktop access

Search URL Search Domain Scan URL

URL: https://cbslnk.cbsileads.com/redir?edition=en&ursuid=&devicetype=desktop&pagetype=article&assettitle=this+huge+android+trojan+malware+campaign+was+discovered+after+the+gang+behind+it+made+basic+security+mistakes&assettype=content_article&topicguid=&viewguid=eaa95f35-b837-473b-90a5-6449462fcf2d&docid=4275939&promo=2150&ftag_cd=LGN22ef1e6&spotname=right-rail&destUrl=https%3A%2F%2Fwww.techrepublic.com%2Fresource-library%2Fwhitepapers%2Fcomputer-equipment-disposal-policy%2F%3Fpromo%3D2150%26ftag%3DLGN22ef1e6%26cval%3Dright-rail%26source%3Dzdnet&ctag=medc-right-rail&siteId=2&rsid=cnetzdnetglobalsite&sl=en&sc=&assetguid=1b0217ac-3a72-470b-9289-742af80ceb70&q=&cval=4275939;2150&ttag=&bhid=
Title: Computer Equipment Disposal Policy

Search URL Search Domain Scan URL

URL: https://www.facebook.com/pages/ZDNet/5953112932
Title:

Search URL Search Domain Scan URL

URL: http://twitter.com/zdnet
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/zdnet-com
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCr9QWb5RKLfaunjKHJZAdQQ
Title:

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/cookies
Title: Cookies

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/adchoice
Title: Ad Choice

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/eula
Title: Mobile User Agreement

Search URL Search Domain Scan URL

URL: http://narratives.zdnet.com/
Title: Sponsored Narratives

Search URL Search Domain Scan URL

URL: https://cbsi.secure.force.com/CBSi/knowledgehome?referer=zdnet.com
Title: Site Assistance

Search URL Search Domain Scan URL

URL: https://academy.zdnet.com/
Title: ZDNet Academy

Search URL Search Domain Scan URL

URL: https://www.cbsinteractive.com/legal/cbsi/privacy-policy/cookies-and-beacons
Title: cookie policy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 71

https://tags.bluekai.com/site/20486?limit=0&id=5978151504331401042&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=5978151504331401042%26eid=50056 HTTP 302
https://ml314.com/csync.ashx?fp=jUmQ1999999cVoj5&person_id=5978151504331401042&eid=50056

Request Chain 72

https://idsync.rlcdn.com/395886.gif?partner_uid=5978151504331401042 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTNTk3ODE1MTUwNDMzMTQwMTA0MhAAGg0IgZTY7AUSBQjoBxAAQgBKAA HTTP 307
https://ml314.com/csync.ashx?fp=&person_id=5978151504331401042&eid=50082

Request Chain 73

https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151504331401042%26eid=50220 HTTP 302
https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151504331401042%26eid=50220&mm_bnc&mm_bct&UUID=89595d95-ffff-4a00-9bf8-9d710024a4de HTTP 302
https://ml314.com/csync.ashx?fp=89595d95-ffff-4a00-9bf8-9d710024a4de&person_id=5978151504331401042&eid=50220

Request Chain 74

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151504331401042 HTTP 302
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151504331401042 HTTP 302
https://ml314.com/csync.ashx?fp=83becc4622982f58041f38d277ff8aed&eid=50146&person_id=5978151504331401042

Request Chain 75

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2g9CG1JWOcF0M-vMOFbSsgm_LYKugFGkpxLVWMhOTk2k&gdpr=1&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil HTTP 302
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil

Request Chain 76

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=5978151504331401042&redir= HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=5978151504331401042&redir=

Request Chain 107

https://pixel.everesttech.net/4083/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__EFOPTOUT__%26throttleCookie%3D__EFSYNC__%26time%3D__EFTIME__ HTTP 302
https://www.everestjs.net/static/pixel_details.html

Request Chain 121

https://cm.everesttech.net/cm HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WFpZS0FRQUFBYy04UnYzSQ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEDa7u26vykZvUyuIYU6a0P0&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 125

https://sb.scorecardresearch.com/b?c1=2&c2=3005086&ns__t=1570114050021&ns_c=UTF-8&c8=This%20huge%20Android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made%20basic%20security%20mistakes%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&c9= HTTP 302
https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1570114050021&ns_c=UTF-8&c8=This%20huge%20Android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made%20basic%20security%20mistakes%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&c9=

Request Chain 126

https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/%23ftag%3DRSSbaffb68%7C&rp=&ts=compact&rnd=1570114050022 HTTP 302
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/%23ftag%3DRSSbaffb68%7C&rp=&ts=compact&rnd=1570114050022&ja=1

Request Chain 145

https://www.googleadservices.com/pagead/conversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0 HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=AgqWXYrSCY7d7gPSm4vwAw&random=1235091298&sscte=1&crd=&gtd= HTTP 302
https://www.google.com/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1235091298&crd=&is_vtc=1&random=2175587563 HTTP 302
https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1235091298&crd=&is_vtc=1&random=2175587563&ipr=y

442 HTTP transactions
12 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/ 459 KB
109 KB 208ms
191ms Document
text/html 2.18.233.143
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a2-18-233-143.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

3a3614a42534b29d568b64422700905b31ec791ef05f6a2aafb88ed1503c2007

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.zdnet.com
:scheme: https
:path: /article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1

Response headers

status: 200
server: nginx
content-type: text/html; charset=UTF-8
cache-control: max-age=5400, private
x-tx-id: 3f8c2e71-ccaa-4003-aca9-0d75f91c3b72
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
expires: Thu, 03 Oct 2019 15:40:17 GMT
last-modified: Thu, 03 Oct 2019 14:10:17 GMT
content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
x-frame-options: SAMEORIGIN
access-control-allow-origin: https://www.zdnet.com
content-encoding: gzip
accept-ranges: bytes
content-length: 110352
date: Thu, 03 Oct 2019 14:47:28 GMT
set-cookie: fly_device=desktop; expires=Thu, 10-Oct-2019 14:47:28 GMT; path=/; domain=.zdnet.com; secure fly_geo={"countryCode": "de"}; expires=Thu, 10-Oct-2019 14:47:28 GMT; path=/; domain=.zdnet.com; secure fly_preferred_edition=eu; path=/; domain=.zdnet.com; secure fly_default_edition=eu; path=/; domain=.zdnet.com; secure
vary: Accept-Encoding, User-Agent
strict-transport-security: max-age=63072000; includeSubDomains; preload

GET
H2 200 main-a78f3c243e-rev.css
zdnet2.cbsistatic.com/fly/1814-fly/css/core/ 355 KB
64 KB 23ms
6ms Stylesheet
text/css 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/1814-fly/css/core/main-a78f3c243e-rev.css

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

58c3593e62aeda27dc92790ddb33fd7ff8cfb0f7a9c154bc9ebad50afc2dd764

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83065
status: 200
vary: Accept-Encoding
content-length: 65260
x-xss-protection: 1; mode=block
last-modified: Wed, 02 Oct 2019 15:38:02 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d94c45a-58a01"
strict-transport-security: max-age=31536000
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 09 Oct 2019 15:43:02 GMT

GET
H2 200 controls-b84eef3a0e-rev.css
zdnet3.cbsistatic.com/fly/css/video/htmlPlayerControls/ 41 KB
7 KB 23ms
7ms Stylesheet
text/css 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-b84eef3a0e-rev.css

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

bf069cddda8cd2b6740b460e576c56eaa88cc2e939d8d764b99fa4b87f26ffad

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83065
status: 200
vary: Accept-Encoding
content-length: 6563
x-xss-protection: 1; mode=block
last-modified: Wed, 02 Oct 2019 15:38:16 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d94c468-a53d"
strict-transport-security: max-age=31536000
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 09 Oct 2019 15:43:02 GMT

GET
H2 200 evidon-sitenotice-tag.js Show response
zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/ 69 KB
14 KB 7ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

8998e68f9bb1686ca1e03fcf3f0d6ea669c32d1f3554aeea809f1b1824ff6625

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 126449
status: 200
vary: Accept-Encoding
content-length: 13960
x-xss-protection: 1; mode=block
last-modified: Tue, 01 Oct 2019 15:02:29 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d936a85-1134e"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 09 Oct 2019 03:39:58 GMT

GET
H2 200 country.js Show response
c.evidon.com/geo/ 260 B
512 B 27ms
6ms Script
application/x-javascript 23.0.46.190
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://c.evidon.com/geo/country.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.0.46.190 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-0-46-190.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: f9784f57729f84391b084eed9e944e048f771129d65e9b58f34095fdfba86473

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
last-modified: Wed, 30 May 2018 22:23:16 GMT
server: AkamaiNetStorage
status: 200
etag: "c1e367d098d326049811561575dbda4a:1527718996"
access-control-max-age: 86400
access-control-allow-methods: GET,OPTIONS,POST
content-type: application/x-javascript
access-control-allow-origin
accept-ranges: bytes
access-control-allow-headers: *
content-length: 260

GET
H2 200 snthemes.js Show response
zdnet3.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/ 94 KB
8 KB 6ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/snthemes.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

39f0e13a96fd029965b5b5fd3504853b6fe6ded07b4dd8862a0e033be626e655

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 328199
status: 200
vary: Accept-Encoding
content-length: 7763
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Sep 2019 14:04:37 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d8cc575-177f3"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 06 Oct 2019 19:17:33 GMT

GET
H2 200 settings.js Show response
zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/ 33 KB
2 KB 31ms
5ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/settings.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

ad7ed17bf4c8d9dd2511e7254670822d0f90c8fb89187f860cfbcb91821abc84

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 209890
status: 200
vary: Accept-Encoding
content-length: 1669
x-xss-protection: 1; mode=block
last-modified: Mon, 30 Sep 2019 12:27:34 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d91f4b6-828e"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 08 Oct 2019 04:24:39 GMT

GET
H2 200 en.js Show response
zdnet2.cbsistatic.com/fly/js/libs/evidon/translations/ 311 KB
14 KB 7ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/libs/evidon/translations/en.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

caab9bbec165591d5214448b624dae44a3cbc575721ba71da2f7130bbbcbc6dc

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 293901
status: 200
vary: Accept-Encoding
content-length: 14353
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Sep 2019 14:07:20 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d8cc618-4ddff"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 07 Oct 2019 05:08:55 GMT

GET
DATA 200
OK truncated
/ 917 B
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H2 200 dannypalmer-author.jpg
zdnet3.cbsistatic.com/hub/i/r/2016/03/11/8691cddd-cac4-4268-abf4-4051e392aa35/thumbnail/40x40/461dbf406bd95edba75058b11c556066/ 920 B
1 KB 6ms
5ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2016/03/11/8691cddd-cac4-4268-abf4-4051e392aa35/thumbnail/40x40/461dbf406bd95edba75058b11c556066/dannypalmer-author.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

e41f9d0fb2d51a0375967a0ef23dac71eabde665b7ad3af7cf65e2f5f0cb784a

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
x-content-type-options: nosniff
age: 6719113
status: 200
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 920
x-xss-protection: 1; mode=block
last-modified: Mon, 16 Oct 2017 07:57:34 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 16 Jul 2020 20:21:29 GMT

GET
H2 200 5a982d2860b2c8bf2ebef58a-1280x7201mar022018170154poster.jpg
zdnet3.cbsistatic.com/hub/i/r/2018/03/02/c61c6d86-94dc-412c-bdc8-21a24efa1682/thumbnail/570x322/af8c57de47d759b84b358760f97df4ad/ 32 KB
32 KB 6ms
6ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2018/03/02/c61c6d86-94dc-412c-bdc8-21a24efa1682/thumbnail/570x322/af8c57de47d759b84b358760f97df4ad/5a982d2860b2c8bf2ebef58a-1280x7201mar022018170154poster.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

5574db931bbea790fb2c4188f4bc676c15b2464676b38ff8c0021358247b4084

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1873990
status: 200
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 32726
x-xss-protection: 1; mode=block
last-modified: Sat, 03 Mar 2018 16:30:29 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 10 Sep 2020 22:06:46 GMT

GET
H2 200 advertisement.js Show response
zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/utils/ 53 B
177 B 8ms
8ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/utils/advertisement.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

07b69027231d985f5bdcd4d5a539f120d26003feef6e9dc0a6b77a4b43a9b21f

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 516939
status: 200
vary: Accept-Encoding
content-length: 71
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Sep 2019 14:04:37 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d8cc575-35"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 04 Oct 2019 15:11:49 GMT

GET
H2 200 beardedcomputeruseristock-823708524.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/10/03/1db9369a-7fa2-4576-80a5-b1510d227aa9/thumbnail/170x128/b781c1f105d6de425a859bba5451ebde/ 7 KB
7 KB 22ms
5ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/10/03/1db9369a-7fa2-4576-80a5-b1510d227aa9/thumbnail/170x128/b781c1f105d6de425a859bba5451ebde/beardedcomputeruseristock-823708524.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

59261cdd3b53d64db22f1d9d4861cc28bca4faa6973bfd1d3e7dcc399514e7d4

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5121
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 6689
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "220787ad7829c9cbc7e9953cb1c36fb3"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 minerva-attack.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/10/03/8f2751d7-c1f6-4c5c-b5af-37c572e326a4/thumbnail/170x128/72701dc1ba0727bc9e36618adb30b4ab/ 4 KB
5 KB 8ms
5ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/10/03/8f2751d7-c1f6-4c5c-b5af-37c572e326a4/thumbnail/170x128/72701dc1ba0727bc9e36618adb30b4ab/minerva-attack.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f4a55016f0aed60d4dfb0b5a4e33f19506ee81676255d4c44cf59c5723ae599f

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6754
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4461
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "4607f7fff0dce694258e1c637512aa9d"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 airbus.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/01/30/a03b8e17-e950-40fc-a6db-54c16d4b324d/thumbnail/170x128/212d28e159bb3452e9d898f6231fd628/ 4 KB
4 KB 10ms
7ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/01/30/a03b8e17-e950-40fc-a6db-54c16d4b324d/thumbnail/170x128/212d28e159bb3452e9d898f6231fd628/airbus.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

5b9f8d91fd1ac54f80ad47c1cb12cda6a08c30220a25b9a0b16a44e76ba68f97

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7585
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 3631
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "8a057268a74a5f1201285aa667585e15"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screenshot-2019-10-03-at-09-41-19.png
zdnet1.cbsistatic.com/hub/i/r/2019/10/03/15b466f6-329c-4266-b7c1-634919d9768a/thumbnail/170x128/9566472c8fda054f4149aa7f27df3603/ 27 KB
27 KB 22ms
6ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/10/03/15b466f6-329c-4266-b7c1-634919d9768a/thumbnail/170x128/9566472c8fda054f4149aa7f27df3603/screenshot-2019-10-03-at-09-41-19.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

0532a453613b2794bb06248e47c054774e515c65f524ec50f56bf06c6239721d

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11168
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 27609
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "8c5b85b2e2efb5bc2756a63747c720e9"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screenshot-2019-10-03-at-09-40-51.png
zdnet1.cbsistatic.com/hub/i/r/2019/10/03/fb8b4159-1feb-4cff-9d63-1719a71851fe/thumbnail/170x128/ee558c67639c5055a54134b64da2275c/ 31 KB
31 KB 32ms
16ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/10/03/fb8b4159-1feb-4cff-9d63-1719a71851fe/thumbnail/170x128/ee558c67639c5055a54134b64da2275c/screenshot-2019-10-03-at-09-40-51.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

18c80b69f54f5ecec1c56c3d0487d30d253b89afac6238fba5421b873d2bfe20

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
x-content-type-options: nosniff
age: 14484
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 31933
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "83cbc5e9ad9b537435036c2cdc4b0074"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 ea.png
zdnet1.cbsistatic.com/hub/i/r/2018/11/19/db29fce8-1e2b-4ec6-bb98-b1e984538f07/thumbnail/170x128/6cfe29e80aa994783a081975a016677c/ 36 KB
36 KB 30ms
15ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2018/11/19/db29fce8-1e2b-4ec6-bb98-b1e984538f07/thumbnail/170x128/6cfe29e80aa994783a081975a016677c/ea.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

16579b3be4b9ff233cf69e36de77806864cbac2f7a9a38c260cd6bab1533a4e3

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20837
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 36826
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "8eb8c14637ad7f04b17390e3c4b16ec9"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 anu-campus-web.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/06/04/3e8f4544-211c-4df3-91b9-b629cadb8c75/thumbnail/170x128/52ef880880cb9e3ea0948a095b0f7cc9/ 7 KB
7 KB 9ms
8ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/06/04/3e8f4544-211c-4df3-91b9-b629cadb8c75/thumbnail/170x128/52ef880880cb9e3ea0948a095b0f7cc9/anu-campus-web.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

4ff5a40256550a6f0d72038d0ec04c7719f348def3332a07ca50f91241985703

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 53440
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 7435
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "ae78510109d46b0a6eef9820a4ca95d6"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 ddos-internet-globe-map.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/10/02/9be7f25b-d4a8-4277-86cc-96ecc6af40e2/thumbnail/170x128/673eb18a4780ed6d4137055fe99b19f5/ 7 KB
8 KB 26ms
11ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/10/02/9be7f25b-d4a8-4277-86cc-96ecc6af40e2/thumbnail/170x128/673eb18a4780ed6d4137055fe99b19f5/ddos-internet-globe-map.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

dff4eb735fd3d80c028700698284f23d640934c14f8f0c2999b226c25095b7ba

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
x-content-type-options: nosniff
age: 57291
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 7644
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "ef0b9a69f90b1ab0228784ccc7d52136"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 zendesk.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/10/02/58133c91-a780-4f47-9b5e-1d5d12aaf343/thumbnail/170x128/029900c8dd71d3a3afc471d162b29577/ 4 KB
5 KB 7ms
6ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/10/02/58133c91-a780-4f47-9b5e-1d5d12aaf343/thumbnail/170x128/029900c8dd71d3a3afc471d162b29577/zendesk.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

9af9801de1b09aeecde53cd208449ab6dd1ee253ef070fddebb8b2b0a43bdf2d

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75865
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4538
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "3596c80a46918e6dde2f3c37290cba47"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 require-2.1.2.js Show response
zdnet2.cbsistatic.com/fly/1814-fly/js/libs/ 16 KB
6 KB 7ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83065
status: 200
vary: Accept-Encoding
content-length: 6305
x-xss-protection: 1; mode=block
last-modified: Wed, 02 Oct 2019 15:37:59 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d94c457-3f09"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 09 Oct 2019 15:43:02 GMT

GET
H2 200 mag-white01.png
zdnet3.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/core/ 1 KB
1 KB 7ms
7ms Image
image/png 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/core/mag-white01.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://zdnet2.cbsistatic.com/fly/1814-fly/css/core/main-a78f3c243e-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83066
status: 200
vary: Accept-Encoding
content-length: 936
x-xss-protection: 1; mode=block
last-modified: Wed, 02 Oct 2019 15:35:27 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d94c3bf-4f1"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 09 Oct 2019 15:43:02 GMT

GET
H2 200 Raleway-Bold.woff2
zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/ 51 KB
51 KB 19ms
6ms Font
font/woff2 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Bold.woff2

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

9db8bd3e641dc88d54edf476a148e75e29b4e8ccd040cb340404d557578dcfbd

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://zdnet2.cbsistatic.com/fly/1814-fly/css/core/main-a78f3c243e-rev.css
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
x-content-type-options: nosniff
age: 6224116
status: 200
vary: Accept-Encoding
content-length: 52212
x-xss-protection: 1; mode=block
last-modified: Tue, 23 Jul 2019 09:13:41 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d36cfc5-cbf4"
strict-transport-security: max-age=31536000
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 22 Jul 2020 12:03:46 GMT

GET
H2 200 Raleway-Regular.woff2
zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/ 50 KB
50 KB 30ms
17ms Font
font/woff2 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Regular.woff2

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

66ef1b7581d8ef7b82bfe2ca363a612a479d89b808e2241f68d3e8c75f4f06d4

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://zdnet2.cbsistatic.com/fly/1814-fly/css/core/main-a78f3c243e-rev.css
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
x-content-type-options: nosniff
age: 2973446
status: 200
vary: Accept-Encoding
content-length: 51572
x-xss-protection: 1; mode=block
last-modified: Thu, 29 Aug 2019 19:30:36 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d6827dc-c974"
strict-transport-security: max-age=31536000
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 29 Aug 2020 04:43:37 GMT

GET
H2 200 Raleway-Light.woff2
zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/ 50 KB
51 KB 30ms
17ms Font
font/woff2 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Light.woff2

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

6de73873dd441f953668e77030299f082e0f3e6335bf944d88d44978162e6609

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://zdnet2.cbsistatic.com/fly/1814-fly/css/core/main-a78f3c243e-rev.css
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
x-content-type-options: nosniff
age: 6813634
status: 200
vary: Accept-Encoding
content-length: 51608
x-xss-protection: 1; mode=block
last-modified: Tue, 16 Jul 2019 08:38:39 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d2d8d0f-c998"
strict-transport-security: max-age=31536000
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 15 Jul 2020 18:06:51 GMT

GET
H2 200 ring-animated.svg
zdnet2.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/video/ 704 B
482 B 6ms
5ms Image
image/svg+xml 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/video/ring-animated.svg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

0025565f0cddfceb7ebdbc4b21d2552c894998e443153f97a6e8b353dfd9bebd

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://zdnet3.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-b84eef3a0e-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83063
status: 200
vary: Accept-Encoding
content-length: 364
x-xss-protection: 1; mode=block
last-modified: Wed, 02 Oct 2019 15:35:27 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d94c3bf-2c0"
strict-transport-security: max-age=31536000
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 01 Oct 2020 15:43:04 GMT

GET
H2 200 vendorlist.js Show response
zdnet2.cbsistatic.com/fly/js/libs/evidon/ 113 KB
51 KB 6ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/libs/evidon/vendorlist.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

eb07b53d262575cef96004e2be725ac235db39262e9bb8466a2a9b85cf532aa8

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 559733
status: 200
vary: Accept-Encoding
content-length: 52305
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Sep 2019 14:07:20 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d8cc618-1c3b9"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 04 Oct 2019 03:05:20 GMT

GET
H2 200 logo.png
zdnet1.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/core/ 4 KB
4 KB 6ms
6ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/core/logo.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://zdnet2.cbsistatic.com/fly/1814-fly/css/core/main-a78f3c243e-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83065
status: 200
vary: Accept-Encoding
content-length: 4128
x-xss-protection: 1; mode=block
last-modified: Wed, 02 Oct 2019 15:35:27 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d94c3bf-1009"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 09 Oct 2019 15:43:02 GMT

GET
H2 200 main.default.js Show response
zdnet3.cbsistatic.com/fly/1814-fly/js/ 209 KB
69 KB 6ms
5ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

15102dc05e413115725f527ef7a26007562147b84910f3aa2b589d4ca52b114d

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83065
status: 200
vary: Accept-Encoding
content-length: 70772
x-xss-protection: 1; mode=block
last-modified: Wed, 02 Oct 2019 15:38:01 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d94c459-342bc"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 09 Oct 2019 15:43:03 GMT

GET
H/1.1 200
OK ls-zdnet.js Show response
js-sec.indexww.com/ht/ 85 KB
26 KB 22ms
8ms Script
text/javascript 2.18.234.21
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 57e1e8e64fe95a0acc0822d690633b9450b26919fcedc32958ebcf7d39393181

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:28 GMT
Content-Encoding: gzip
Last-Modified: Thu, 03 Oct 2019 14:10:29 GMT
Server: Apache
ETag: "763ab9-15269-5940225dde75d"
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=1473
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 26184
Expires: Thu, 03 Oct 2019 15:12:01 GMT

GET
H2 200 YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Show response
c.go-mpulse.net/boomerang/ Frame A799 187 KB
55 KB 24ms
24ms Script
application/javascript 104.111.214.229
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.214.229 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-111-214-229.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/javascript;charset=UTF-8
status: 200
cache-control: max-age=604800, s-maxage=604800
timing-allow-origin: *
content-length: 56060

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 44 KB
14 KB 40ms
39ms Script
text/javascript 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

sffe /

Resource Hash

3d5f6fa3e5acb251b5c5f3ab93c17237961d8dfcd1a5ea1265f1334e448dbf5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "297 / 651 of 1000 / last-modified: 1570111537"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14319
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:28 GMT

GET
H2 200 sfp.js Show response
native.sharethrough.com/assets/ 419 KB
118 KB 142ms
125ms Script
application/javascript 13.224.196.129
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://native.sharethrough.com/assets/sfp.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.196.129 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-224-196-129.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 95afa5dd49afcfca5657bbb020523f5d9a5c8dd6723f49a3b5f34e46619f6a96

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 11:15:44 GMT
content-encoding: gzip
last-modified: Tue, 01 Oct 2019 16:10:09 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=3600
x-amz-cf-id: WamtUN4nnSOSimeBahshjAI0JJx9gZWbKwdpvc3UFgPoLO9RveQmWw==
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
expires: Tue, 01 Oct 2019 17:10:07 GMT

GET
H2 200 evidon-banner.js Show response
zdnet2.cbsistatic.com/fly/js/libs/evidon/ 8 KB
3 KB 7ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/libs/evidon/evidon-banner.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

c649aaa88ce29f86caa50dc08e1745c9783e049656ff2d5a93ef813b7f0c662a

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 126418
status: 200
vary: Accept-Encoding
content-length: 2440
x-xss-protection: 1; mode=block
last-modified: Tue, 01 Oct 2019 15:04:58 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d936b1a-1faf"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 09 Oct 2019 03:40:12 GMT

GET
H2 204 18863
l.betrad.com/site/v3/425/3445/3/1/2/2/ 0
120 B 283ms
94ms Image
text/plain 34.205.11.82
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://l.betrad.com/site/v3/425/3445/3/1/2/2/18863?consent=1
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.205.11.82 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-205-11-82.compute-1.amazonaws.com
Software: / Express
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: gzip
x-powered-by: Express
etag: W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary: Accept-Encoding

GET
H2 200 ;ord=1570114048866
ad.doubleclick.net/ddm/ad/owilswwwyw/ 43 B
551 B 29ms
15ms Image
image/gif 216.58.205.230
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/ad/owilswwwyw/;ord=1570114048866?

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.205.230 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s24-in-f230.1e100.net

Software

cafe /

Resource Hash

9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Oct 2019 14:47:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 43
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
536 B 90ms
29ms XHR
application/json 63.32.199.154
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=184216
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 63.32.199.154 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-63-32-199-154.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 67b52db6ed5b65b65fe31e571ea2fb05a59a32d890de15782f1a3166391a31ad

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
x-aspnet-version: 4.0.30319
status: 200
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.zdnet.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Sat, 02 Nov 2019 14:47:28 GMT

GET
H2 204 18863
l.betrad.com/site/v3/425/3445/3/4/2/2/ 0
120 B 255ms
95ms Image
text/plain 34.205.11.82
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://l.betrad.com/site/v3/425/3445/3/4/2/2/18863?consent=1
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.205.11.82 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-205-11-82.compute-1.amazonaws.com
Software: / Express
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: gzip
x-powered-by: Express
etag: W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary: Accept-Encoding

GET
H2 200 urs.js Show response
urs.zdnet.com/sdk/ 50 KB
50 KB 256ms
115ms Script
application/javascript 35.190.38.167
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://urs.zdnet.com/sdk/urs.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.190.38.167 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 167.38.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
via: 1.1 google
last-modified: Thu, 07 Feb 2019 14:05:56 GMT
etag: "5c5c3b44-c7f5"
content-type: application/javascript
status: 200
accept-ranges: bytes
alt-svc: clear
content-length: 51189

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
656 B 31ms
17ms Script
application/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
656 B 29ms
15ms Script
application/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_modern_2019092602.js Show response
securepubads.g.doubleclick.net/gpt/ 145 KB
56 KB 40ms
40ms Script
text/javascript 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_2019092602.js?21064579

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

sffe /

Resource Hash

831d19d3c80ca082ccf9394743c71280aa5a2b7c40b8176382eb1ce20ad06ae7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 26 Sep 2019 18:43:36 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 56843
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:28 GMT

GET
H2 200 scrolling-mpu-22779a851e-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 956 B
598 B 6ms
5ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/scrolling-mpu-22779a851e-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

4d565f67641c732365c3180ec1e37c7a987825faad3e8632de8a07a9101feedd

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80780
status: 200
vary: Accept-Encoding
content-length: 491
x-xss-protection: 1; mode=block
last-modified: Wed, 02 Oct 2019 15:37:53 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d94c451-3bc"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 09 Oct 2019 16:21:08 GMT

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 93 KB
19 KB 25ms
7ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8FC3) /
Resource Hash: 64cfd2a647408273e2609b638b29d1f10370824f0169ee4db637edac660dfb66

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
last-modified: Mon, 16 Sep 2019 18:11:12 GMT
server: ECAcc (frc/8FC3)
etag: "4063075910"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=300
accept-ranges: bytes
content-length: 19393
expires: Thu, 03 Oct 2019 14:52:28 GMT

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/ Frame A799 2 KB
1 KB 36ms
35ms XHR
application/json 104.111.214.229
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5233713&v=1.571.0&if=&sl=0&si=ei2o70ylniq-NaN&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,LOGN&acao=
Requested by: Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.214.229 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-111-214-229.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 8c556813deb0bd2ee2613cf1dc08d4744b1aab6755f593f951e892a51c516845

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:28 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 690

GET
H/1.1 200
OK isInternalUser.js Show response
iicbsi-a.akamaihd.net/common/js/esi/ 22 B
272 B 25ms
6ms Script
application/x-javascript 2a01:4a0:1338:28::c38a:ff18
NETZBETRIEB-GMBH

General

Check archive.org

Show headers Download Go to

Full URL: https://iicbsi-a.akamaihd.net/common/js/esi/isInternalUser.js?cb=cbsiInternal
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a01:4a0:1338:28::c38a:ff18 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:28 GMT
Cache-Control: max-age=211043
Server: AkamaiNetStorage
Connection: keep-alive
ETag: "fb25287978f1b619e801f164a2dfd9ea:1473886414"
Content-Length: 22
Content-Type: application/x-javascript

GET
H2 200 vglnk.js Show response
cdn.viglink.com/api/ 78 KB
28 KB 65ms
30ms Script
text/javascript 2606:4700::6810:a20d
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.viglink.com/api/vglnk.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a20d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1452718
cf-ray: 51ffb6266f4ccbb4-VIE
status: 200
content-length: 27719
x-amz-id-2: HNEV4caKoOdziBrXGZIDp4CzG6boiBMb4TLu65nU6otYm4+p2OQwr1vWix1CX0FBodMy916W6w4=
last-modified: Mon, 16 Sep 2019 19:15:01 GMT
server: cloudflare
etag: "1545d811432c0074356408ee8f6c1e23"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: FB54A2C70C0BB866
cache-control: public, max-age=1800
accept-ranges: bytes
content-type: text/javascript
expires: Thu, 03 Oct 2019 15:17:29 GMT

GET
H2 200 utag.1779.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 3 KB
2 KB 6ms
5ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1779.js?utv=ut4.43.201812051842
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8F05) /
Resource Hash: cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: gzip
last-modified: Mon, 11 Jul 2016 20:43:57 GMT
server: ECAcc (frc/8F05)
etag: "392561602"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1785
expires: Fri, 18 Oct 2019 14:47:29 GMT

GET
H2 200 utag.1782.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
1 KB 12ms
11ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8F54) /
Resource Hash: 791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
last-modified: Mon, 29 Oct 2018 17:20:42 GMT
server: ECAcc (frc/8F54)
etag: "3447796852"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1071
expires: Fri, 18 Oct 2019 14:47:28 GMT

GET
H2 200 utag.1787.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 142 KB
48 KB 12ms
12ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8F4A) /
Resource Hash: 95ec4dea002be118a633dc5070c23358d10e179ad3de44f23ac97578c6971df7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
last-modified: Wed, 04 Sep 2019 18:05:01 GMT
server: ECAcc (frc/8F4A)
etag: "3504427907"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 48569
expires: Fri, 18 Oct 2019 14:47:28 GMT

GET
H2 200 utag.1790.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
981 B 8ms
8ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1790.js?utv=ut4.43.201805241512
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8F4D) /
Resource Hash: 10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
last-modified: Mon, 01 Aug 2016 14:31:10 GMT
server: ECAcc (frc/8F4D)
etag: "2267415266"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 872
expires: Fri, 18 Oct 2019 14:47:28 GMT

GET
H2 200 utag.1791.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
1 KB 13ms
13ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1791.js?utv=ut4.43.201805241512
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8FD1) /
Resource Hash: 7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
last-modified: Mon, 01 Aug 2016 14:31:10 GMT
server: ECAcc (frc/8FD1)
etag: "3334871598"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1196
expires: Fri, 18 Oct 2019 14:47:28 GMT

GET
H2 200 utag.1792.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 4 KB
2 KB 14ms
13ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1792.js?utv=ut4.43.201805241512
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8FD0) /
Resource Hash: dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
last-modified: Thu, 28 Jul 2016 14:28:47 GMT
server: ECAcc (frc/8FD0)
etag: "2022868805"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1664
expires: Fri, 18 Oct 2019 14:47:28 GMT

GET
H2 200 utag.1797.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
972 B 8ms
8ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8F79) /
Resource Hash: 3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:28 GMT
content-encoding: gzip
last-modified: Wed, 25 Jan 2017 20:07:58 GMT
server: ECAcc (frc/8F79)
etag: "1907756232+gzip"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 883
expires: Fri, 18 Oct 2019 14:47:28 GMT

GET
H2 200 lightbox.js Show response
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame D4FD 326 B
401 B 21ms
21ms Script
application/javascript 2606:4700::6810:4fa5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1570114048993&lv=1
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 192a41b3a2ef7d13301354b3131babb5890472f61ebf9dbff4b461903ec719c6

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
server: cloudflare
age: 245497
x-powered-by: ASP.NET
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cf-ray: 51ffb62649d2cba8-VIE

GET
H/1.1 200
OK ds.js Show response
dw.cbsi.com/js/cbsi/ 18 KB
7 KB 457ms
147ms Script
application/javascript 64.30.230.22
CBS Interactive Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://dw.cbsi.com/js/cbsi/ds.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1790.js?utv=ut4.43.201805241512
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS: phx2-dw-cbsi-xw-ext-lb.cnet.com
Software: Apache/2.4.25 /
Resource Hash: d696da403b0169c2191d0ec0b0fcdaa85487b21b19fd58f4b1fb5b9edf40b153

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:29 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Sep 2017 19:06:40 GMT
Server: Apache/2.4.25
ETag: "1917-55916dc13f000"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=43200, s-maxage=1800
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=80, max=905
Content-Length: 6423
Expires: Thu, 03 Oct 2019 15:17:29 GMT

GET
H2 200 cbsinteractive.js Show response
tru.am/scripts/custom/ 3 KB
1 KB 224ms
179ms Script
text/javascript 2606:4700:20::6819:a322
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://tru.am/scripts/custom/cbsinteractive.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::6819:a322 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 885fb8b9c3d2738bd627def3899f26d4d42641bbb868cc99d1fbc16f0ed9f4c6

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: br
cf-cache-status: MISS
x-guploader-uploadid: AEnB2Uoq0WbNEu0BkrFB75tIn1ix081McrD_DADTs9KW5gLflV_bMSPBM7WRJx5oJv5H1xSpV9ndMwMkILLupiOYKsUmSFdmeA
x-goog-storage-class: REGIONAL
status: 200
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: text/javascript
last-modified: Tue, 30 Apr 2019 19:32:26 GMT
server: cloudflare
etag: W/"c486c91d1321adf59073588524182108"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=9gbW7g==, md5=xIbJHRMhrfWQc1iFJBghCA==
x-goog-generation: 1556652746634603
cache-control: public, max-age=86400
x-goog-stored-content-length: 2725
cf-ray: 51ffb6268fcd59dc-VIE
expires: Fri, 04 Oct 2019 14:47:29 GMT

GET
H/1.1 200
OK tag.aspx Show response
ml314.com/ 26 KB
12 KB 99ms
41ms Script
application/javascript 34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?392019
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 390a28be2ca4bcea5b71fe050295281a1a8fc99175690cdd62de378190400acb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:28 GMT
Content-Encoding: gzip
Last-Modified: Thu, 03 Oct 2019 09:29:23 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=67314
Connection: keep-alive
Content-Length: 11933
Expires: Fri, 04 Oct 2019 09:29:23 GMT

GET
H/1.1 200
OK st.v3.js Show response
www.everestjs.net/static/ 25 KB
7 KB 31ms
14ms Script
application/x-javascript 95.100.75.247
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://www.everestjs.net/static/st.v3.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.100.75.247 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a95-100-75-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 3624e97a6a4f6fb481369929e579039d00be03b0a2e5d1f5f961c44dfd98940c

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:29 GMT
Content-Encoding: gzip
Last-Modified: Mon, 12 Aug 2019 09:05:18 GMT
Server: Apache
ETag: "1ff0663-624a-58fe7d2af0fea"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=19868
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7175
Expires: Thu, 03 Oct 2019 20:18:37 GMT

GET
H/1.1 200
OK anonc.js Show response
dw.cbsi.com/ 73 B
620 B 452ms
155ms Script
application/javascript 64.30.230.22
CBS Interactive Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://dw.cbsi.com/anonc.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS: phx2-dw-cbsi-xw-ext-lb.cnet.com
Software: Apache/2.4.25 /
Resource Hash: 8e969090426570dfb96cc14e3e0bd3a52f04198469db46956b0350e7de31f70c

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:29 GMT
Server: Apache/2.4.25
Etag: L5Xm0F2WCgG84e601JY.1.dw_anonc
P3P: CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"
Cache-control: private, max-age=43200, s-max-age=0
Connection: Keep-Alive
Content-Type: application/javascript
Keep-Alive: timeout=80, max=415
Content-Length: 73
Expires: Mon, 05 Jan 1970 12:12:12 GMT

GET
H2 200 user.js Show response
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame D4FD 762 KB
124 KB 21ms
21ms Script
application/javascript 2606:4700::6810:4fa5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637048605074139690
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1570114048993&lv=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c9bb3631896aee1e930e140eb8fcbb4ad9cd9b96ec259b88b4b2fce0a55e805

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: qP10qPK8evED/0zxduUG5Q==
age: 245497
cf-polished: origSize=1198838
status: 200
last-modified: Mon, 23 Sep 2019 18:35:07 GMT
x-ms-lease-status: unlocked
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-ms-request-id: 7c4704d7-501e-003e-7e3d-72e3e0000000
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
cf-ray: 51ffb6268a89cba8-VIE
expires: Fri, 02 Oct 2020 14:47:29 GMT

GET
H2 200 pixel.gif
cdn.viglink.com/images/ 43 B
103 B 32ms
31ms Image
image/gif 2606:4700::6810:a20d
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.viglink.com/images/pixel.gif?ch=1&rn=3.7250497618007783
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a20d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
cf-cache-status: HIT
age: 8
cf-ray: 51ffb6269ffecbb4-VIE
status: 200
content-length: 43
x-amz-id-2: HrrKeHwcpae7WIw2OrZ71qNBKOTtGe87zi7c46ReqYsyaDilbmLNVsrHM//KTvEu+OHWwIYX9P0=
last-modified: Tue, 10 Feb 2015 03:29:39 GMT
server: cloudflare
etag: "221d8352905f2c38b3cb2bd191d630b0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: BCF6197221BF5488
cache-control: max-age=15, must-revalidate
accept-ranges: bytes
content-type: image/gif

GET
H2 200 pixel.gif
cdn.viglink.com/images/ 43 B
264 B 25ms
25ms Image
image/gif 2606:4700::6810:a20d
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.viglink.com/images/pixel.gif?ch=2&rn=3.7250497618007783
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a20d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
cf-cache-status: HIT
age: 8
cf-ray: 51ffb6269fffcbb4-VIE
status: 200
content-length: 43
x-amz-id-2: HrrKeHwcpae7WIw2OrZ71qNBKOTtGe87zi7c46ReqYsyaDilbmLNVsrHM//KTvEu+OHWwIYX9P0=
last-modified: Tue, 10 Feb 2015 03:29:39 GMT
server: cloudflare
etag: "221d8352905f2c38b3cb2bd191d630b0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: BCF6197221BF5488
cache-control: max-age=15, must-revalidate
accept-ranges: bytes
content-type: image/gif

GET
H2 200 fb_lightbox.2.1.5.css
www.lightboxcdn.com/static/ 4 KB
1 KB 21ms
21ms Stylesheet
text/css 2606:4700::6810:4fa5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/static/fb_lightbox.2.1.5.css?cb=637048605067352348
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637048605074139690
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0b9028c7ecccf4f31fafcfca176cd6ed38197d7b3d6ea4c107b98af8eecc525b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: q4B4xYJoZwx9ikt94o1nCA==
age: 245496
cf-polished: origSize=6016
x-ms-meta-cbmodifiedtime: Wed, 10 Apr 2019 18:50:43 GMT
status: 200
last-modified: Wed, 10 Apr 2019 19:06:17 GMT
x-ms-lease-status: unlocked
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
x-ms-request-id: a8c06077-501e-007a-013d-723f8c000000
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
cf-ray: 51ffb626ec0bcba8-VIE
expires: Fri, 02 Oct 2020 14:47:29 GMT

GET
H2 200 ls.html
www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame F114 0
0 707ms
707ms Document
text/html 2606:4700::6810:4fa5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637048605067352348
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637048605074139690
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: www.lightboxcdn.com
:scheme: https
:path: /lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637048605067352348
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
accept-encoding: gzip, deflate, br
cookie: __cfduid=df694f9c57f818e70ed0ea36796041ee21570114049
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Response headers

status: 200
date: Thu, 03 Oct 2019 14:47:29 GMT
content-type: text/html
content-md5: xa1/rdPe0J6SwxlD7atkzw==
last-modified: Mon, 23 Sep 2019 18:35:06 GMT
x-ms-request-id: 128681f2-401e-00a2-0df9-79985d000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
cf-cache-status: MISS
expires: Fri, 02 Oct 2020 14:47:29 GMT
cache-control: public, max-age=31536000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 51ffb626ec27cba8-VIE
content-encoding: br

GET
H2 200 t.gif
www.lightboxcdn.com/z9g/ 35 B
256 B 20ms
19ms Image
image/gif 2606:4700::6810:4fa5
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lightboxcdn.com/z9g/t.gif?c=1570114049099&h=www.zdnet.com&e=p&u=40913
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 03 Oct 2019 14:47:29 GMT
cf-cache-status: HIT
content-md5: KNaBTzCeoon4R8ac+RGUxg==
age: 2360776
cf-polished: status=not_needed
x-ms-meta-cbmodifiedtime: Tue, 26 Feb 2019 00:59:40 GMT
status: 200
content-length: 35
x-ms-lease-status: unlocked
last-modified: Tue, 26 Feb 2019 01:15:02 GMT
server: cloudflare
etag: 0x8D69B87D5A1B25F
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
x-ms-request-id: 48b7eafb-401e-010c-457d-f6fd65000000
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 51ffb626ec23cba8-VIE
cf-bgj: imgq:85

GET
H/1.1 200
OK utsync.ashx Show response
ml314.com/ 906 B
1 KB 31ms
31ms Script
application/javascript 34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=50070&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&pv=1570114049117_ydx05umm3&bl=en-us&cb=1245609&return=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D22052%26dpuuid%3D%5BPersonID%5D%26redir%3D&ht=&d=&dc=&si=1570114049117_ydx05umm3&cid=eaa95f35-b837-473b-90a5-6449462fcf2d&s=1600x1200&rp=
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?392019
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 6ad7a1cd240e11691e154cbcb0a4cda0ab8e41fe9ff63bddd797883c3291b596

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:28 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
p3P: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control: private
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 519
Expires: 0

GET
H/1.1 200
OK ud.ashx Show response
in.ml314.com/ 20 B
698 B 357ms
168ms Script
application/javascript 52.44.237.33
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://in.ml314.com/ud.ashx?topiclimit=&cb=392019
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?392019
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.44.237.33 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-44-237-33.compute-1.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:29 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, no-cache="set-cookie"
Connection: keep-alive
Content-Length: 138
Expires: Fri, 04 Oct 2019 14:47:29 GMT

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://tags.bluekai.com/site/20486?limit=0&id=5978151504331401042&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=5978151504331401042%26eid=50056
https://ml314.com/csync.ashx?fp=jUmQ1999999cVoj5&person_id=5978151504331401042&eid=50056

43 B
312 B

31ms
30ms

Image
image/gif

34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=jUmQ1999999cVoj5&person_id=5978151504331401042&eid=50056
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:29 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Fri, 04 Oct 2019 10:47:29 GMT

Redirect headers

Location: https://ml314.com/csync.ashx?fp=jUmQ1999999cVoj5&person_id=5978151504331401042&eid=50056
Date: Thu, 03 Oct 2019 14:47:29 GMT
Connection: keep-alive
Content-Length: 0
BK-Server: b9fc
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://idsync.rlcdn.com/395886.gif?partner_uid=5978151504331401042
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTNTk3ODE1MTUwNDMzMTQwMTA0MhAAGg0IgZTY7AUSBQjoBxAAQgBKAA
https://ml314.com/csync.ashx?fp=&person_id=5978151504331401042&eid=50082

43 B
312 B

32ms
32ms

Image
image/gif

34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=&person_id=5978151504331401042&eid=50082
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:29 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Fri, 04 Oct 2019 10:47:29 GMT

Redirect headers

date: Thu, 03 Oct 2019 14:47:29 GMT
via: 1.1 google
status: 307
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ml314.com/csync.ashx?fp=&person_id=5978151504331401042&eid=50082
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151504331401042%26eid=50220
https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151504331401042%26eid=50220&mm_bnc&mm_bct&UUID=89595d95-ffff-4a00-9bf8-9d710024a4de
https://ml314.com/csync.ashx?fp=89595d95-ffff-4a00-9bf8-9d710024a4de&person_id=5978151504331401042&eid=50220

43 B
312 B

31ms
30ms

Image
image/gif

34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=89595d95-ffff-4a00-9bf8-9d710024a4de&person_id=5978151504331401042&eid=50220
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:29 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Fri, 04 Oct 2019 10:47:29 GMT

Redirect headers

Date: Thu, 03 Oct 2019 14:47:29 GMT
Server: MT3 1734 ed2a032 master zrh-pixel-x16
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://ml314.com/csync.ashx?fp=89595d95-ffff-4a00-9bf8-9d710024a4de&person_id=5978151504331401042&eid=50220
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 0
Expires: Thu, 03 Oct 2019 14:47:28 GMT

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151504331401042
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151504331401042
https://ml314.com/csync.ashx?fp=83becc4622982f58041f38d277ff8aed&eid=50146&person_id=5978151504331401042

43 B
312 B

32ms
31ms

Image
image/gif

34.248.158.173
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=83becc4622982f58041f38d277ff8aed&eid=50146&person_id=5978151504331401042
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:29 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Fri, 04 Oct 2019 10:47:29 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:29 GMT
P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Location: https://ml314.com/csync.ashx?fp=83becc4622982f58041f38d277ff8aed&eid=50146&person_id=5978151504331401042
Cache-Control: no-cache
X-Server: 10.45.12.175
Connection: keep-alive
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2g9CG1JWOcF0M-vMOFbSsgm_LYKugFGkpxLVWMhOTk2k&gdpr=1&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil

70 B
171 B

10ms
10ms

Image
image/gif

18.197.149.199
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.197.149.199 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-197-149-199.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:29 GMT
Content-Length: 70
Content-Type: image/gif

Redirect headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:29 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
p3P: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Location: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Cache-Control: private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 168
Expires: 0,Fri, 04 Oct 2019 10:47:29 GMT

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/
Redirect Chain

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=5978151504331401042&redir=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=5978151504331401042&redir=

42 B
776 B

37ms
37ms

Image
image/gif

52.31.175.110
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=5978151504331401042&redir=
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.175.110 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-31-175-110.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v045-033e267e6.edge-irl1.demdex.com 5.59.0.20190904135845 2ms (+5ms)
Pragma: no-cache
X-TID: UXsD5MzEQzk=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
X-TID: kT4P5LibQiI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=5978151504331401042&redir=
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 article-2cfdba3ef4-rev.js Show response
zdnet4.cbsistatic.com/fly/js/pages/ 160 KB
45 KB 6ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/js/pages/article-2cfdba3ef4-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

8712d548c2bf72289213c2eca9bcdd1e94c766bf9cf4653c422e91e07882f310

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 170897
status: 200
vary: Accept-Encoding
content-length: 45972
x-xss-protection: 1; mode=block
last-modified: Tue, 01 Oct 2019 15:05:06 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d936b22-28162"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 08 Oct 2019 15:19:11 GMT

GET
H2 200 ta-pagesocial-sdk.js Show response
tru.am/scripts/ 35 KB
12 KB 25ms
25ms Script
application/javascript 2606:4700:20::6819:a322
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://tru.am/scripts/ta-pagesocial-sdk.js
Requested by: Host: tru.am
URL: https://tru.am/scripts/custom/cbsinteractive.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::6819:a322 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 18 Apr 2019 03:51:14 GMT
server: cloudflare
age: 6195
etag: W/"942d5ae1e512ccdf18813550428dd002"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 51ffb627b8d859dc-VIE
expires: Fri, 04 Oct 2019 14:47:29 GMT

GET
H2 200 CBSI-PLAYER.js Show response
vidtech.cbsinteractive.com/uvpjs/0.42.297/ 1 MB
281 KB 29ms
6ms Script
application/javascript 151.101.14.133
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: gzip
age: 3134654
x-cache: HIT, HIT
status: 200
content-length: 286838
x-amz-id-2: eFLdg4aPXUFc7W4j8Nhh9UdduMDflMLRIufQ6v/Vh6+pWt+vfGcNnF3gpKRr47exsFfoiPpv1MY=
x-served-by: cache-dca17775-DCA, cache-fra19126-FRA
last-modified: Fri, 01 Feb 2019 18:20:56 GMT
server: AmazonS3
x-timer: S1570114049.276084,VS0,VE0
etag: "eb5dd4ed3dcb7641ebbcb604d7ddb038"
vary: Accept-Encoding
x-amz-request-id: F767A360D0453B01
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=2592000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1, 13

GET
H2 200 chartbeat_video.js Show response
static.chartbeat.com/js/ 66 KB
23 KB 20ms
6ms Script
application/x-javascript 2600:9000:2156:3000:18:1fcd:349:ca21
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat_video.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2156:3000:18:1fcd:349:ca21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: nginx /
Resource Hash: 88762480fb084c0725cf9c3abde10e540ebf64884fd50a86789b5eb661c38cdd

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:20:27 GMT
content-encoding: gzip
last-modified: Thu, 01 Aug 2019 01:36:07 GMT
server: nginx
age: 1621
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=7200
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: fKLpsUjhGWJd_Yk3rOe-fAsyKDh-U6tLH3kkOBvx4ttVxolt51KiqQ==
via: 1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
expires: Thu, 03 Oct 2019 16:20:27 GMT

GET
H2 200 mpulse-1.0.2.js Show response
zdnet1.cbsistatic.com/fly/js/libs/ 12 KB
5 KB 6ms
6ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 520077
status: 200
vary: Accept-Encoding
content-length: 4877
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Sep 2019 14:07:22 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d8cc61a-2fdf"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 04 Oct 2019 14:19:30 GMT

POST
H2 200 beacon Show response
beacon.tru.am/ 0
351 B 202ms
159ms Fetch 2606:4700:20::6819:a322
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.tru.am/beacon
Requested by: Host: tru.am
URL: https://tru.am/scripts/ta-pagesocial-sdk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::6819:a322 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 03 Oct 2019 14:47:29 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
status: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache, private, max-age=0
cf-ray: 51ffb6283ffccbac-VIE
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/v2/ 2 KB
1 KB 37ms
36ms XHR
application/json 104.111.214.229
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1570114049271&s=30fcf08b4338fd79dd8a4776e6dc28ff4f0440696ab91c8ee89b2d7a854c9971
Requested by: Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.214.229 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-111-214-229.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fcfe0abaa04e858e1aade99a0cfa8090279713543a220e30e4b87ffc15c3f8ad

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:29 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 737

GET
H2 200 ping
ping.chartbeat.net/ 43 B
168 B 279ms
92ms Image
image/gif 107.23.115.104
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F&u=DSrogqCWXKnexY2L3&d=zdnet.com&g=65713&g0=security&g1=danny%20palmer&n=1&f=00001&c=0&x=0&m=0&y=3977&o=1585&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=1056&t=DPlZj-CSh1urDJEzIbBcT0cxCDy1Vl&V=116&i=This%20huge%20Android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made%20basic%20securit&tz=-120&_acct=anon&sn=1&sv=D1L-AIDcpicsDEmeIYCihflaCtMhsC&sd=1&im=067b2ff3&_
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.23.115.104 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-107-23-115-104.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Thu, 03 Oct 2019 14:47:29 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
expires: 0

GET
H/1.1 200
OK c.gif
dw.cbsi.com/clear/ 42 B
346 B 151ms
151ms Image
image/gif 64.30.230.22
CBS Interactive Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dw.cbsi.com/clear/c.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=1b0217ac-3a72-470b-9289-742af80ceb70&assettitle=this%20huge%20android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made%20basic%20security%20mistakes&assettype=content_article&pubdate=2019-10-03%2011%3A07%3A27&viewguid=eaa95f35-b837-473b-90a5-6449462fcf2d&devicetype=desktop&sitetype=responsive%20web&author=danny%20palmer&authorid=1aa87593-0f1d-4577-862b-a59b5ec9bc57&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&ts=1570114049457&ld=www.zdnet.com&ldc=9982115b-faee-47dc-a501-c98bd877e2c4&brwinsz=1600x1200&brscrsz=1600x1200&brlang=en-US&tcset=utf8&im=dsjs&clgf=L5Xm0F2WCgG84e601JY&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&title=This%20huge%20Android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made%20basic%20security%20mistakes%20%7C%20ZDNet
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS: phx2-dw-cbsi-xw-ext-lb.cnet.com
Software: Apache/2.4.25 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:29 GMT
Server: Apache/2.4.25
Vary: *
Content-Type: image/gif
Cache-control: no-cache, must-revalidate, no-transform
Connection: Keep-Alive
Keep-Alive: timeout=80, max=406
Content-Length: 42
Expires: Mon, 05 Jan 1970 12:12:12 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 2 KB
1 KB 34ms
34ms XHR
application/json 52.31.175.110
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&ts=1570114049473
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.175.110 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-31-175-110.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a1974a650dc2ae6fbadd2fe23f0af78c38de9674a5b2c343529befd77e6fc3a8

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v045-02340b4f2.edge-irl1.demdex.com 5.59.0.20190904135845 3ms (+1ms)
Pragma: no-cache
Content-Encoding: gzip
X-TID: NlNlF8PASSw=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 673
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
116 B 6ms
6ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=cbsi/zdnetglobalsite/201909161811&cb=1570114049474
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8F86) /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
last-modified: Thu, 14 Apr 2016 16:59:33 GMT
server: ECAcc (frc/8F86)
etag: "2243872957"
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=600
accept-ranges: bytes
content-length: 2
expires: Thu, 03 Oct 2019 14:57:29 GMT

GET
H/1.1 200
OK Cookie set dest5.html
cbsi.demdex.net/ Frame D572 0
0 112ms
28ms Document
text/html 52.30.7.139
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cbsi.demdex.net/dest5.html?d_nsid=undefined
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.30.7.139 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-30-7-139.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Host: cbsi.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Accept-Encoding: gzip, deflate, br
Cookie: demdex=57820925998946903021900188742470777849
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Thu, 03 Oct 2019 09:48:59 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=57820925998946903021900188742470777849;Path=/;Domain=.demdex.net;Expires=Tue, 31-Mar-2020 14:47:29 GMT;Max-Age=15552000
Vary: Accept-Encoding, User-Agent
X-TID: dsvE6fcERqY=
Content-Length: 2764
Connection: keep-alive

GET
H2 200 id Show response
saa.cbsi.com/ 90 B
585 B 90ms
29ms XHR
application/x-javascript 108.128.130.224
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://saa.cbsi.com/id?d_visid_ver=2.3.0&d_fieldgroup=A&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&mid=57943255567832546621876129017199951489&ts=1570114049512

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.128.130.224 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-108-128-130-224.eu-west-1.compute.amazonaws.com

Software

jag /

Resource Hash

01b51130a9571ae465e70d2b7784d21610124932ead2cedaa2db0fd7ffc523b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Thu, 03 Oct 2019 14:47:29 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-5d695d76d8-q26w6
vary: Origin
x-c: master-1021.Ic37195.M0-288
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.zdnet.com
access-control-allow-credentials: true
content-type: application/x-javascript
content-length: 90
x-xss-protection: 1; mode=block

POST
H/1.1 200
OK ping Show response
api.viglink.com/api/ 265 B
945 B 128ms
36ms XHR
text/javascript 99.80.15.126
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api.viglink.com/api/ping
Requested by: Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: 4f6a9ffb0b1f3aa3ef2bd4a9c137964c8315cf99c4eccee10798770067d449d0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:29 GMT
Server: Apache-Coyote/1.1
P3P: CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
Content-Length: 265
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 2 KB
1 KB 37ms
36ms XHR
application/json 52.31.175.110
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&d_mid=57943255567832546621876129017199951489&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%012ECB0500FFFF8000-4006FFFE40D2E2C3&ts=1570114049604
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.175.110 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-31-175-110.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: dc758384fb85e15446a3272eee0ae16ed55c58ad320279b86e5183af0fcdbaba

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v045-058942083.edge-irl1.demdex.com 5.59.0.20190904135845 5ms (+0ms)
Pragma: no-cache
Content-Encoding: gzip
X-TID: fBZxeMzuSnc=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 672
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 s02107355397593 Show response
saa.cbsi.com/b/ss/cnetzdnetglobalsite/10/JS-2.3.0/ 2 KB
2 KB 41ms
41ms Script
application/x-javascript 108.128.130.224
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://saa.cbsi.com/b/ss/cnetzdnetglobalsite/10/JS-2.3.0/s02107355397593?AQB=1&ndh=1&pf=1&callback=s_c_il[0].doPostbacks&et=1&t=3%2F9%2F2019%2016%3A47%3A29%204%20-120&d.&nsid=0&jsonv=1&.d&mid=57943255567832546621876129017199951489&aid=2ECB0500FFFF8000-4006FFFE40D2E2C3&aamlh=6&ce=UTF-8&ns=cbsinteractive&pageName=zdnet%3A%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F&g=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&cc=USD&ch=editorial&server=www.zdnet.com&v0=ftag%3ARSSbaffb68%7C&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c1=zdnet&v1=zdnet&h1=editorial%7Carticle&l1=google%7Cmicrosoft&c2=D%3Dv2&v2=eu&l2=113c25b6-ec91-11e3-95d2-02911863765e&c3=D%3Dv3&v3=responsive%20web%7Cdesktop&l3=1aa87593-0f1d-4577-862b-a59b5ec9bc57&c4=D%3Dv4&c5=D%3Dv5&v5=cnetzdnetglobalsite&c6=D%3Dv6&v6=editorial%7Carticle&c7=D%3Dv7&v7=D%3Dg&c8=D%3Dv8&v8=This%20huge%20Android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made%20basic%20security%20mistakes%20%7C%20ZDNet&c9=D%3DUser-Agent&c10=D%3Dv10&v10=article&c11=D%3Dv11&v15=not%20authenticated%7Canon&c20=D%3Dv20&v20=this%20huge%20android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made%20basic%20security%20mistakes&c22=D%3Dv22&v22=content_article&c23=D%3Dv23&v23=113c25b6-ec91-11e3-95d2-02911863765e&c24=D%3Dv24&v24=eaa95f35-b837-473b-90a5-6449462fcf2d&c25=D%3Dv25&c26=D%3Dv26&c28=D%3Dv28&c30=D%3Dv30&v30=1b0217ac-3a72-470b-9289-742af80ceb70&c31=D%3Dv31&c33=D%3Dv33&c34=D%3Dv34&c35=D%3Dv35&v35=L5Xm0F2WCgG84e601JY&c44=D%3Dv44&v44=zdnet&c50=D%3Dv50&c51=D%3Dv51&c52=D%3Dv52&c53=D%3Dv53&c54=D%3Dv54&c65=D%3Dv65&v65=discover&c69=D%3Dv69&v85=true&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&AQE=1

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.128.130.224 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-108-128-130-224.eu-west-1.compute.amazonaws.com

Software

jag /

Resource Hash

c70c7e618c549d422a49565742087872e453e74e0f43f06687eae8f5ba7d0f52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-aam-tid: rcdLDVlOSfU=
date: Thu, 03 Oct 2019 14:47:29 GMT
x-content-type-options: nosniff
x-c: master-1021.Ic37195.M0-288
p3p: CP="This is not a P3P policy"
status: 200
content-length: 1659
x-xss-protection: 1; mode=block
dcs: dcs-prod-irl1-v045-04673dd07.edge-irl1.demdex.com 5.59.0.20190904135845 8ms (+1ms)
pragma: no-cache
last-modified: Fri, 04 Oct 2019 14:47:29 GMT
server: jag
xserver: anedge-5d695d76d8-frmqd
etag: 2ECB0500FFFF8000-40161FF160D2F21D
vary: *
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 02 Oct 2019 14:47:29 GMT

POST
H/1.1 200
OK domains Show response
api.viglink.com/api/ 96 B
541 B 30ms
30ms XHR
text/javascript 99.80.15.126
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api.viglink.com/api/domains
Requested by: Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: c79411685a096da27cca4df859f6ea32bda063e14d51e956b93a8da598e7d102

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:28 GMT
Server: Apache-Coyote/1.1
P3P: CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
Content-Length: 96
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
No Content / Show response
0211c812.akstat.io/ 0
354 B 100ms
74ms XHR
image/gif 104.111.214.229
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://0211c812.akstat.io/?h.pg=article&when=1570114049746&t_other=custom4%7C233&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=97945b792d0e5b2076d4300cc1b7f9d5d6b29f20&h.t=1570114049287&http.initiator=api&rt.start=api&rt.si=36cc6527-2a2f-4c2a-8ef1-4966f31d4b63&rt.ss=1570114050302&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1

Requested by

Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.214.229 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-214-229.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:29 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Thu, 03 Oct 2019 14:47:29 GMT

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 65 B
942 B 133ms
118ms XHR
text/javascript 2.18.234.21
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?v=7.2&s=182823&fn=headertag.IndexExchangeHtb.adResponseCallback&r=%7B%22id%22%3A7129031%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C%22%7D%2C%22imp%22%3A%5B%7B%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22202%22%2C%22siteID%22%3A%22182829%22%7D%2C%22id%22%3A%221%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22220%22%2C%22siteID%22%3A%22183316%22%7D%2C%22id%22%3A%222%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22209%22%2C%22siteID%22%3A%22182828%22%7D%2C%22id%22%3A%223%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22210%22%2C%22siteID%22%3A%22182826%22%7D%2C%22id%22%3A%224%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22208%22%2C%22siteID%22%3A%22182824%22%7D%2C%22id%22%3A%225%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22222%22%2C%22siteID%22%3A%22182825%22%7D%2C%22id%22%3A%226%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22219%22%2C%22siteID%22%3A%22183315%22%7D%2C%22id%22%3A%227%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22201%22%2C%22siteID%22%3A%22182823%22%7D%2C%22id%22%3A%228%22%7D%5D%2C%22ext%22%3A%7B%22source%22%3A%22ixwrapper%22%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22adserver.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%224e23d674-f09f-423b-a7bd-8520ead26b15%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID%22%7D%7D%2C%7B%22id%22%3A%22FALSE%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_LOOKUP%22%7D%7D%2C%7B%22id%22%3A%222019-10-03T14%3A47%3A28%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_CREATED_AT%22%7D%7D%5D%7D%5D%7D%7D
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 6847254cd547693a3f979c0ab7b824fc90b0054250790e33f64930de87c2c615

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript
Content-Length: 85
Expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 99 B
1 KB 44ms
26ms XHR
application/javascript 37.252.173.62
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?id=11834629&size=728x90&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=ArAP5iEg&psa=0&promo_sizes=970x250&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

5ae3f698a2993e6c115f57c600b5b025776902c6796a85b8b2bbc754706a87b7

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 535.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.49:80
AN-X-Request-Uuid: 672e4ca3-bec5-4c3b-9a11-5ea980ecbc44
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 99
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 99 B
1 KB 42ms
24ms XHR
application/javascript 37.252.173.62
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?id=11834625&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=1bauMoAl&psa=0&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

81ac79011df184d5e4b8dd0c5849f098ae0c2f9a5bc7a498d97628b40a308a1b

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 535.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.91:80
AN-X-Request-Uuid: c2871715-01c0-4271-bd23-d298d3056393
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 99
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 99 B
1 KB 38ms
21ms XHR
application/javascript 37.252.173.62
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?id=11834627&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=MSFl1OCP&psa=0&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

2513ba7a560574328b8cd642df510e26fe2b1a978b88d84e4f4b2a979bf4cc55

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 535.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.200:80
AN-X-Request-Uuid: fe4e3d7c-6d7a-438c-8bfc-795b0b24d18b
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 99
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 99 B
1 KB 68ms
50ms XHR
application/javascript 37.252.173.62
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?id=11834631&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=rxst4K3o&psa=0&promo_sizes=300x600&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

0ae0a49658a5d18b0d8022e298d55737fd40b5e0938fdd4a1e5de865543d9de2

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 535.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.109:80
AN-X-Request-Uuid: 2be01dd3-af8a-47ee-ad20-13c724342625
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 99
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 99 B
1 KB 40ms
22ms XHR
application/javascript 37.252.173.62
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?id=11834632&size=728x90&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=H66YNKOH&psa=0&promo_sizes=970x250&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

03542957b7a5b6ff3e91d8df4dbfc3443568867cefc7b1bd7716ce324e83f9be

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 535.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.119:80
AN-X-Request-Uuid: 0938c60c-d131-4c84-a4a8-989a83905e60
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 99
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 vglnk.js Show response
cdn.viglink.com/api/ 78 KB
27 KB 25ms
25ms Script
text/javascript 2606:4700::6810:a20d
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.viglink.com/api/vglnk.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a20d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1452718
cf-ray: 51ffb62bce53cbb4-VIE
status: 200
content-length: 27719
x-amz-id-2: HNEV4caKoOdziBrXGZIDp4CzG6boiBMb4TLu65nU6otYm4+p2OQwr1vWix1CX0FBodMy916W6w4=
last-modified: Mon, 16 Sep 2019 19:15:01 GMT
server: cloudflare
etag: "1545d811432c0074356408ee8f6c1e23"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: FB54A2C70C0BB866
cache-control: public, max-age=1800
accept-ranges: bytes
content-type: text/javascript
expires: Thu, 03 Oct 2019 15:17:29 GMT

GET
H2 200 utag.1775.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 26 KB
9 KB 7ms
7ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.43.201909161811
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8F51) /
Resource Hash: 0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: gzip
last-modified: Thu, 10 Nov 2016 20:41:55 GMT
server: ECAcc (frc/8F51)
etag: "1112944691"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 8960
expires: Fri, 18 Oct 2019 14:47:29 GMT

GET
H2 200 utag.277.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
924 B 10ms
10ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.43.201909161811
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8F67) /
Resource Hash: 0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: gzip
last-modified: Mon, 11 Jul 2016 20:43:58 GMT
server: ECAcc (frc/8F67)
etag: "461771432"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 863
expires: Fri, 18 Oct 2019 14:47:29 GMT

GET
H2 200 utag.1772.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
1 KB 8ms
7ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1772.js?utv=ut4.43.201909161811
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8F3A) /
Resource Hash: e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: gzip
last-modified: Mon, 11 Jul 2016 20:43:58 GMT
server: ECAcc (frc/8F3A)
etag: "4198895974"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 959
expires: Fri, 18 Oct 2019 14:47:29 GMT

GET
H2 200 utag.1796.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 8 KB
3 KB 8ms
8ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1796.js?utv=ut4.43.201909161811
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8F27) /
Resource Hash: 9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:27 GMT
content-encoding: gzip
last-modified: Mon, 28 Nov 2016 15:09:53 GMT
server: ECAcc (frc/8F27)
etag: "931235332"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 2762
expires: Fri, 18 Oct 2019 14:47:27 GMT

GET
H2 200 utag.1810.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
1 KB 10ms
9ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1810.js?utv=ut4.43.201909161811
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8F3D) /
Resource Hash: 07178558c596bc2fe33d99750a349d5413fa4571fc778cefbe4f4f367404f6d6

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: gzip
last-modified: Mon, 08 Jul 2019 17:22:10 GMT
server: ECAcc (frc/8F3D)
etag: "4274102907"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 988
expires: Fri, 18 Oct 2019 14:47:29 GMT

GET
H/1.1

200
OK

pixel_details.html
www.everestjs.net/static/ Frame E6CB
Redirect Chain

https://pixel.everesttech.net/4083/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__EFOPTOUT__%26throttleCook...
https://www.everestjs.net/static/pixel_details.html

0
0

8ms
7ms

Document
text/html

95.100.75.247
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://www.everestjs.net/static/pixel_details.html
Requested by: Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.100.75.247 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a95-100-75-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: www.everestjs.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Response headers

Server: Apache
Last-Modified: Tue, 04 Oct 2011 16:14:21 GMT
ETag: "8623-a6-4ae7b62583140"
Accept-Ranges: bytes
Content-Type: text/html
Content-Encoding: gzip
Content-Length: 146
Cache-Control: max-age=60034
Expires: Fri, 04 Oct 2019 07:28:03 GMT
Date: Thu, 03 Oct 2019 14:47:29 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

Date: Thu, 03 Oct 2019 14:47:29 GMT
Server: Apache
Set-Cookie: everest_session_v2=XZYKAQAAAc-8Rv3I; path=/; domain=.everesttech.net everest_g_v2=g_surferid~XZYKAQAAAc-8Rv3I; path=/; domain=.everesttech.net; expires=Sat, 28-Aug-2021 01:27:29 GMT
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache
Location: https://www.everestjs.net/static/pixel_details.html#google=XZYKAQAAAc-8Rv3I&gsurfer=XZYKAQAAAc-8Rv3I&optout=0&throttleCookie=&time=20191003144729
Content-Length: 345
Keep-Alive: timeout=15, max=992064
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK Cookie set dest5.html
cbsi.demdex.net/ Frame 7B6E 0
0 28ms
28ms Document
text/html 52.30.7.139
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cbsi.demdex.net/dest5.html?d_nsid=0
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.30.7.139 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-30-7-139.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Host: cbsi.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Accept-Encoding: gzip, deflate, br
Cookie: demdex=53382507390233673202233730399316405255
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Thu, 03 Oct 2019 09:46:48 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=53382507390233673202233730399316405255;Path=/;Domain=.demdex.net;Expires=Tue, 31-Mar-2020 14:47:29 GMT;Max-Age=15552000
Vary: Accept-Encoding, User-Agent
X-TID: cc/p8oumT0Y=
Content-Length: 2764
Connection: keep-alive

GET
H2 200 / Show response
www.zdnet.com/components/breaking-news/xhr/ 1 KB
2 KB 151ms
151ms XHR
application/json 2.18.233.143
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a2-18-233-143.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

9342819f93f32a4dbb6f2d36222c9e768100640e1465450707bddcd5a8617211

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 497
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 03 Oct 2019 14:28:51 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Thu, 03 Oct 2019 14:47:30 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: 3229da05-99b6-4003-830b-7d1de3251f76
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=5400, private
accept-ranges: bytes
expires: Thu, 03 Oct 2019 15:58:51 GMT

GET
H2 200 disqus-count-5922ea1c53-rev.js Show response
zdnet2.cbsistatic.com/fly/js/components/ 406 B
377 B 6ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/components/disqus-count-5922ea1c53-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

b8c15c61feffdfe68b168cf2ac8cf58867f38547da3b15d7971a75c44f16bc26

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 516940
status: 200
vary: Accept-Encoding
content-length: 270
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Sep 2019 14:07:16 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d8cc614-196"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 04 Oct 2019 15:11:49 GMT

GET
H2 200 disqus-loader-db6fae9369-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 1 KB
774 B 7ms
5ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/disqus-loader-db6fae9369-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

4bb0f33f40b38593e1cba1c8b2f15703d33753bbd80f30511dd9c464a959afe7

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 291969
status: 200
vary: Accept-Encoding
content-length: 642
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Sep 2019 14:07:16 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d8cc614-580"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 07 Oct 2019 05:41:21 GMT

GET
H2 200 istock-business-email-and-accounting.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/10/01/c6fe8bcc-7c8d-4d1f-ae7d-749d63380f76/thumbnail/70x53/de6ccffc6a9a309985a6fcabc8961240/ 5 KB
5 KB 6ms
6ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/10/01/c6fe8bcc-7c8d-4d1f-ae7d-749d63380f76/thumbnail/70x53/de6ccffc6a9a309985a6fcabc8961240/istock-business-email-and-accounting.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

3fe62dc6820ac4d4bd4bd0f7d28471fde967492b7cc3308ced0a195bdd37a9a3

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
x-content-type-options: nosniff
age: 99984
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4929
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "ee39e503b6bedf0c98c388b7e8589aca"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 istock-hands-on-a-keyboard-possibly-a-hacker-doing-some-hacking.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/09/18/677b5fd6-bac6-47ce-8232-23d5563e40fe/thumbnail/70x53/d05a071b5d112ead76626ecc0ee89efe/ 5 KB
4 KB 7ms
6ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/09/18/677b5fd6-bac6-47ce-8232-23d5563e40fe/thumbnail/70x53/d05a071b5d112ead76626ecc0ee89efe/istock-hands-on-a-keyboard-possibly-a-hacker-doing-some-hacking.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

7e2d4be3aa4af820adeff7929ee539740102bd2619e4c5a546299c649e994c56

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1312803
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4192
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "7c022d9c6dd601e087e186ee6dfe1fc7"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 victim-of-a-ransomware-attack.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/09/27/bd2481de-d5af-4c10-962c-3f04cc7b22a6/thumbnail/70x53/831a02607d74896bf50676c03e7b9742/ 5 KB
4 KB 8ms
8ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/09/27/bd2481de-d5af-4c10-962c-3f04cc7b22a6/thumbnail/70x53/831a02607d74896bf50676c03e7b9742/victim-of-a-ransomware-attack.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

875bc944393483ad8a1a517bd4a0cc131dc62212bbdc93d8ec141d43131ba847

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 531205
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4462
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "d3f06eef2ffac7faadbe3055a70682ac"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 istock-gdpr-image-2019.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/09/25/593191a6-95bd-492d-9893-8ddd7f8bc280/thumbnail/70x53/686caea5bf20c710ebde2f385f1d799c/ 5 KB
4 KB 7ms
7ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/09/25/593191a6-95bd-492d-9893-8ddd7f8bc280/thumbnail/70x53/686caea5bf20c710ebde2f385f1d799c/istock-gdpr-image-2019.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

99ee25a9f167f0de6f763814bccbd6f46d6de72ce93af8a319dab16fbf4e4571

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 625602
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4425
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "8977ecbb8cb82d77fb091c7a7f186163"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 / Show response
www.zdnet.com/newsletter/xhr/widget-login/ 2 KB
2 KB 392ms
392ms XHR
application/json 2.18.233.143
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/newsletter/xhr/widget-login/?topic=security

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a2-18-233-143.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

f56e4fd9d58980747b23b3b61ec1c1094300e15fd95e043cd3c6301b64e89ca6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 731
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: no-referrer-when-downgrade
server: nginx
x-frame-options: SAMEORIGIN
date: Thu, 03 Oct 2019 14:47:30 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: eed9bf4b-b226-4d37-beeb-858051097c5e
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H2 200 front-door-carousel-56427878d9-rev.js Show response
zdnet1.cbsistatic.com/fly/js/components/ 5 KB
2 KB 7ms
7ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/js/components/front-door-carousel-56427878d9-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

5ecc6a93ec2939faa8dbf80084346c7d940f5a2181ee69343810da52902eb92d

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 520075
status: 200
vary: Accept-Encoding
content-length: 1564
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Sep 2019 14:07:16 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d8cc614-124a"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 04 Oct 2019 14:19:34 GMT

GET
H2 200 urban-airship-29ae327ed0-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 1 KB
1 KB 6ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-29ae327ed0-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

fa33d1db535d783b0baf4e74bdc7ce9e54633f87a03669b2803e567088d64ccb

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 153267
status: 200
vary: Accept-Encoding
content-length: 827
x-xss-protection: 1; mode=block
last-modified: Tue, 01 Oct 2019 15:04:57 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d936b19-514"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 08 Oct 2019 20:13:02 GMT

GET
H/1.1 200
OK 4083-12969.js Show response
www.everestjs.net/dl/4083/ 484 B
664 B 8ms
8ms Script
application/x-javascript 95.100.75.247
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://www.everestjs.net/dl/4083/4083-12969.js
Requested by: Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.100.75.247 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a95-100-75-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
Last-Modified: Mon, 25 Nov 2013 14:23:10 GMT
Server: Apache
ETag: "4a5a49-1e4-4ec011a776f80"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=69048
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 288
Expires: Fri, 04 Oct 2019 09:58:18 GMT

GET
H/1.1 200
OK v
pixel.everesttech.net/4083/ 128 B
716 B 15ms
15ms Image
image/png 66.117.28.68
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/4083/v?ev___loc=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&ev___ref=%2F%2F
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Last-Modified: Wed, 19 Oct 2016 22:11:25 GMT
Server: Apache
ETag: "9c38d7-80-53f3f17013d40"
Vary: Cookie
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: image/png
Keep-Alive: timeout=15, max=981445
Content-Length: 128

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/
Redirect Chain

https://cm.everesttech.net/cm
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WFpZS0FRQUFBYy04UnYzSQ
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEDa7u26vykZvUyuIYU6a0P0&google_cver=1
https://pixel.everesttech.net/1x1

128 B
407 B

21ms
21ms

Image
image/png

66.117.28.68
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Last-Modified: Wed, 19 Oct 2016 22:11:25 GMT
Server: Apache
ETag: "1433c2-80-53f3f17013d40"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=992038
Content-Length: 128

Redirect headers

Date: Thu, 03 Oct 2019 14:47:29 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://pixel.everesttech.net/1x1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET
H2 200 advertisement-d41d8cd98f-rev.js Show response
zdnet2.cbsistatic.com/fly/js/utils/ 0
264 B 6ms
5ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/utils/advertisement-d41d8cd98f-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
x-content-type-options: nosniff
age: 113792
status: 200
vary: Accept-Encoding
content-length: 0
x-xss-protection: 1; mode=block
last-modified: Tue, 01 Oct 2019 15:05:12 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d936b28-0"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 09 Oct 2019 07:10:56 GMT

GET
H2 200 comscore.streaming.6.1.1.171219.min.js Show response
vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/comscore/ 104 KB
19 KB 7ms
6ms Script
application/javascript 151.101.14.133
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/comscore/comscore.streaming.6.1.1.171219.min.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 081873caa83744b6d819ab294b08927e20b60841dd8f23a87c2a57e15f65591c

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
age: 2884961
x-cache: HIT, HIT
status: 200
content-length: 18881
x-amz-id-2: wvf0nU/fYVCFEqryjhvs4lE8elhKGqjNp6XkUi9e80Sa1GEUIj4jnKU0o2ibZvqs8vFZW3mqUNQ=
x-served-by: cache-dca17771-DCA, cache-fra19126-FRA
last-modified: Fri, 01 Feb 2019 18:21:03 GMT
server: AmazonS3
x-timer: S1570114050.021724,VS0,VE1
etag: "c3c30c0ebfc35a9426296256fc3133d8"
vary: Accept-Encoding
x-amz-request-id: 05965AFBEC58A879
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=2592000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 24, 1

GET
H/1.1 200
OK cs.js Show response
sb.scorecardresearch.com/c2/3005086/ 0
400 B 21ms
8ms Script
application/x-javascript 2.16.31.65
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/c2/3005086/cs.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.43.201909161811
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.16.31.65 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-16-31-65.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
Last-Modified: Fri, 08 Apr 2011 23:11:26 GMT
ETag: "d41d8cd98f00b204e9800998ecf8427e:1349196464"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=259200
Connection: keep-alive
Content-Length: 20
Expires: Sun, 06 Oct 2019 14:47:30 GMT

GET
H/1.1

204
No Content

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=2&c2=3005086&ns__t=1570114050021&ns_c=UTF-8&c8=This%20huge%20Android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made...
https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1570114050021&ns_c=UTF-8&c8=This%20huge%20Android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20mad...

0
248 B

8ms
8ms

Image
text/plain

2.16.31.65
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1570114050021&ns_c=UTF-8&c8=This%20huge%20Android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made%20basic%20security%20mistakes%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&c9=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.16.31.65 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-16-31-65.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:30 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1570114050021&ns_c=UTF-8&c8=This%20huge%20Android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made%20basic%20security%20mistakes%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&c9=
Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:30 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

m
secure-us.imrworldwide.com/cgi-bin/
Redirect Chain

https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-sec...
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-sec...

44 B
332 B

31ms
31ms

Image
image/gif

52.49.22.89
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/%23ftag%3DRSSbaffb68%7C&rp=&ts=compact&rnd=1570114050022&ja=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.49.22.89 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-49-22-89.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Oct 2019 14:47:30 GMT
server: nginx
status: 200
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
content-type: image/gif
content-length: 44
expires: Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 03 Oct 2019 14:47:30 GMT
server: nginx
status: 302
location: https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/%23ftag%3DRSSbaffb68%7C&rp=&ts=compact&rnd=1570114050022&ja=1
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 121 KB
32 KB 20ms
7ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

14d88b3a27f0e6de034f86ad42d6411081e9467daf754147f2f16bcb20782177

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 31604
x-xss-protection: 0
pragma: public
x-fb-debug: YhHinmZioNE49wc6WFm5FWWkDZVNY9O88YkBK7jc6sfhlLb6kh2crLfoXcLY5bZlzzCtqhqADLLYhSD8DBP0nQ==
x-fb-trip-id: 420120009
x-frame-options: DENY
date: Thu, 03 Oct 2019 14:47:30 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/ 60 KB
15 KB 67ms
35ms Script
application/javascript 104.17.209.240
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_3xeBFJDuSs0SRW5&Q_LOC=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.43.201909161811

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

6c849673497b1b5c33c9a09e812aa0da912bc3564c30c1585ae151aa995e4e76

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 486725
cf-polished: origSize=62065
status: 200
edge-control: max-age=604800
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-bgj: minify
server: cloudflare
x-powered-by: Express
etag: W/"f271-BkBPGSSER0aT3YysQanZWmWgsOA"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=60, s-maxage=604800
cf-ray: 51ffb62cd82b2766-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

GET
H2 200 cbs_zQTp2H_zdnet.js Show response
cdn-magiclinks.trackonomics.net/client/static/v2/ 95 KB
18 KB 29ms
9ms Script
text/javascript 2600:9000:21f3:1000:1d:8c8c:47c0:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-magiclinks.trackonomics.net/client/static/v2/cbs_zQTp2H_zdnet.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1810.js?utv=ut4.43.201909161811
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:1000:1d:8c8c:47c0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: Apache/2.4.34 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.8 /
Resource Hash: 735dd6528ef8dd97886865a6ff4a0387d6cebab544c6288c8ba2169b1858c392

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 01 Oct 2019 17:34:05 GMT
content-encoding: gzip
last-modified: Wed, 21 Aug 2019 10:15:58 GMT
server: Apache/2.4.34 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.8
age: 76194
status: 200
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: 8JYU0KIFl7ckX3qcviFBUyl_FqLMvT7QYd-9sJqpUtIS0TBFcWfvgQ==
via: 1.1 f0dda47e8f83bee88cb60d3d2e3fa5e5.cloudfront.net (CloudFront)

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 99 KB
15 KB 416ms
415ms XHR
text/plain 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=100901377703250&correlator=2046291051191560&output=ldjh&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&adsid=NT&eid=21064579%2C21062833%2C21064370%2C21064581&vrg=2019092602&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20191003&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=7x7%7C5x5%2C1x1%2C728x90%7C970x66%7C970x250%2C300x250%7C300x600%7C300x1050%2C300x250%2C300x250%2C728x90%7C970x66%7C970x250%2C371x771&ists=64&prev_scp=pos%3Dnav%7C%7Cpos%3Dtop%7Cpos%3Dtop%7Cpos%3Dmiddle%7Cpos%3Dbottom%7Cpos%3Dbottom%7Cpos%3Dtop&eri=1&cust_params=buyingcycle%3Ddiscover%26topic%3Dsecurity%252Candroid%26tag%3Dmalware%252Ccyber-security%26prodtype%3Dandroid%26mfr%3Dgoogle%252Cmicrosoft%26pid%3Dskype%26collection%3Da-winning-strategy-for-cybersecurity%26device%3Ddesktop%26ptype%3Darticle%26cid%3Da-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%26env%3Dprod%26firstpg%3D1%26vguid%3Deaa95f35-b837-473b-90a5-6449462fcf2d%26session%3Df%26subses%3D2%26ftag%3DRSSbaffb68%257C&cookie_enabled=1&bc=31&abxe=1&lmt=1570111817&dt=1570114050036&dlt=1570114048471&idt=497&frm=20&biw=1585&bih=1200&oid=3&adxs=-12245933%2C0%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933&adys=-12245933%2C87%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933&adks=1259185275%2C2483368062%2C3169268714%2C3675382948%2C299677617%2C77918511%2C1610139521%2C2767376938&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&dssz=84&icsg=0&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x3988%7C1585x0%7C1585x0%7C370x0%7C370x0%7C370x250%7C1210x0%7C370x0&msz=7x7%7C1585x0%7C688x105%7C300x280%7C300x280%7C300x280%7C728x130%7C371x771&ga_vid=718268121.1570114050&ga_sid=1570114050&ga_hid=962638165&fws=132%2C4%2C132%2C132%2C132%2C132%2C132%2C132&ohw=1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_2019092602.js?21064579

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

2396ae574bcae1b010e4624dfcf1f3eb7789701edbf9cfe3affb223b4b70ace6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14738
x-xss-protection: 0
google-lineitem-id: 4745974454,-2,253246569,253246569,241984809,253246569,253246569,4825966980
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138239360681,-2,138271463540,138271463546,75375443409,75375443409,75374362809,138247024569
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_modern_rendering_2019092602.js Show response
securepubads.g.doubleclick.net/gpt/ 59 KB
23 KB 39ms
38ms Script
text/javascript 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_rendering_2019092602.js?21064579

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_2019092602.js?21064579

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

sffe /

Resource Hash

ede50408d9975eb59f99b6525984e2c1cf091977e1bbc37d49a1aee6e75bcc90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 26 Sep 2019 18:43:36 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 23878
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ 0
0 21ms
7ms Other
text/html 2a00:1450:4001:81f::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_2019092602.js?21064579
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/10/01/c6fe8bcc-7c8d-4d1f-ae7d-749d63380f76/thumbnail/70x53/de6ccffc6a9a309985a6fcabc8961240/istock-business-email-and-accounting.jpg

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

3fe62dc6820ac4d4bd4bd0f7d28471fde967492b7cc3308ced0a195bdd37a9a3

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
x-content-type-options: nosniff
age: 99984
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4929
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "ee39e503b6bedf0c98c388b7e8589aca"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

7e2d4be3aa4af820adeff7929ee539740102bd2619e4c5a546299c649e994c56

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1312803
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4192
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "7c022d9c6dd601e087e186ee6dfe1fc7"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/09/25/593191a6-95bd-492d-9893-8ddd7f8bc280/thumbnail/70x53/686caea5bf20c710ebde2f385f1d799c/istock-gdpr-image-2019.jpg

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

99ee25a9f167f0de6f763814bccbd6f46d6de72ce93af8a319dab16fbf4e4571

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 625602
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4425
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "8977ecbb8cb82d77fb091c7a7f186163"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/09/27/bd2481de-d5af-4c10-962c-3f04cc7b22a6/thumbnail/70x53/831a02607d74896bf50676c03e7b9742/victim-of-a-ransomware-attack.jpg

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

875bc944393483ad8a1a517bd4a0cc131dc62212bbdc93d8ec141d43131ba847

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 531205
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4462
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "d3f06eef2ffac7faadbe3055a70682ac"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 ima3.js Show response
s0.2mdn.net/instream/html5/ 270 KB
92 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:818::2006
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/html5/ima3.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

f376ec816553a1689505887acf667a213907fa9c9a3086cf1c4d49b9ce85886e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 93892
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H2 200 feature-disabled-d41d8cd98f-rev.js Show response
zdnet3.cbsistatic.com/fly/js/ 0
131 B 7ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/feature-disabled-d41d8cd98f-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
x-content-type-options: nosniff
age: 160606
status: 200
vary: Accept-Encoding
content-length: 0
x-xss-protection: 1; mode=block
last-modified: Tue, 01 Oct 2019 15:04:58 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d936b1a-0"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 08 Oct 2019 18:10:43 GMT

POST
H/1.1 200
OK headerstats Show response
as-sec.casalemedia.com/ 0
337 B 26ms
12ms XHR
text/plain 2.18.234.21
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/headerstats?s=182823&u=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&v=3
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:30 GMT
Server: Apache
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H2 200 fly-disqus-count-1f604770a3-rev.js Show response
zdnet2.cbsistatic.com/fly/js/components/ 882 B
584 B 7ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/components/fly-disqus-count-1f604770a3-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

b2ab8784d5ca4bc5e4e1990ba55c6d9f041b8fe8cf41ad9afa37bc1c3dd12756

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 289521
status: 200
vary: Accept-Encoding
content-length: 460
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Sep 2019 14:07:16 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d8cc614-372"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 07 Oct 2019 06:22:09 GMT

GET
H2 200 309391486091569 Show response
connect.facebook.net/signals/config/ 307 KB
78 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/309391486091569?v=2.9.4&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

d44c1c3b519cd0b390eb41352d8f3e522e4ed7eac8bc5cf475638985a9c4af16

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 79752
x-xss-protection: 0
pragma: public
x-fb-debug: fM49V7HXI+XTke8ySu2BaudcVJTPSYGftBinY6vg7X5e/lN6rCCu/3BiIllz0zsFOgNqmwj9DGP0PWchlzXQXw==
x-fb-trip-id: 420120009
x-frame-options: DENY
date: Thu, 03 Oct 2019 14:47:30 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 ua-sdk.min.js Show response
web-sdk.urbanairship.com/notify/v1/ 78 KB
17 KB 22ms
6ms Script
application/javascript 35.227.208.151
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://web-sdk.urbanairship.com/notify/v1/ua-sdk.min.js
Requested by: Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-29ae327ed0-rev.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 35.227.208.151 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 151.208.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e59c8c655db8c097ed0067789aeb44ed58f25f8c68a5772bbb3f1fdc18e5e336

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:43:20 GMT
content-encoding: gzip
x-goog-meta-goog-reserved-file-mtime: 1556302399
age: 250
x-guploader-uploadid: AEnB2Up8FR7B-s5qH9UVXPleWKe1oG1EtGrsRlYYBpvuKPgvkQQltC0vOwNKvxvA_TVlueqAfi3xNFV6pQ_QmIeGkYyab1-x3A
x-goog-storage-class: MULTI_REGIONAL
status: 200
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: clear
content-length: 16960
last-modified: Fri, 26 Apr 2019 18:13:21 GMT
server: UploadServer
etag: "251defdc0ecc8a3bad8ae4cf9aab1923"
vary: Accept-Encoding
x-goog-hash: crc32c=A7yEjg==, md5=JR3v3A7MijutiuTPmqsZIw==
x-goog-generation: 1556302401249893
cache-control: public, max-age=300
x-goog-stored-content-length: 16960
accept-ranges: bytes
content-type: application/javascript
expires: Thu, 03 Oct 2019 14:48:20 GMT

GET
H/1.1 200
OK z Show response
lightboxapi2.azurewebsites.net/z9l/40913/www.zdnet.com/jsonp/ 218 B
503 B 686ms
686ms Script
application/javascript 23.99.128.52
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL: https://lightboxapi2.azurewebsites.net/z9l/40913/www.zdnet.com/jsonp/z?cb=1570114050145&callback=jQuery17107302815199944876_1570114049093&_=1570114050146
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637048605074139690
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.99.128.52 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS: waws-prod-dm1-001.cloudapp.net
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 755c9ddf4b6ab524af31de451f3eeec2aa094beaa56416f61e12f3639612f90b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:29 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Content-Length: 290
Vary: Accept-Encoding
Content-Type: application/javascript

GET
H2 200 z.gif Show response
api1.lightboxcdn.com/z9u/LIewXglgNlCGD0BWAdABgAQApiwMYQDsAXEAZwAsBudASWIFMp0dd0B5AZXQA10BGVAH0-AFkGIAlOgCCAB1lR6AdXoAjANIQiSAMwB2ZDoBsWdQAkAKsAAyAGnRQIAa3roA4vVxOQUgMLkAJxAAW3p4PRE0Qz0AJgBOZD4jOPQO... 183 B
362 B 21ms
20ms XHR
application/javascript 2606:4700::6810:4fa5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://api1.lightboxcdn.com/z9u/LIewXglgNlCGD0BWAdABgAQApiwMYQDsAXEAZwAsBudASWIFMp0dd0B5AZXQA10BGVAH0-AFkGIAlOgCCAB1lR6AdXoAjANIQiSAMwB2ZDoBsWdQAkAKsAAyAGnRQIAa3roA4vVxOQUgMLkAJxAAW3p4PRE0Qz0AJgBOZD4jOPQOWAAzWACIXQNjIA__XZX/z.gif
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637048605074139690
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: dd787044f07fb551657e198707ea27bfddcf6cf53bd6e8bf5efd6322a5273cba

Request headers

Accept: */*
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: br
cf-cache-status: HIT
age: 81253
x-powered-by: ASP.NET
status: 200
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
access-control-allow-credentials: true
cf-ray: 51ffb62d7e4f595e-VIE
expires: Fri, 04 Oct 2019 14:47:30 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/1036174608/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=AgqWXYrSCY7d7g...
https://www.google.com/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1235091298&crd=&is_vtc=1&random=2175587563
https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1235091298&crd=&is_vtc=1&random=2175587563&ipr=y

42 B
110 B

20ms
20ms

Image
image/gif

2a00:1450:4001:81c::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1235091298&crd=&is_vtc=1&random=2175587563&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Oct 2019 14:47:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 03 Oct 2019 14:47:30 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1235091298&crd=&is_vtc=1&random=2175587563&ipr=y
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK pixel
ad.yieldmanager.com/ 0
341 B 119ms
39ms Image
text/plain 2a00:1288:110:c305::9000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.yieldmanager.com/pixel?id=2447099&t=2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::9000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
X-Content-Type-Options: nosniff
Server: ATS
Age: 0
Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security: max-age=31536000
Connection: keep-alive
Content-Length: 0
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK s
pixel.everesttech.net/4083/ 128 B
716 B 19ms
18ms Image
image/png 66.117.28.68
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/4083/s?s=12969
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Last-Modified: Wed, 19 Oct 2016 22:11:25 GMT
Server: Apache
ETag: "443742-80-53f3f17013d40"
Vary: Cookie
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: image/png
Keep-Alive: timeout=15, max=996542
Content-Length: 128

GET
H2 200 show-hide-1.0-7dc26ff326-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 2 KB
818 B 6ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/show-hide-1.0-7dc26ff326-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f92514f4e39c16da9037f964148a09a79419744b77d611860ffc81c86aeace0a

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 16780
status: 200
vary: Accept-Encoding
content-length: 710
x-xss-protection: 1; mode=block
last-modified: Wed, 02 Oct 2019 15:37:53 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d94c451-7a5"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 10 Oct 2019 10:07:50 GMT

GET
H2 200 inferredEvents.js Show response
connect.facebook.net/signals/plugins/ 35 KB
10 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/plugins/inferredEvents.js?v=2.9.4

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

b4e9e9bef19c34422f55a7fdb9d10c4db5e39cff24b8c98a0be0e09b2ee6ac2b

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 10218
x-xss-protection: 0
pragma: public
x-fb-debug: bLtz5DyI/I5wXCxl1PLZ7gezcqao1vrv25pgvOhK96hN8hTEGBO04fFpHMT8CbghHv2DpG8vZXud+5tbi2/GyA==
x-fb-trip-id: 420120009
x-frame-options: DENY
date: Thu, 03 Oct 2019 14:47:30 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 VideoHeartbeat-2.0.2.min.js Show response
vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/ 143 KB
29 KB 6ms
6ms Script
application/javascript 151.101.14.133
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e08209b44a15fd9f6b9977d2580034e8d3da36542235802c2722ff8db4c0a461

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
age: 1085742
x-cache: HIT, HIT
status: 200
content-length: 28977
x-amz-id-2: Cf+ez/evZwJi2gFLSdyjft7yGVaKwux+Xpvi6r/uDB3kKBPXFs9dkuki+ne3/+bsFNBPb8+5aCA=
x-served-by: cache-dca17779-DCA, cache-fra19126-FRA
last-modified: Fri, 01 Feb 2019 18:21:02 GMT
server: AmazonS3
x-timer: S1570114050.241151,VS0,VE0
etag: "215943f0e77b4fcc9cc72b98a8ea1cfc"
vary: Accept-Encoding
x-amz-request-id: 1399DC71A77E592D
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=2592000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 6605, 9

GET
H/1.1 200
OK count.js Show response
zdnet-1.disqus.com/ 1 KB
1 KB 356ms
342ms Script
application/javascript 151.101.112.134
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet-1.disqus.com/count.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

nginx /

Resource Hash

3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Age: 2153600
P3P: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 871
X-XSS-Protection: 1; mode=block
Last-Modified: Wed, 04 Sep 2019 20:05:34 GMT
Server: nginx
ETag: "5d70190e-367"
Strict-Transport-Security: max-age=300; includeSubdomains
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=300
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect

GET
H2 200 /
www.facebook.com/tr/ 44 B
323 B 19ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=309391486091569&ev=PageView&dl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&rl=&if=false&ts=1570114050247&sw=1600&sh=1200&v=2.9.4&r=stable&a=tmtealium&ec=0&o=30&fbp=fb.1.1570114050247.1424608009&it=1570114050132&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Thu, 03 Oct 2019 14:47:30 GMT

POST
H2 204 /
686eb51a.akstat.io/ 0
201 B 75ms
60ms Other
image/gif 104.111.214.229
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://686eb51a.akstat.io/

Requested by

Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.214.229 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-214-229.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Thu, 03 Oct 2019 14:47:30 GMT
status: 204
content-type: image/gif
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/v2/ 2 KB
1 KB 33ms
33ms XHR
application/json 104.111.214.229
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1570114050259&s=768d277575c1392c09d2f0b83c3e0e4ebd50c94e402ee65cefc43d6e51130b8a
Requested by: Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.214.229 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-111-214-229.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 2c1c4ca8a45d8978ba1b8be7aa9a60018ce4c2e4a2bf5a1cb80f043d4418e6eb

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 735

GET
H2 200 AppMeasurement-2.3.0.min.js Show response
vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/ 77 KB
27 KB 6ms
6ms Script
application/javascript 151.101.14.133
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/AppMeasurement-2.3.0.min.js
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4974c54f5183f50fd1f3c3d49c496fd79602f8159b6d393d3fab09e4433555dd

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
age: 534560
x-cache: HIT, HIT
status: 200
content-length: 27260
x-amz-id-2: 9s6i6EteVxm5ubGSrZmQQGj2X4g0g1ppYWgpwMjlCnQZ29OggPmck5WwK+NVWaKVLJ/lppiMT8k=
x-served-by: cache-dca17744-DCA, cache-fra19126-FRA
last-modified: Fri, 01 Feb 2019 18:21:02 GMT
server: AmazonS3
x-timer: S1570114050.268483,VS0,VE0
etag: "d71ba6c9a930b6864408830c3e2705f9"
vary: Accept-Encoding
x-amz-request-id: 2DE42663743D817A
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=2592000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 580, 9

GET
H2 200 bcn
www.summerhamster.com/ 43 B
181 B 18ms
6ms Image
image/gif 35.157.160.140
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.summerhamster.com/bcn?fe=1570114050275&y=2.0.1105&elg=972089869&flg=68&x=zzz.cgqhw.frp%2Fduwlfoh%2Fd-kxjh-dqgurlg-wurmdq-pdozduh-fdpsdljq-zdv-glvfryhuhg-diwhu-wkh-jdqj-ehklqg-lw-pdgh-edvlf-vhfxulwb-plvwdnhv%2F&vqwo=1&deo=0&g0=vg%3A%3Aer%2Cxd%3A%3Aqexd%3A%3Aqsu%7Cvg%3A%3Ask%3A%3Aqsk%3A%3Aqsu%7Cgisl%3A%3Alp%2Clqi%2Cqh%3A%3Aqoe%3A%3Aqsu%3A%3Axuo%3D%2F%2Fdg.grxeohfolfn.qhw%2Fggp%2Fdg%2Frzlovzzzbz%2F%3Brug%3D1570114048866%3F%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cddg%2Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.des_re_halvw%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Csu%3A%3Aid%3A%3Aquiv%3A%3Aqsu&hu=0&g2=0%3A%3A0%3A%3A0%3A%3A0%3A%3A0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.160.140 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-35-157-160-140.eu-central-1.compute.amazonaws.com
Software: Jetty(9.2.10.v20150310) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Thu, 03 Oct 2019 14:47:30 GMT
server: Jetty(9.2.10.v20150310)
access-control-allow-origin: *
content-length: 43
access-control-allow-methods: *
content-type: image/gif

GET
H2 200 ggcmb510.js Show response
cdn-gl.imrworldwide.com/novms/js/2/ 12 KB
5 KB 19ms
6ms Script
application/javascript 2600:9000:20eb:b400:2:42d9:3100:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/novms/js/2/ggcmb510.js
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:20eb:b400:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f68ec7cf550e86cb14e4d992724157c4f625ea3f0cd7d06e9e533c17c735401d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: hJwFf7.rJ8_eWm5jL3mfN_44ER66zoAa
content-encoding: gzip
last-modified: Fri, 06 Sep 2019 14:11:27 GMT
server: AmazonS3
age: 3115
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=86400
date: Thu, 03 Oct 2019 14:20:43 GMT
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: Rk0-ZzQWA9rKxYw18ucs91UwsFzXhnn3BE_1f1w0y8Fbcw0BO02s5w==
via: 1.1 8f20db43ba7579b7216cf908572d5054.cloudfront.net (CloudFront)

GET
H2 200 mux.js Show response
vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/ 81 KB
25 KB 6ms
6ms Script
application/javascript 151.101.14.133
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/mux.js
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e812da2f13362e348f887e6eb8361bc247f6d043588aa436df4c64e4bd04e7f7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
age: 711013
x-cache: HIT, HIT
status: 200
content-length: 25193
x-amz-id-2: uyqq9GTCYIovpBDCLE78+pIdisUuOvn8uUDB+xH4SeB2+mR2SCdeoeIES21yRqXAa2GJK5TF/V8=
x-served-by: cache-dca17774-DCA, cache-fra19126-FRA
last-modified: Fri, 01 Feb 2019 18:21:06 GMT
server: AmazonS3
x-timer: S1570114050.303918,VS0,VE0
etag: "5d69e0e991739e9cd3f544944c8b3739"
vary: Accept-Encoding
x-amz-request-id: 661201C46759821C
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=2592000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 485, 8

GET
H2 206 uvp_blank.mp4
vidtech.cbsinteractive.com/h5/blanks/ 11 KB
11 KB 6ms
6ms Media
video/mp4 151.101.14.133
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://vidtech.cbsinteractive.com/h5/blanks/uvp_blank.mp4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6227f18e898e5b7c708fc1eb1763bd1b2186bdecd6f8b81f4bc1bf84f4d7d4e6

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range: bytes=0-

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
via: 1.1 varnish, 1.1 varnish
age: 1325245
x-cache: HIT, HIT
status: 206
x-cache-hits: 241677, 38300
content-length: 11247
x-amz-id-2: RWSuYoveoPlVL8+CKVrvoJOxvT/jZR2ccK055Pg68MOkg2YkaejHy+1cH72KSfRTxtYrLSmSGpM=
x-served-by: cache-dca17723-DCA, cache-fra19126-FRA
content-range: bytes 0-11246/11247
last-modified: Fri, 21 Dec 2018 00:54:05 GMT
server: AmazonS3
x-timer: S1570114050.333955,VS0,VE0
etag: "707bb2a4c9141aba1068d851f5be0409"
x-amz-request-id: 4F6B1AEF2D270DCA
cache-control: public, max-age=2592000
accept-ranges: bytes
content-type: video/mp4
x-amz-meta-mtime: 1296432000

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 715 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 glcfg510.js Show response
cdn-gl.imrworldwide.com/novms/js/2/configs/ 2 KB
1 KB 7ms
7ms Script
application/javascript 2600:9000:20eb:b400:2:42d9:3100:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/novms/js/2/configs/glcfg510.js
Requested by: Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/ggcmb510.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:20eb:b400:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: acf3b5b3ade1391096f23120b725a032dce430448ba8aff2a6f0c3f9c598b2a3

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: GInHhHfR4d51qjhnrZPDTMhozHWlfp_N
content-encoding: gzip
last-modified: Tue, 10 Sep 2019 15:40:32 GMT
server: AmazonS3
age: 3179
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=86400
date: Thu, 03 Oct 2019 14:03:54 GMT
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: YIL3AA7qvUJNX7E-XTbesXpT5HjPLt9BsOho4CUTSvnYZz22xtSmXg==
via: 1.1 8f20db43ba7579b7216cf908572d5054.cloudfront.net (CloudFront)

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 2 KB
1 KB 33ms
33ms XHR
application/json 52.31.175.110
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&d_cid_ic=userId%01&d_cid_ic=puuid%01&ts=1570114050355
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/AppMeasurement-2.3.0.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.175.110 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-31-175-110.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 2f528c7545091cd56a7605b14531a2ac0fa48b87b09c9c826ecf520d43b33524

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v045-00ec72527.edge-irl1.demdex.com 5.59.0.20190904135845 2ms (+1ms)
Pragma: no-cache
Content-Encoding: gzip
X-Error: 300,300
X-TID: oIuP8YIESPA=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 673
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
DATA 200
OK truncated
/ 9 KB
9 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c872580af551ba7c07a453c4a0b45a1ca614e3246afe7fc08f7bf2c7de4bd0b6

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin: https://www.zdnet.com

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H2 200 id Show response
saa.cbsi.com/ 90 B
404 B 29ms
29ms XHR
application/x-javascript 108.128.130.224
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://saa.cbsi.com/id?d_visid_ver=2.3.0&d_fieldgroup=A&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&mid=53510638259362554562209093715854961023&ts=1570114050415

Requested by

Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/AppMeasurement-2.3.0.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.128.130.224 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-108-128-130-224.eu-west-1.compute.amazonaws.com

Software

jag /

Resource Hash

e8f4e59d72798de9c04d8e937b812a2cf159ab547c42fdd10cefcfb7642db8a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Thu, 03 Oct 2019 14:47:30 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-5d695d76d8-rp258
vary: Origin
x-c: master-1021.Ic37195.M0-288
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.zdnet.com
access-control-allow-credentials: true
content-type: application/x-javascript
content-length: 90
x-xss-protection: 1; mode=block

GET
H2 200 bridge3.337.0_en.html
imasdk.googleapis.com/js/core/ Frame 7B87 0
0 6ms
5ms Document
text/html 2a00:1450:4001:817::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.337.0_en.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/instream/html5/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: imasdk.googleapis.com
:scheme: https
:path: /js/core/bridge3.337.0_en.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 192446
date: Thu, 03 Oct 2019 09:30:45 GMT
expires: Fri, 02 Oct 2020 09:30:45 GMT
last-modified: Tue, 01 Oct 2019 17:33:59 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 19005
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ 26 KB
10 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:818::2006
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/instream/html5/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 10523
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H2 200 / Show response
www.zdnet.com/video/related-videos-xhr/the-10-best-ways-to-secure-your-android-phone/ 34 KB
6 KB 182ms
182ms XHR
application/json 2.18.233.143
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/video/related-videos-xhr/the-10-best-ways-to-secure-your-android-phone/

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a2-18-233-143.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

2e898a76df3a30aea7677eebcacab3ccbc9c03d2f655d04f853cfc429bad13b1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 5303
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 03 Oct 2019 14:01:24 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Thu, 03 Oct 2019 14:47:30 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: 86b145f5-9cd4-4e9d-9955-04cf06c9534b
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=5400, private
accept-ranges: bytes
expires: Thu, 03 Oct 2019 15:31:24 GMT

GET
H2 200 36A8CE_2_0.woff2
vidtech.cbsinteractive.com/uvpjs/0.42.297/css_assets/ 53 KB
54 KB 19ms
6ms Font
binary/octet-stream 151.101.14.133
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/css_assets/36A8CE_2_0.woff2
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 02f3b82bf48c364a56b75c12695031ce9fa6dbc0e39af44b677d65bab6fe90fd

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
via: 1.1 varnish, 1.1 varnish
age: 1877574
x-cache: HIT, HIT
status: 200
content-length: 54767
x-amz-id-2: MB4kz71c4pCgKqmbxlPCRwopnXgRkM+K6PNPBZydd9jschWqEK3QWyQXFkKNxNrVPNecOxrwKKc=
x-served-by: cache-dca17721-DCA, cache-fra19147-FRA
last-modified: Fri, 01 Feb 2019 18:20:56 GMT
server: AmazonS3
x-timer: S1570114050.449291,VS0,VE0
etag: "22d779c809ed11e380d62c76e1f202e8"
access-control-max-age: 3600
x-amz-request-id: 3ADB3AE2E6D210C6
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
content-type: binary/octet-stream
x-cache-hits: 95, 2

GET
H2 200 ping
ping.chartbeat.net/ 43 B
168 B 92ms
92ms Image
image/gif 107.23.115.104
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=video%40zdnet.com&g=65713&p=%2Fvideo%2Fmanifest%2Fthe-10-best-ways-to-secure-your-android-phone.m3u8&i=Turn%20your%20Android%20smartphone%20into%20a%20bunker%20with%2010%20simple%20steps&g0=security&g1=danny%20palmer&u=CTY6-7C_mDQtCU1XzA&t=C9yZ4WBuJbw7DZ7xoesJzrrmVEYC&x=0&y=0&V=116&VS=VS&n=1&b=1599&r=&_vd=71000&_vi=This%20huge%20Android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made%20basic%20securit&_vp=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F&_vh=zdnet.com&_pu=DSrogqCWXKnexY2L3&_pt=DPlZj-CSh1urDJEzIbBcT0cxCDy1Vl&_pr=&_vdd=zdnet.com&_vt=ct&_vs=s1&_vcs=0&_vvs=0&_vpt=0&_vaup=man&_vplt=0.42.297&_vce=0&c=0&W=0&R=0&I=1&E=0&j=75&tz=-120&_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.23.115.104 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-107-23-115-104.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Thu, 03 Oct 2019 14:47:30 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
expires: 0

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 2 KB
1 KB 37ms
37ms XHR
application/json 52.31.175.110
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&d_mid=53510638259362554562209093715854961023&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%012ECB050105158000-401AA844C0D0EA62&d_cid_ic=userId%01&d_cid_ic=puuid%01&ts=1570114050476
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/AppMeasurement-2.3.0.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.175.110 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-31-175-110.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 263b5d559df316e9b1b39680d4bd08e02c7d0ed695e4499536b7a09a2c19793d

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v045-0a1d67f6c.edge-irl1.demdex.com 5.59.0.20190904135845 6ms (+1ms)
Pragma: no-cache
Content-Encoding: gzip
X-Error: 300,300
X-TID: PPXTWO0fQLA=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 674
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 PF7B87067-BF4D-F80F-E040-070AAD316CE6.js Show response
cdn-gl.imrworldwide.com/conf/ 41 KB
8 KB 7ms
6ms Script
application/javascript 2600:9000:20eb:b400:2:42d9:3100:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/conf/PF7B87067-BF4D-F80F-E040-070AAD316CE6.js
Requested by: Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/configs/glcfg510.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:20eb:b400:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 420203ca7b0395ca062903c765b681e27062360484f8274a389461e4a4a071d6

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: h6vUD0w3qBUsDiAOZIJHl73TXD82poNU
content-encoding: gzip
last-modified: Tue, 01 Oct 2019 04:36:23 GMT
server: AmazonS3
age: 214
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=86400,s-maxage=86400
date: Thu, 03 Oct 2019 14:43:57 GMT
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: m5UEaNSi62W1pKLqMpPx_UAVHGUB8GihlGgh5WBvDLLylkw3GhYltw==
via: 1.1 8f20db43ba7579b7216cf908572d5054.cloudfront.net (CloudFront)

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame FD41 0
63 B 17ms
17ms Fetch
image/gif 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsttBA72nc3CfxawVLPg1EkAIVOLukceSa3QazTV1Cq5X7z3mT6X_Gim-J7Dti_ItffxmnRIGeyL4EjaSCbj1tSYkBDow8w4w0ZFugYQ0R5oXaq2-ymqaSJXT5IbhWux705OXbsBPXtCAPsNgnnaeTb-Df-NB9ojk8frcapzQW0vwZHR5C7y2gsF3UiA3W4eClFoZqGQUh8w_O4sgjwCe87NJS71FFRYDaQKxnnjxfmgC8vxkZj3UobyaFz9Xyt353NdzEJZ-8TQ&sai=AMfl-YSUDZDA8PKiilVoqvOY4FcVq7DrpJNHGX0GgHL9dH6XFTzdEhWvjyfoPFP4Rsk8PamPSLUUW0Q4ODgTVAQXTaXWVMdO5goOqYPKTomss7H7VVrezXPaxOZmZpA1js8T&sig=Cg0ArKJSzN4Lb7V6YJlGEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:30 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame FD41 78 KB
29 KB 60ms
44ms Script
text/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5f224a13a15499778526423761125cbae8b8063bf0f90a46862671e17ccc9e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1569842443931303"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29671
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame FD41 305 KB
101 KB 22ms
7ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_rendering_2019092602.js?21064579
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Oct 2019 19:12:57 GMT
Server: AmazonS3
x-amz-request-id: 9073494F6B56554C
ETag: "90057ee6dd9ded5b49509cb6336f58d4"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=52652
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 103402
x-amz-id-2: JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 77 KB
29 KB 60ms
45ms Script
text/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_2019092602.js?21064579

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

a7708a738c64bd02df7ae231ab503159ab3336fa03de1853675631309ec07ada

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1569842443931303"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29108
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame D8BF 0
63 B 17ms
16ms Fetch
image/gif 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuOG5EuBdHgyztXy8YXqWbgaLxUyeDF_xV58_3GrEzmdCB9F19QCNlnrk0wvGbbnhN5HQ9q59RLpShwl8UK38Ra_4VbYa_H1Z77d330wAQqGCvx2toJwE_XBoX3_RT3RZiiOKtRBlyWtMpUoN_1Noq-6yHNhjHuLTd3CmNEqHv0x-UPknWTgdP_IrvRBFTL8cM5uBHJHcZCuH_Sre2eqZnF7UEDw-ICowyuT5a2Yso50tEEBXXkut542e-Wzth3W9sOL3M&sai=AMfl-YSNBlcmxUB6Sukb6jLL3ziOGNJHwtRTpmXN3sDB1CgcTOwGJISBgQMtWwNipTe_rrtO9WDR1xws6buVo0m9uqw15raZkNg0ogqoAD7Mu9cjYCMICNho_qmuFlMRpGu0&sig=Cg0ArKJSzHIEtk1g8Fk3EAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:30 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK 9818.js Show response
ads.rubiconproject.com/ad/ Frame D8BF 26 KB
8 KB 26ms
7ms Script
text/javascript 23.37.55.184
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.rubiconproject.com/ad/9818.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache / PHP/5.3.3
Resource Hash: d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=1443
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 7558
Expires: Thu, 03 Oct 2019 15:11:33 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame D8BF 78 KB
29 KB 56ms
47ms Script
text/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5f224a13a15499778526423761125cbae8b8063bf0f90a46862671e17ccc9e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1569842443931303"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29671
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame D8BF 305 KB
101 KB 17ms
6ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_rendering_2019092602.js?21064579
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Oct 2019 19:12:57 GMT
Server: AmazonS3
x-amz-request-id: 9073494F6B56554C
ETag: "90057ee6dd9ded5b49509cb6336f58d4"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=52652
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 103402
x-amz-id-2: JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame 0337 0
63 B 19ms
17ms Fetch
image/gif 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu8FQwfoFfmZ_EoMhyOZH7XMcTRF2wIDr6KLLI_LyCOfLsn-Lvb0GSyaxlYc4Gvs9IfAIwYvQaHRdTV1LfbEvLUJRvMyz7rq2AiIvcsqOWRdgAWwGYb58CXWStAUF2o2VpFDnDhrGd8iPP6my_jRrIHwOACwIk0XSZnbpLVQHPq1wz0UxY9z3JCl86TPEEEegENqkAKuRdGQi-Eteolc3I-CJtJ_pN0mrX2pBQQ_wRTQ4MZxQZZ-IDYdyvOe13p-rXTk_M&sai=AMfl-YRrs0Vi-3FyIDT3xqbf-ATvTgV1_M-QYn7yyuFKfbRvL73bBJtohrBZhlqAg0MqAFc5oOWwL9lTxhX4WKIeiiR5CRQEiEVYzwpZs836f8_TMvC2SS-nqC_Cb2QQtGbV&sig=Cg0ArKJSzJBWMEOx7tO7EAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:30 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK 9818.js Show response
ads.rubiconproject.com/ad/ Frame 0337 26 KB
8 KB 22ms
8ms Script
text/javascript 23.37.55.184
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.rubiconproject.com/ad/9818.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache / PHP/5.3.3
Resource Hash: d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=1443
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 7558
Expires: Thu, 03 Oct 2019 15:11:33 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0337 78 KB
29 KB 41ms
39ms Script
text/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5f224a13a15499778526423761125cbae8b8063bf0f90a46862671e17ccc9e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1569842443931303"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29671
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 0337 305 KB
101 KB 17ms
6ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_rendering_2019092602.js?21064579
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Oct 2019 19:12:57 GMT
Server: AmazonS3
x-amz-request-id: 9073494F6B56554C
ETag: "90057ee6dd9ded5b49509cb6336f58d4"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=52652
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 103402
x-amz-id-2: JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame F1BA 0
63 B 18ms
16ms Fetch
image/gif 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstkdoh_xZ_But_GvDmcI71XGPCZEwHeTEjNyX0p-DFJzEMEYGxPnCCYecBLTOxluOqJP3yyUeDyTCt8VrxN1CyylpUbsx46LEukY7mMnhQbVGyKpZfE5CdyngYkGqkAp_oV8GMYIZPLsVempP_O_pUlMFqUUiACHJ14o5JEi8dEKkFLiTOhfEzSfGEXNcr1LdxDs04eXbGUiwBLxG_ZPqqRIl2s5__vK45VL1fauz3l45qPhDuTxIfkbWylwN4yX-CSNyU&sai=AMfl-YSIVM32U0sLsETaDDWTHperiq5_vp3Y5vY4yDc2wMrBFiO5YeO-MHV0CDw8l10RBLuDOd8HjTLy2WtwbrZ6YIdyiDC-y7BMTiHLVWhZ8VqMOimNwgA9a62X3Kqz-I-7&sig=Cg0ArKJSzJsBVdIgAeQPEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:30 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK 9818.js Show response
ads.rubiconproject.com/ad/ Frame F1BA 26 KB
8 KB 21ms
8ms Script
text/javascript 23.37.55.184
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.rubiconproject.com/ad/9818.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache / PHP/5.3.3
Resource Hash: d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=1443
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 7558
Expires: Thu, 03 Oct 2019 15:11:33 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame F1BA 78 KB
29 KB 45ms
42ms Script
text/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5f224a13a15499778526423761125cbae8b8063bf0f90a46862671e17ccc9e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1569842443931303"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29671
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame F1BA 305 KB
101 KB 18ms
6ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_rendering_2019092602.js?21064579
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Oct 2019 19:12:57 GMT
Server: AmazonS3
x-amz-request-id: 9073494F6B56554C
ETag: "90057ee6dd9ded5b49509cb6336f58d4"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=52652
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 103402
x-amz-id-2: JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=

GET
H2 200 socasaservice-launched-by-macquarie-gove-5d8d820e9fad230001c8c2c6-1-sep-30-2019-24-21-16-poster.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/09/30/9ccddf65-78a5-4fe3-986c-ce383b51943d/thumbnail/170x96/d16dae7cc786d1530b57dd0c8e04b999/ 6 KB
6 KB 15ms
13ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/09/30/9ccddf65-78a5-4fe3-986c-ce383b51943d/thumbnail/170x96/d16dae7cc786d1530b57dd0c8e04b999/socasaservice-launched-by-macquarie-gove-5d8d820e9fad230001c8c2c6-1-sep-30-2019-24-21-16-poster.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

5745383487c3952eea3e1897ef015b91ccd0b30b7400770b5c9000a9000225f9

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 45967
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 5801
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "a9e18cb5dd9d3ab420946fa19ebbbf52"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 20191001-danny-karen-gdpr.png
zdnet2.cbsistatic.com/hub/i/r/2019/10/01/493c009c-f3a3-466d-a533-0296a7f69ae8/thumbnail/170x96/c43faa5b93fea1cc200cacd2d70a2fe2/ 37 KB
37 KB 9ms
7ms Image
image/png 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/10/01/493c009c-f3a3-466d-a533-0296a7f69ae8/thumbnail/170x96/c43faa5b93fea1cc200cacd2d70a2fe2/20191001-danny-karen-gdpr.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

b5bd040e94c4a87a1efe3d50ad481d5409fcf52d351fc070577299f2b9132d6b

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 157153
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 37502
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "f24f96d246285d951fe203d06473ff09"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 hackers-target-transportation-and-shippi-5d8dc365800f320001e09d98-1-sep-29-2019-20-21-41-poster.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/09/29/905fc4ea-408b-474f-a83d-e41e8dfea70b/thumbnail/170x96/b59051fe42de5cf5e98cd582a2ef896e/ 4 KB
4 KB 8ms
6ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/09/29/905fc4ea-408b-474f-a83d-e41e8dfea70b/thumbnail/170x96/b59051fe42de5cf5e98cd582a2ef896e/hackers-target-transportation-and-shippi-5d8dc365800f320001e09d98-1-sep-29-2019-20-21-41-poster.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

1996fb8b37fe4cf668c07fcdf89eedf167a0467acadbd5d177c078585232c745

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 249403
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4443
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "d03a857a23b5285736c4d55e0bb067c8"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 gdpr-heres-why-firms-are-still-strugglin-5d8dd0e2800f320001e0a64e-1-sep-27-2019-11-41-48-poster.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/09/27/8e729479-7e27-4a2e-ad8c-6560e6f709cc/thumbnail/170x96/a6ff2f3cceeee1543e5d9a0d850e0c00/ 4 KB
4 KB 11ms
9ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/09/27/8e729479-7e27-4a2e-ad8c-6560e6f709cc/thumbnail/170x96/a6ff2f3cceeee1543e5d9a0d850e0c00/gdpr-heres-why-firms-are-still-strugglin-5d8dd0e2800f320001e0a64e-1-sep-27-2019-11-41-48-poster.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

e3c8c5266002e44c9001cf7a9dff6ae0957769e7b45122b4abe63f9311c90de9

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 257677
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4074
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "d2a2c1da2acde3ed27003dba9c3c1ccc"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 the-ultimate-guide-to-finding-and-killin-5d866a039fad230001c65fb5-1-sep-25-2019-17-05-22-poster.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/09/25/e7d01642-2849-4784-b4e3-55b0b75b20c5/thumbnail/170x96/79fffa57e44d19c03b59ca167c082683/ 4 KB
4 KB 10ms
8ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/09/25/e7d01642-2849-4784-b4e3-55b0b75b20c5/thumbnail/170x96/79fffa57e44d19c03b59ca167c082683/the-ultimate-guide-to-finding-and-killin-5d866a039fad230001c65fb5-1-sep-25-2019-17-05-22-poster.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

a0846357a84bde9d83f32eff7da4622cda6456ff21ae9900628da7b9fafd398d

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 524796
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4503
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "8620005ac78d8257435d490058c643dd"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 ransomware-new-attack-has-links-to-gandc-5d8c8a98800f320001e021d1-1-sep-27-2019-11-44-25-poster.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/09/27/a42bd1a3-af6b-44f6-8bf8-9cc634acdab2/thumbnail/170x96/06724dcff56e7c2e162fde142e685152/ 4 KB
4 KB 8ms
7ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/09/27/a42bd1a3-af6b-44f6-8bf8-9cc634acdab2/thumbnail/170x96/06724dcff56e7c2e162fde142e685152/ransomware-new-attack-has-links-to-gandc-5d8c8a98800f320001e021d1-1-sep-27-2019-11-44-25-poster.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

585e68b616dc09fd14c7306595146b58e4f7178bd6d9397ccdb06035dcc90e6c

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 528486
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 3586
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "6a450490f238b4ddff085d66a916a206"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 act-government-and-austcyber-launch-canb-5d88447d9fad230001c688b2-1-sep-23-2019-6-59-00-poster.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/09/23/bf69e6e4-734b-4a15-8a4f-644ab89ce9b7/thumbnail/170x96/2a786f9c597a4f7b9a1298ad69ce23a6/ 5 KB
5 KB 9ms
8ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/09/23/bf69e6e4-734b-4a15-8a4f-644ab89ce9b7/thumbnail/170x96/2a786f9c597a4f7b9a1298ad69ce23a6/act-government-and-austcyber-launch-canb-5d88447d9fad230001c688b2-1-sep-23-2019-6-59-00-poster.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

3e7a5752fbc5eb7571f53132a305024cab6825bfaed3677a70c906b1ac47feb9

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 550791
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4858
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "a68259547f3d25ab3c0a5c0adb4e3498"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 albanian-gangs-take-up-cryptocurrencies-5d84ced9800f320001ddcfef-1-sep-25-2019-16-57-00-poster.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/09/25/43781d86-310e-44a7-95c7-f0a7bb5e7f6f/thumbnail/170x96/685a5897c8cc3c00ae09dc06019d8320/ 6 KB
6 KB 10ms
10ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/09/25/43781d86-310e-44a7-95c7-f0a7bb5e7f6f/thumbnail/170x96/685a5897c8cc3c00ae09dc06019d8320/albanian-gangs-take-up-cryptocurrencies-5d84ced9800f320001ddcfef-1-sep-25-2019-16-57-00-poster.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

3487767fc72b5c9653ccb95a5662386c06ea137d901918c4a33ae55363d71b44

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 621400
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 5665
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "2f891485332423c8715842537cf742a0"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 new-ransomware-strain-uses-overkill-encr-5d84cf6c800f320001ddd035-1-sep-25-2019-16-57-12-poster.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/09/25/645186be-6f22-456b-b8ee-0859ad0a2761/thumbnail/170x96/21c99195787ff9aaa49cfe2c78744c64/ 5 KB
5 KB 10ms
9ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/09/25/645186be-6f22-456b-b8ee-0859ad0a2761/thumbnail/170x96/21c99195787ff9aaa49cfe2c78744c64/new-ransomware-strain-uses-overkill-encr-5d84cf6c800f320001ddd035-1-sep-25-2019-16-57-12-poster.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

c6078d11c51e0bd1cf708d526df397c041d0c240d18b05b71a8b0e294c713d54

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 671722
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4757
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "1a77befc3b608d6ed363567685f70e1e"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 malware-two-android-apps-removed-from-go-5d888b839fad230001c69e8f-1-sep-23-2019-11-56-19-poster.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/09/23/734058ee-c602-46e7-a07b-137d5ee5047a/thumbnail/170x96/30f2d59b7c858189f1c49f7af20fcba1/ 4 KB
4 KB 9ms
6ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/09/23/734058ee-c602-46e7-a07b-137d5ee5047a/thumbnail/170x96/30f2d59b7c858189f1c49f7af20fcba1/malware-two-android-apps-removed-from-go-5d888b839fad230001c69e8f-1-sep-23-2019-11-56-19-poster.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

ed7f448873eab8e03fbe308acf43d9bb0cc12fe665907b37bc3a71c7decf3af7

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 788953
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4067
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "0f9cafd014db7a619ddb4276af0d692c"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame 19D3 0
63 B 20ms
16ms Fetch
image/gif 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstJeCsXo5Yzg3t-DDum1Gfp-9jA_asBdWGT6lVHEHN1hrZvpJ-LgzpNCNvIP9unXlRjh92dDH0evpk8fbNIgSejqB46dCbL8BY_zodRZuu2emIe-_S3kM_bYyU3hUXxtBdMUpKpWt_mkFWgIE_-TXDhQz0HyiUedvZ69G68jYEnHHZN6G2Fz8NEGzpwKk2m4hetPA6CrYy1LVJx9WZAhLAOWuKEpTRoonIDoMUy7hwxBDIGhU1ZON6XNtG9cgmqxPOUdck&sai=AMfl-YR3sARJIRfoJlGiPMpz1JV-RZ63zi7ivHYyUIpGYTvmGaUTkflN3RFU_mrYcZf3L8913OLIjP42-UqqbZyHT9AOlVNnMYbRAJyNYC0r7apoSssP2XOqKvvo8yBf8ATT&sig=Cg0ArKJSzM0OwaqHl0RiEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:30 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK 9818.js Show response
ads.rubiconproject.com/ad/ Frame 19D3 26 KB
8 KB 9ms
7ms Script
text/javascript 23.37.55.184
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.rubiconproject.com/ad/9818.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache / PHP/5.3.3
Resource Hash: d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=1443
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 7558
Expires: Thu, 03 Oct 2019 15:11:33 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 19D3 78 KB
29 KB 41ms
37ms Script
text/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5f224a13a15499778526423761125cbae8b8063bf0f90a46862671e17ccc9e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1569842443931303"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29671
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 19D3 305 KB
101 KB 8ms
6ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_rendering_2019092602.js?21064579
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Oct 2019 19:12:57 GMT
Server: AmazonS3
x-amz-request-id: 9073494F6B56554C
ETag: "90057ee6dd9ded5b49509cb6336f58d4"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=52652
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 103402
x-amz-id-2: JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame E907 0
63 B 18ms
17ms Fetch
image/gif 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvR76S1oTN05OQgn02BLkzB8hL129WzPlmUppHRbVSGxsq_7qP6JQ4V_K_dtpPLNnE6WMig473ks8QRDIzIfBGqIeSFlFsBVYJRS_oEVZ2vPHvdq41UiInxDU0HBb_m47bhsqycotKhSoFl5YRFowuRjmsUBN9QHh-I9XXwan40McKOXH_reA-v5eqFyEj4y41Ewjg0nd-hyx6dC_ONeGTOG9UvQZcbjfpyKYe_YwjPMmbe0jokdlrEV4zUFNLyN-iWPMI&sai=AMfl-YTd9rtiNLPEoAnfemHRi3CqPTVHJdHDzT92Ik156_N5t_xpkV05N5R9m_fa1R3uDEenJByihsvW7gfTWEDcrtRsQTkggmZxfIbXlavzUFIxhOAcf_dfpxWCSdNAzMEg&sig=Cg0ArKJSzCpkKZXX-HnDEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:30 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK 9818.js Show response
ads.rubiconproject.com/ad/ Frame E907 26 KB
8 KB 10ms
9ms Script
text/javascript 23.37.55.184
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.rubiconproject.com/ad/9818.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache / PHP/5.3.3
Resource Hash: d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=1443
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 7558
Expires: Thu, 03 Oct 2019 15:11:33 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame E907 78 KB
29 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5f224a13a15499778526423761125cbae8b8063bf0f90a46862671e17ccc9e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1569842443931303"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29671
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame E907 305 KB
101 KB 8ms
7ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_rendering_2019092602.js?21064579
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Oct 2019 19:12:57 GMT
Server: AmazonS3
x-amz-request-id: 9073494F6B56554C
ETag: "90057ee6dd9ded5b49509cb6336f58d4"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=52652
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 103402
x-amz-id-2: JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame DBB7 0
63 B 20ms
16ms Fetch
image/gif 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssQrx0I4VHg807bEETRizojvlSNMfU9KBMF5c5YeU1eU-LlLXK4JbvowJ1B356n3pg9tcvMpuEMzzqHh4bLtSLznJ2anXGz_ruGJKATkEUnwpXA8yGct8Gn2rwD_1aZaJ97awecVCBKTHd5xr4f68uSOekK_H_eJQClQY2zFqelKtcUKy05hpAw6kq-5BR-yuLa-M6XM8UlzcODF9go2RuCYCekSvX7Tz1X7D0Thq-eW4Jg3ZBD39fHtMDWUks9TVHlrs_Df0dO&sai=AMfl-YRNsTwkYt37I49-dnLNl-xhAj5cBkLUO5hVuMgdYOt0wujWeq2gNAGhBXdA5lUwlDNUfg0eBB9EFQpYMzsjjG-A990P2DYN7RYe0MOsS4Y-Anql_cvmYGyyRgqjdTmO&sig=Cg0ArKJSzCCmAZy6--NhEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:30 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 adKit.min.js Show response
rev.cbsi.com/common/js/ Frame DBB7 6 KB
2 KB 12ms
6ms Script
application/x-javascript 2.18.233.143
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://rev.cbsi.com/common/js/adKit.min.js?1664209588
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-143.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
last-modified: Mon, 13 May 2019 18:29:20 GMT
server: Apache
etag: "e524dc608d5c7c30eef57b6ed95dc6a8:1557772160"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
accept-ranges: bytes
content-length: 2149

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame DBB7 78 KB
29 KB 42ms
38ms Script
text/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5f224a13a15499778526423761125cbae8b8063bf0f90a46862671e17ccc9e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1569842443931303"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29671
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame DBB7 305 KB
101 KB 7ms
6ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_rendering_2019092602.js?21064579
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Oct 2019 19:12:57 GMT
Server: AmazonS3
x-amz-request-id: 9073494F6B56554C
ETag: "90057ee6dd9ded5b49509cb6336f58d4"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=52652
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 103402
x-amz-id-2: JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=

GET
H2 200 nlsSDK600.bundle.min.js Show response
cdn-gl.imrworldwide.com/novms/js/2/ 159 KB
46 KB 9ms
7ms Script
application/javascript 2600:9000:20eb:b400:2:42d9:3100:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Requested by: Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/conf/PF7B87067-BF4D-F80F-E040-070AAD316CE6.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:20eb:b400:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0ed08b2eb6ca91d95304d2c126a6482fe12c541132516e95b0f30c93ab3beeea

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: LsknotgJ27sHWfh0olFMGPF0aUHXxFfq
content-encoding: gzip
last-modified: Tue, 10 Sep 2019 15:40:32 GMT
server: AmazonS3
age: 1713
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=86400
date: Thu, 03 Oct 2019 14:21:05 GMT
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: 39UghBA7fxpWezmHJKMuEJrU9yN5EGn6Lgcxpgb2dMZvmFt-n-XmjA==
via: 1.1 8f20db43ba7579b7216cf908572d5054.cloudfront.net (CloudFront)

GET
H2 200 carousel-f3b9253e16-rev.js Show response
zdnet2.cbsistatic.com/fly/js/components/ 312 B
483 B 6ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/components/carousel-f3b9253e16-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

77682498c3ae319a10c59528b8e39180f6e08e6d5be63ef79b54cf21b8a6ec47

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 516931
status: 200
vary: Accept-Encoding
content-length: 215
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Sep 2019 14:07:16 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d8cc614-138"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 04 Oct 2019 15:11:59 GMT

GET
H/1.1 200
OK 283812-2.js Show response
optimized-by.rubiconproject.com/a/9818/59604/ Frame D8BF 2 KB
1 KB 118ms
90ms Script
text/javascript 69.173.144.140
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.49094678758224863&tk_st=1&rf=https%3A//www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/%23ftag%3DRSSbaffb68%7C&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1
Requested by: Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 4addcc6efa05d9d64766cfa58615e5f940455ca87b002340215c51ce5752352b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: Keep-Alive
Content-Type: text/javascript
Keep-Alive: timeout=5, max=163
Content-Length: 914
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK 283812-15.js Show response
optimized-by.rubiconproject.com/a/9818/59604/ Frame 0337 2 KB
1 KB 128ms
94ms Script
text/javascript 69.173.144.140
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.6618835823954274&tk_st=1&rf=https%3A//www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/%23ftag%3DRSSbaffb68%7C&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Requested by: Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: b583dc0c3a23a12be525b041d586f6263f044673f9002101ff510fd6a42adf6f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: Keep-Alive
Content-Type: text/javascript
Keep-Alive: timeout=5, max=128
Content-Length: 1064
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK 283812-15.js Show response
optimized-by.rubiconproject.com/a/9818/59604/ Frame F1BA 2 KB
1 KB 132ms
94ms Script
text/javascript 69.173.144.140
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.0741877935126567&tk_st=1&rf=https%3A//www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/%23ftag%3DRSSbaffb68%7C&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Requested by: Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 53e7271ea612799bbe25590852879c43de518e88870169f2cc98220169787ef0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: Keep-Alive
Content-Type: text/javascript
Keep-Alive: timeout=5, max=343
Content-Length: 918
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK count-data.js Show response
zdnet-1.disqus.com/ 243 B
766 B 6ms
6ms Script
application/javascript 151.101.112.134
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet-1.disqus.com/count-data.js?1=1b0217ac-3a72-470b-9289-742af80ceb70

Requested by

Host: zdnet-1.disqus.com
URL: https://zdnet-1.disqus.com/count.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

nginx /

Resource Hash

dba93ce15d94f490a3e2c7ef4adf1b5f8350917dc4d9b9051097e0e54c34b064

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Age: 85
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Vary: Accept-Encoding
Cache-Control: public, max-age=600
Strict-Transport-Security: max-age=300; includeSubdomains
Content-Type: application/javascript; charset=UTF-8
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 204
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK 283812-15.js Show response
optimized-by.rubiconproject.com/a/9818/59604/ Frame 19D3 2 KB
1 KB 195ms
166ms Script
text/javascript 69.173.144.140
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.762580033679435&tk_st=1&rf=https%3A//www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/%23ftag%3DRSSbaffb68%7C&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Requested by: Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: ce8562164c992f51fa43a7a9ba79612bed137fc4160c5262809342c36e65098a

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: Keep-Alive
Content-Type: text/javascript
Keep-Alive: timeout=5, max=474
Content-Length: 915
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK 283812-2.js Show response
optimized-by.rubiconproject.com/a/9818/59604/ Frame E907 2 KB
1 KB 106ms
77ms Script
text/javascript 69.173.144.140
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.07320145046675841&tk_st=1&rf=https%3A//www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/%23ftag%3DRSSbaffb68%7C&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1
Requested by: Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: b442294d74475ff92ff4f3669b4bed28c615e6196f5bfd8de33b1e7445c15bef

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Encoding: gzip
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: Keep-Alive
Content-Type: text/javascript
Keep-Alive: timeout=5, max=336
Content-Length: 915
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame DBB7 44 KB
14 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: rev.cbsi.com
URL: https://rev.cbsi.com/common/js/adKit.min.js?1664209588

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

3d5f6fa3e5acb251b5c5f3ab93c17237961d8dfcd1a5ea1265f1334e448dbf5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "297 / 998 of 1000 / last-modified: 1570111537"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14319
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H/1.1 200
OK n.js Show response
geo.moatads.com/ Frame FD41 107 B
365 B 54ms
21ms Script
text/html 18.130.64.138
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570114050779&de=156186382951&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=2&cb=0&ym=0&cu=1570114050779&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745974454%3A138239360681&zMoatPS=nav&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=7&zMoatH=7&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=7x7&zMoatSZPS=7x7%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1641872763&cs=0&callback=MoatSuperV26.gna822145
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.130.64.138 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-130-64-138.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 10278e03a87d6b560b103fb65f04512603133e1bdfe880c9877860f8b82c1d2e

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Server: nginx
Etag: "8da67ec99d937f61173159b8f6c4e915f07608db"
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=900
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 107

GET
H/1.1 200
OK n.js Show response
geo.moatads.com/ 105 B
363 B 62ms
24ms Script
text/html 18.130.64.138
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570114050779&de=156186382951&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=3&cb=0&ym=0&cu=1570114050779&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745974454%3A138239360681&zMoatPS=nav&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=7&zMoatH=7&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=7x7&zMoatSZPS=7x7%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=902735356&cs=0&callback=MoatDataJsonpRequest
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.130.64.138 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-130-64-138.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 69a516dd1e5351070256dbb2eef13f0979338847151f250bb1032948aa8ee747

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Server: nginx
Etag: "bd12ea376902392b769fa9ec888110d763936ab0"
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=900
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 105

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
5ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570114050779&de=156186382951&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=4&cb=0&ym=0&cu=1570114050779&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745974454%3A138239360681&zMoatPS=nav&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=7&zMoatH=7&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=7x7&zMoatSZPS=7x7%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1853075860&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:30 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:30 GMT

POST
H2 200 /
www.facebook.com/tr/ Frame 25BE 0
0 6ms
6ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 7117
pragma: no-cache
cache-control: no-cache
origin: https://www.zdnet.com
upgrade-insecure-requests: 1
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
accept-encoding: gzip, deflate, br
cookie: fr=00G912racqRs3Fptf..BdlgoC...1.0.BdlgoC.
Origin: https://www.zdnet.com
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Response headers

status: 200
content-type: text/plain
access-control-allow-origin: https://www.zdnet.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 0
server: proxygen-bolt
date: Thu, 03 Oct 2019 14:47:30 GMT

GET
H2 200 ls.html
cdn-gl.imrworldwide.com/novms/html/ Frame 2EE2 0
0 6ms
6ms Document
text/html 2600:9000:20eb:b400:2:42d9:3100:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/novms/html/ls.html
Requested by: Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:20eb:b400:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

:method: GET
:authority: cdn-gl.imrworldwide.com
:scheme: https
:path: /novms/html/ls.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
accept-encoding: gzip, deflate, br
cookie: IMRID=ae7eeef5-54ef-486b-b78f-5687651118b9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Response headers

status: 200
content-type: text/html
last-modified: Fri, 06 Sep 2019 14:11:26 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: TgDQJyYhN1aLSUrTFh9RqwoOo.QV2zkw
server: AmazonS3
content-encoding: gzip
date: Thu, 03 Oct 2019 13:56:05 GMT
cache-control: max-age=86400
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 8f20db43ba7579b7216cf908572d5054.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: -Tah8O2MohcvPcjm8WaAUx5IxJqiRhNO_MMT7WcKu8HvALtSv8uTlA==
age: 6064

GET
H/1.1 200
OK n.js Show response
geo.moatads.com/ Frame DBB7 106 B
364 B 26ms
26ms Script
text/html 18.130.64.138
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570114050889&de=816730933090&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=7&cb=0&ym=0&cu=1570114050889&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4825966980%3A138247024569&zMoatPS=top&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=371&zMoatH=771&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=371x771&zMoatSZPS=371x771%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1358988445&cs=0&callback=MoatSuperV26.gna177312
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.130.64.138 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-130-64-138.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 9283c9192d43d20701bbb3e6877fe0213dd3d24da4e725e750d55f36f329fb6e

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Server: nginx
Etag: "5ace1efa03d7b19db0b9d432c392f2ae82a65e35"
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=900
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 106

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame DBB7 109 B
171 B 15ms
14ms Script
application/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame DBB7 109 B
171 B 16ms
15ms Script
application/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2019092602.js Show response
securepubads.g.doubleclick.net/gpt/ Frame DBB7 158 KB
58 KB 44ms
44ms Script
text/javascript 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019092602.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

sffe /

Resource Hash

35aefd2d1de0b25d9a5640cf3129dfc507a3c417a7da34f4bb6f9b4a79e19484

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 26 Sep 2019 18:43:36 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 59149
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
5ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570114050889&de=816730933090&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=9&cb=0&ym=0&cu=1570114050889&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4825966980%3A138247024569&zMoatPS=top&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=371&zMoatH=771&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=371x771&zMoatSZPS=371x771%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=309267442&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:30 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame D8BF 75 KB
27 KB 42ms
23ms Script
text/javascript 2a00:1450:4001:81a::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.49094678758224863&tk_st=1&rf=https%3A//www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/%23ftag%3DRSSbaffb68%7C&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

bf655fd1f2f66d50693282dd406bc60b585260db094c708f218b18ba2576de46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 26894
x-xss-protection: 0
server: cafe
etag: 6195879739138677770
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H/1.1 200
OK 7ed92a8d-7d25-4893-99d2-a4733a86c2bd
beacon-eu2.rubiconproject.com/beacon/d/ Frame D8BF 43 B
268 B 45ms
16ms Image
image/webp 69.173.144.155
The Rubicon Project

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon-eu2.rubiconproject.com/beacon/d/7ed92a8d-7d25-4893-99d2-a4733a86c2bd?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=2&e=6A1E40E384DA563BC4D5AE615C6A1CCA6B395CB4E1E5699D655D7E1752687D688D03733F0A482CA7B1B163AF3C027D06172DB22D3B21A9B5AFD69714434A9A302C576DC214995D9D3570ECD3831C9446AC237D6FA0EBFC9A6240B348FC26EBCF9339CFA995EA152083009FDB9DE7981633F8630F2FDB6069
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.155 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: Rubicon Project /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:30 GMT
Cache-Control: private, max-age=0, no-cache
Server: Rubicon Project
Content-Type: image/webp
Content-Length: 43
Expires: 01 Jan 1970 10:00:00 GMT

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame 0337 75 KB
26 KB 42ms
23ms Script
text/javascript 2a00:1450:4001:81a::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.6618835823954274&tk_st=1&rf=https%3A//www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/%23ftag%3DRSSbaffb68%7C&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

bf655fd1f2f66d50693282dd406bc60b585260db094c708f218b18ba2576de46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 26894
x-xss-protection: 0
server: cafe
etag: 6195879739138677770
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H/1.1 200
OK 1e2a4399-6a0b-43c5-97bd-a1c731ccfe74
beacon-eu2.rubiconproject.com/beacon/d/ Frame 0337 43 B
268 B 44ms
14ms Image
image/webp 69.173.144.155
The Rubicon Project

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon-eu2.rubiconproject.com/beacon/d/1e2a4399-6a0b-43c5-97bd-a1c731ccfe74?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=15&e=6A1E40E384DA563B7299A1BF140EB5E82124D64C0C4B5DB512931DB0A4EB5E3C06BD2C24801E826757DF6F27AAEC31AD6D748C0D8D7FAA223853D48DF252C477A9C3B6DD073E16AC3A7D0F4B29A162671C45189F33B502F0956270D897C40F9B8341A4546875863E90E385F9572B9DD5BB4F33CDE214CF90
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.155 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: Rubicon Project /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:30 GMT
Cache-Control: private, max-age=0, no-cache
Server: Rubicon Project
Content-Type: image/webp
Content-Length: 43
Expires: 01 Jan 1970 10:00:00 GMT

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame F1BA 75 KB
26 KB 40ms
23ms Script
text/javascript 2a00:1450:4001:81a::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.0741877935126567&tk_st=1&rf=https%3A//www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/%23ftag%3DRSSbaffb68%7C&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

bf655fd1f2f66d50693282dd406bc60b585260db094c708f218b18ba2576de46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 26894
x-xss-protection: 0
server: cafe
etag: 6195879739138677770
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H/1.1 200
OK 521def61-1a69-4359-a1e5-fafb175fd28e
beacon-eu2.rubiconproject.com/beacon/d/ Frame F1BA 43 B
268 B 57ms
16ms Image
image/webp 69.173.144.155
The Rubicon Project

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon-eu2.rubiconproject.com/beacon/d/521def61-1a69-4359-a1e5-fafb175fd28e?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=15&e=6A1E40E384DA563B2A9CE132DC3E7BC60C9977D1CA5EDD430C32E817148B6C272BDBD83D0D881BF4AFA29EBA9AB16EC56D748C0D8D7FAA22184022062DEF2C8B2C576DC214995D9D3570ECD3831C9446AC237D6FA0EBFC9A6240B348FC26EBCFEB2496EFCC5E65F183009FDB9DE7981633F8630F2FDB6069
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.155 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: Rubicon Project /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:30 GMT
Cache-Control: private, max-age=0, no-cache
Server: Rubicon Project
Content-Type: image/webp
Content-Length: 43
Expires: 01 Jan 1970 10:00:00 GMT

GET
H2 200 carousel-1.0.js Show response
zdnet3.cbsistatic.com/fly/bundles/flyjs/js/components/ 21 KB
4 KB 6ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/bundles/flyjs/js/components/carousel-1.0.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

0bfe19716cf9c9ba0b1343bf813585bf7970dd9b3ad96d82c88874b28130edbf

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 601089
status: 200
vary: Accept-Encoding
content-length: 4361
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Sep 2019 14:06:03 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d8cc5cb-5590"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 03 Oct 2019 15:49:21 GMT

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame E907 75 KB
26 KB 43ms
30ms Script
text/javascript 2a00:1450:4001:81a::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.07320145046675841&tk_st=1&rf=https%3A//www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/%23ftag%3DRSSbaffb68%7C&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

bf655fd1f2f66d50693282dd406bc60b585260db094c708f218b18ba2576de46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 26894
x-xss-protection: 0
server: cafe
etag: 6195879739138677770
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H/1.1 200
OK 94808f42-6c1e-493a-8343-9445bee6b5bc
beacon-eu2.rubiconproject.com/beacon/d/ Frame E907 43 B
268 B 54ms
17ms Image
image/webp 69.173.144.155
The Rubicon Project

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon-eu2.rubiconproject.com/beacon/d/94808f42-6c1e-493a-8343-9445bee6b5bc?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=2&e=6A1E40E384DA563BB4D28D5CEE68C5C2F78A7D25B47A2886081B3CB21E8124222A80E1686C6142CC0E23163DC498849E172DB22D3B21A9B5B07DF21C6B66E0DDA9C3B6DD073E16AC3A7D0F4B29A162671C45189F33B502F0956270D897C40F9B96B8F425CDA5648290E385F9572B9DD5BB4F33CDE214CF90
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.155 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: Rubicon Project /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:30 GMT
Cache-Control: private, max-age=0, no-cache
Server: Rubicon Project
Content-Type: image/webp
Content-Length: 43
Expires: 01 Jan 1970 10:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame D8BF 109 B
171 B 15ms
15ms Script
application/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame D8BF 109 B
171 B 16ms
16ms Script
application/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/ Frame D8BF 231 KB
85 KB 69ms
69ms Script
text/javascript 2a00:1450:4001:81a::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

c8615d41121675d739ad8a05627ccfd2c6b99c576521ff17a2313f79a37fa6cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 86819
x-xss-protection: 0
server: cafe
etag: 6415741152906011923
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H2 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/ Frame 582D 231 KB
85 KB 60ms
59ms Script
text/javascript 2a00:1450:4001:81a::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

c8615d41121675d739ad8a05627ccfd2c6b99c576521ff17a2313f79a37fa6cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 86819
x-xss-protection: 0
server: cafe
etag: 6415741152906011923
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Oct 2019 14:47:30 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20190926/r20190131/ Frame DC92 0
0 6ms
6ms Document
text/html 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20190926/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20190926/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnxzJR9aMw3cvcvUbhCrqELcYxH8XClZkM94T7weCwVWsFk8w4UQmXMDaRS
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
vary: Accept-Encoding
date: Mon, 30 Sep 2019 19:30:48 GMT
expires: Mon, 14 Oct 2019 19:30:48 GMT
content-type: text/html; charset=UTF-8
etag: 2385566188703980536
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 7388
x-xss-protection: 0
cache-control: public, max-age=1209600
age: 242203
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame F4A5 0
0 65ms
8ms Document
text/html 23.37.55.184
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 02 Oct 2019 22:29:01 GMT
Content-Encoding: gzip
Content-Length: 7649
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=42928
Expires: Fri, 04 Oct 2019 02:42:59 GMT
Date: Thu, 03 Oct 2019 14:47:31 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame 19D3 75 KB
26 KB 55ms
55ms Script
text/javascript 2a00:1450:4001:81a::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.762580033679435&tk_st=1&rf=https%3A//www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/%23ftag%3DRSSbaffb68%7C&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

bf655fd1f2f66d50693282dd406bc60b585260db094c708f218b18ba2576de46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 26894
x-xss-protection: 0
server: cafe
etag: 6195879739138677770
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK bdbcdab8-5e1d-4909-a0f9-13edb0986400
beacon-eu2.rubiconproject.com/beacon/d/ Frame 19D3 43 B
268 B 15ms
15ms Image
image/webp 69.173.144.155
The Rubicon Project

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon-eu2.rubiconproject.com/beacon/d/bdbcdab8-5e1d-4909-a0f9-13edb0986400?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=15&e=6A1E40E384DA563BD0FCFAE0285DB78D6DAD3797D6E83A295D586D1D73261386A9E6A9E36A2A87A501E68A76E7CA5181172DB22D3B21A9B5D0618F1E4FEB1A362C576DC214995D9D3570ECD3831C9446AC237D6FA0EBFC9A6240B348FC26EBCFEB2496EFCC5E65F183009FDB9DE7981633F8630F2FDB6069
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.155 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: Rubicon Project /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:30 GMT
Cache-Control: private, max-age=0, no-cache
Server: Rubicon Project
Content-Type: image/webp
Content-Length: 43
Expires: 01 Jan 1970 10:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame F1BA 109 B
171 B 48ms
46ms Script
application/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame F1BA 109 B
171 B 48ms
47ms Script
application/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/ Frame F1BA 231 KB
85 KB 72ms
71ms Script
text/javascript 2a00:1450:4001:81a::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

c8615d41121675d739ad8a05627ccfd2c6b99c576521ff17a2313f79a37fa6cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 86819
x-xss-protection: 0
server: cafe
etag: 6415741152906011923
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H2 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/ Frame 668E 231 KB
85 KB 50ms
50ms Script
text/javascript 2a00:1450:4001:81a::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

c8615d41121675d739ad8a05627ccfd2c6b99c576521ff17a2313f79a37fa6cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 86819
x-xss-protection: 0
server: cafe
etag: 6415741152906011923
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame F7C0 0
0 19ms
9ms Document
text/html 23.37.55.184
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 02 Oct 2019 22:29:01 GMT
Content-Encoding: gzip
Content-Length: 7649
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=42928
Expires: Fri, 04 Oct 2019 02:42:59 GMT
Date: Thu, 03 Oct 2019 14:47:31 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 0337 109 B
171 B 17ms
15ms Script
application/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 0337 109 B
171 B 17ms
16ms Script
application/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/ Frame 0337 231 KB
85 KB 30ms
29ms Script
text/javascript 2a00:1450:4001:81a::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

c8615d41121675d739ad8a05627ccfd2c6b99c576521ff17a2313f79a37fa6cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 86819
x-xss-protection: 0
server: cafe
etag: 6415741152906011923
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H2 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/ Frame 7F36 231 KB
85 KB 29ms
29ms Script
text/javascript 2a00:1450:4001:81a::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

c8615d41121675d739ad8a05627ccfd2c6b99c576521ff17a2313f79a37fa6cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 86819
x-xss-protection: 0
server: cafe
etag: 6415741152906011923
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK analytics.js Show response
s.update.rubiconproject.com/2/873648/ Frame 0337 0
75 B 238ms
28ms Script
text/plain 18.203.131.207
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://s.update.rubiconproject.com/2/873648/analytics.js?si=59604&di=www.zdnet.com&ap=&dm=15&pi=283812&ti=1e2a4399-6a0b-43c5-97bd-a1c731ccfe74&r5=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&dt=8736481428691810142000
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 18.203.131.207 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-203-131-207.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:30 GMT
Content-Length: 0

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame 1BB1 0
0 7ms
6ms Document
text/html 23.37.55.184
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 02 Oct 2019 22:29:01 GMT
Content-Encoding: gzip
Content-Length: 7649
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=42928
Expires: Fri, 04 Oct 2019 02:42:59 GMT
Date: Thu, 03 Oct 2019 14:47:31 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame E907 109 B
171 B 18ms
15ms Script
application/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame E907 109 B
171 B 16ms
14ms Script
application/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/ Frame E907 231 KB
85 KB 37ms
35ms Script
text/javascript 2a00:1450:4001:81a::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

c8615d41121675d739ad8a05627ccfd2c6b99c576521ff17a2313f79a37fa6cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 86819
x-xss-protection: 0
server: cafe
etag: 6415741152906011923
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H2 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/ Frame 86A1 231 KB
85 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:81a::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

c8615d41121675d739ad8a05627ccfd2c6b99c576521ff17a2313f79a37fa6cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 86819
x-xss-protection: 0
server: cafe
etag: 6415741152906011923
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame BD19 0
0 7ms
6ms Document
text/html 23.37.55.184
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 02 Oct 2019 22:29:01 GMT
Content-Encoding: gzip
Content-Length: 7649
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=42928
Expires: Fri, 04 Oct 2019 02:42:59 GMT
Date: Thu, 03 Oct 2019 14:47:31 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame DBB7 29 KB
7 KB 128ms
127ms XHR
text/plain 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1188650453168333&correlator=2256485971179739&output=ldjh&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&adsid=NT&eid=21062833%2C21064102&vrg=2019092602&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20191003&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=372x142%2C372x142&prev_scp=env%3Dprod%26session%3Df%26subses%3D2%26ptype%3Darticle%26vguid%3Deaa95f35-b837-473b-90a5-6449462fcf2d%7Cenv%3Dprod%26session%3Df%26subses%3D2%26ptype%3Darticle%26vguid%3Deaa95f35-b837-473b-90a5-6449462fcf2d&cookie=ID%3Df862685a568ee6eb-22f0332f39b000ab%3AT%3D1570114050%3AS%3DALNI_MYwrSvI6GG2eldP7rbXwpTWjLg1GQ&cdm=www.zdnet.com&bc=31&abxe=1&lmt=1570114051&dt=1570114051116&dlt=1570114050684&idt=414&frm=23&biw=1585&bih=1200&isw=371&ish=771&oid=3&adxs=-12245933%2C-12245933&adys=-12245933%2C-12245933&adks=3261246841%2C3261246840&ucis=t094crazh6oo%7Cfo0eut1kbzzb&ifi=1&ifk=4218985854&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F&top=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&dssz=17&icsg=43552&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0%7C0x0&msz=0x0%7C0x0&ga_vid=531659678.1570114051&ga_sid=1570114051&ga_hid=1255747702&fws=384%2C384&ohw=0%2C0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019092602.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

06378c6af4fed039d3d4c6e53aa51d0925d9c5b2a048ab3788ed5f93c41ff07f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7221
x-xss-protection: 0
google-lineitem-id: 4746066197,4746066197
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138239375540,138239479696
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2019092602.js Show response
securepubads.g.doubleclick.net/gpt/ Frame DBB7 63 KB
24 KB 39ms
39ms Script
text/javascript 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019092602.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019092602.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

sffe /

Resource Hash

35c073a53df4dd054afab9758b90a88846802754ff15fc3b31cc9af133c8a401

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 26 Sep 2019 18:43:36 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 24721
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ Frame DBB7 0
0 17ms
17ms Other
text/html 2a00:1450:4001:81f::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html?n=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019092602.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame D8BF 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 835c5d5c553cbc118d7eea393ad44c36cafa97921317cf77292dacb1c7f88687

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 0337 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9f1b79d3e2a4d8a5c2c199991dd454f2dbba21ac76cbae03cddaefeb7caa85a6

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame F1BA 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fd6a47c60a4311aba61b1ac66c31cc158743955642d4739066358cbb0b6cf6f8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame E907 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 577ef24f902f92dbb6b5c2a62c1b6b591415e8adad0773946af0d78b08907c9f

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 19D3 109 B
171 B 29ms
29ms Script
application/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 19D3 109 B
171 B 15ms
15ms Script
application/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/ Frame 19D3 231 KB
85 KB 29ms
29ms Script
text/javascript 2a00:1450:4001:81a::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

c8615d41121675d739ad8a05627ccfd2c6b99c576521ff17a2313f79a37fa6cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 86819
x-xss-protection: 0
server: cafe
etag: 6415741152906011923
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H2 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/ Frame 46FA 231 KB
85 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:81a::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

c8615d41121675d739ad8a05627ccfd2c6b99c576521ff17a2313f79a37fa6cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 86819
x-xss-protection: 0
server: cafe
etag: 6415741152906011923
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame E91C 0
0 11ms
9ms Document
text/html 23.37.55.184
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 02 Oct 2019 22:29:01 GMT
Content-Encoding: gzip
Content-Length: 7649
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=42928
Expires: Fri, 04 Oct 2019 02:42:59 GMT
Date: Thu, 03 Oct 2019 14:47:31 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
5ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570114051232&de=139183733176&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=13&cb=0&ym=0&cu=1570114051232&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25299489%3A251370729%3A253246569%3A138271463540&zMoatPS=top&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=728&zMoatH=90&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=728x90&zMoatSZPS=728x90%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=320540754&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 29ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=5&fi=1&apd=10&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271463540&S1id=23605329&S2id=23619609&ord=1570114051232&r=139183733176&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatPS=top&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 31ms
7ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=5&fi=1&apd=10&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271463540&S1id=23605329&S2id=23619609&ord=1570114051232&r=139183733176&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatPS=top&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 29ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=5&fi=1&apd=10&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271463540&S1id=23605329&S2id=23619609&ord=1570114051232&r=139183733176&t=nht&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatPS=top&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame DB55 0
0 287ms
286ms Document
text/html 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=3677162154&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&ea=0&flash=0&wgl=1&dt=1570114050977&bpp=19&bdt=389&fdt=304&idt=305&shv=r20190926&cbv=r20190131&saldr=sa&correlator=4015125597002&frm=23&ife=5&pv=2&ga_vid=1683325362.1570114051&ga_sid=1570114051&ga_hid=1963743742&ga_fc=0&iag=3&icsg=10600&nhd=1&dssz=18&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=478&biw=1585&bih=1200&isw=728&ish=90&ifk=369059093&scr_x=0&scr_y=0&eid=20199336&oid=3&pvsid=4257512088716&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.wr0oaug1l1t1&fsb=1&dtd=319

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=3677162154&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&ea=0&flash=0&wgl=1&dt=1570114050977&bpp=19&bdt=389&fdt=304&idt=305&shv=r20190926&cbv=r20190131&saldr=sa&correlator=4015125597002&frm=23&ife=5&pv=2&ga_vid=1683325362.1570114051&ga_sid=1570114051&ga_hid=1963743742&ga_fc=0&iag=3&icsg=10600&nhd=1&dssz=18&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=478&biw=1585&bih=1200&isw=728&ish=90&ifk=369059093&scr_x=0&scr_y=0&eid=20199336&oid=3&pvsid=4257512088716&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.wr0oaug1l1t1&fsb=1&dtd=319
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnxzJR9aMw3cvcvUbhCrqELcYxH8XClZkM94T7weCwVWsFk8w4UQmXMDaRS
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 03 Oct 2019 14:47:31 GMT
server: cafe
content-length: 19190
x-xss-protection: 0
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame D8BF 77 KB
29 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

a7708a738c64bd02df7ae231ab503159ab3336fa03de1853675631309ec07ada

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1569842443931303"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29108
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 9ms
8ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=5&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1570114051305&r=79274661091&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatPS=middle&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 8ms
8ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=5&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1570114051305&r=79274661091&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatPS=middle&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame B02C 0
0 324ms
323ms Document
text/html 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=2269224025&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&ea=0&flash=0&wgl=1&dt=1570114050998&bpp=52&bdt=398&fdt=328&idt=328&shv=r20190926&cbv=r20190131&saldr=sa&correlator=4015125597002&frm=23&ife=5&pv=1&ga_vid=616540103.1570114051&ga_sid=1570114051&ga_hid=1666782239&ga_fc=0&iag=3&icsg=10600&nhd=1&dssz=18&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=1576&biw=1585&bih=1200&isw=300&ish=250&ifk=3336104388&scr_x=0&scr_y=0&eid=20199336%2C410075105&oid=3&pvsid=3948966053522083&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.sug06hioq5xm&fsb=1&dtd=334

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=2269224025&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&ea=0&flash=0&wgl=1&dt=1570114050998&bpp=52&bdt=398&fdt=328&idt=328&shv=r20190926&cbv=r20190131&saldr=sa&correlator=4015125597002&frm=23&ife=5&pv=1&ga_vid=616540103.1570114051&ga_sid=1570114051&ga_hid=1666782239&ga_fc=0&iag=3&icsg=10600&nhd=1&dssz=18&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=1576&biw=1585&bih=1200&isw=300&ish=250&ifk=3336104388&scr_x=0&scr_y=0&eid=20199336%2C410075105&oid=3&pvsid=3948966053522083&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.sug06hioq5xm&fsb=1&dtd=334
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnxzJR9aMw3cvcvUbhCrqELcYxH8XClZkM94T7weCwVWsFk8w4UQmXMDaRS
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 03 Oct 2019 14:47:31 GMT
server: cafe
content-length: 19453
x-xss-protection: 0
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame F1BA 77 KB
29 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

a7708a738c64bd02df7ae231ab503159ab3336fa03de1853675631309ec07ada

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1569842443931303"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29108
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 6ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=2&fi=1&apd=3&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271463546&S1id=23605329&S2id=23619609&ord=1570114051341&r=230134117977&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatPS=top&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 6ms
5ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=2&fi=1&apd=3&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271463546&S1id=23605329&S2id=23619609&ord=1570114051341&r=230134117977&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatPS=top&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 6ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=2&fi=1&apd=3&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271463546&S1id=23605329&S2id=23619609&ord=1570114051341&r=230134117977&t=nht&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatPS=top&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 6ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=5&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1570114051359&r=335063639721&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatPS=bottom&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 6ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=5&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1570114051359&r=335063639721&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatPS=bottom&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 0F1B 0
0 184ms
184ms Document
text/html 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=2269224027&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&ea=0&flash=0&wgl=1&dt=1570114051072&bpp=17&bdt=394&fdt=306&idt=306&shv=r20190926&cbv=r20190131&saldr=sa&correlator=4015125597002&frm=23&ife=5&pv=1&ga_vid=1942722069.1570114051&ga_sid=1570114051&ga_hid=605504939&ga_fc=0&iag=3&icsg=10600&nhd=1&dssz=18&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3861&biw=1585&bih=1200&isw=728&ish=90&ifk=2035717831&scr_x=0&scr_y=0&eid=21064611&oid=3&pvsid=1711340371638494&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.oy772ysvk2lb&fsb=1&dtd=312

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=2269224027&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&ea=0&flash=0&wgl=1&dt=1570114051072&bpp=17&bdt=394&fdt=306&idt=306&shv=r20190926&cbv=r20190131&saldr=sa&correlator=4015125597002&frm=23&ife=5&pv=1&ga_vid=1942722069.1570114051&ga_sid=1570114051&ga_hid=605504939&ga_fc=0&iag=3&icsg=10600&nhd=1&dssz=18&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3861&biw=1585&bih=1200&isw=728&ish=90&ifk=2035717831&scr_x=0&scr_y=0&eid=21064611&oid=3&pvsid=1711340371638494&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.oy772ysvk2lb&fsb=1&dtd=312
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnxzJR9aMw3cvcvUbhCrqELcYxH8XClZkM94T7weCwVWsFk8w4UQmXMDaRS
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 03 Oct 2019 14:47:31 GMT
server: cafe
content-length: 46
x-xss-protection: 0
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame E907 77 KB
29 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

a7708a738c64bd02df7ae231ab503159ab3336fa03de1853675631309ec07ada

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1569842443931303"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29108
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 0843 0
0 272ms
272ms Document
text/html 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=3677162153&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&ea=0&flash=0&wgl=1&dt=1570114051054&bpp=15&bdt=460&fdt=338&idt=338&shv=r20190926&cbv=r20190131&saldr=sa&correlator=4015125597002&frm=23&ife=5&pv=1&ga_vid=1928066393.1570114051&ga_sid=1570114051&ga_hid=990488501&ga_fc=0&iag=3&icsg=42392&nhd=1&dssz=20&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=598&biw=1585&bih=1200&isw=300&ish=250&ifk=1246925581&scr_x=0&scr_y=0&oid=3&pvsid=3786444974863214&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.q16gbeh58p6i&fsb=1&dtd=348

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=3677162153&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&ea=0&flash=0&wgl=1&dt=1570114051054&bpp=15&bdt=460&fdt=338&idt=338&shv=r20190926&cbv=r20190131&saldr=sa&correlator=4015125597002&frm=23&ife=5&pv=1&ga_vid=1928066393.1570114051&ga_sid=1570114051&ga_hid=990488501&ga_fc=0&iag=3&icsg=42392&nhd=1&dssz=20&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=598&biw=1585&bih=1200&isw=300&ish=250&ifk=1246925581&scr_x=0&scr_y=0&oid=3&pvsid=3786444974863214&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.q16gbeh58p6i&fsb=1&dtd=348
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnxzJR9aMw3cvcvUbhCrqELcYxH8XClZkM94T7weCwVWsFk8w4UQmXMDaRS
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 03 Oct 2019 14:47:31 GMT
server: cafe
content-length: 19196
x-xss-protection: 0
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0337 77 KB
29 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

a7708a738c64bd02df7ae231ab503159ab3336fa03de1853675631309ec07ada

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1569842443931303"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29108
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame 5229 0
64 B 17ms
17ms Fetch
image/gif 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstfLGZrljtoeO4BBT7l1OGTGRs4bLcjGdgR-fSHWuyWcRUPgXtFL9PxOPFb7da34OHxN0hhK73ws8tPwOweYEUsvoDRoWTCXjbIhn-s6Lbbj2sxN1bw-ObXAf9fCp-FM0JQfg2vEDh4o9yzX6JghpGtPi-qCrEmQQvmWEK_O2WePTPu2qzloZhZrIUH4M7hvO_-btFbplMlVufwqpQdj6qi2EcZGiJ_tfFeOmUmCo0cUSCDl5DDsdCCMlHync2TfAbkGkMVUh5U&sai=AMfl-YSthnML0Pt5PZYL7w1T8Vrzx0YkwlXetKRxrp2ntll0srt15XthvvOxkHbT9c2ZXoYylkBNU0SjRp2wHLrkLsPW6efE8K9lsgecEeDgDo4I9rRke7hYiMD1A2cmZvfG&sig=Cg0ArKJSzNT62hPxGziTEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:31 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5229 78 KB
29 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5f224a13a15499778526423761125cbae8b8063bf0f90a46862671e17ccc9e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1569842443931303"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29671
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 5229 305 KB
101 KB 6ms
6ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019092602.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:31 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Oct 2019 19:12:57 GMT
Server: AmazonS3
x-amz-request-id: 9073494F6B56554C
ETag: "90057ee6dd9ded5b49509cb6336f58d4"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=52651
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 103402
x-amz-id-2: JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame 305B 0
64 B 17ms
17ms Fetch
image/gif 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvWe-QYSJIs5omT31f5yEd631nEy0j0EZu6ZpXEUKMmBYe06VxPMBjFjn8LzIK3ixDy4VnP6ITpP95ztixupYKAjhrEyyj8Z2YF2rgv32L-G_ssMgzh2N-Bf6QlfbTUw5RgI-4sdfmahjD7n3wNHF_hmg3mcI5D2SIEydVNtnrxNA4zVUvzGi2JrDp2wTN3msJoaYZlqan7l0jU8YCWt_eYvDlbDb2zz2HGYfiAlUHaIYygfK7Co7yLn1sCYgfCKhWHF6urHg8N&sai=AMfl-YQfvNRaQ0QFjBl8EhunnE8Bs_kXm7YepFGxrLIP7-LRse_pDiQt0Lue0yRrIbZKvThYTTH4uHmWIlOjwlkKH8bVQPZw-E06CDlwc5CawtOo58RRpMYuxw4iPXNNmuaa&sig=Cg0ArKJSzIAm-7U4vLP8EAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:31 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 305B 78 KB
29 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5f224a13a15499778526423761125cbae8b8063bf0f90a46862671e17ccc9e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1569842443931303"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29671
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 305B 305 KB
101 KB 7ms
7ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019092602.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:31 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Oct 2019 19:12:57 GMT
Server: AmazonS3
x-amz-request-id: 9073494F6B56554C
ETag: "90057ee6dd9ded5b49509cb6336f58d4"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=52651
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 103402
x-amz-id-2: JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame DBB7 77 KB
29 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019092602.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

a7708a738c64bd02df7ae231ab503159ab3336fa03de1853675631309ec07ada

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1569842443931303"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29108
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DBB7 0
123 B 14ms
13ms Image
image/gif 2a00:1450:4001:81a::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_sz&r=372x142&w=372&h=142

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Oct 2019 14:47:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 19D3 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4f37d9296cff8e33f3f254dca36386d60a0ef9b840196b263158f714c5371665

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 13ms
12ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=5&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1570114051572&r=808856345338&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatPS=bottom&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 6ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=5&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1570114051572&r=808856345338&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatPS=bottom&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 7ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=https%3A%2F%2Fbeacon-eu2.rubiconproject.com%2Fbeacon%2Fd%2F7ed92a8d-7d25-4893-99d2-a4733a86c2bd&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1570114051232&de=139183733176&cu=1570114051232&m=40&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4276&le=1&lf=0&lg=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&as=0&ag=5&an=0&gf=5&gg=0&ix=5&ic=5&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=5&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=10&cd=0&ah=10&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A138271463540&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=728x90&zMoatPS=top&zMoatSZPS=728x90%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=728&zMoatH=90&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatSlotId=leader-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-top-5d960148a8346&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=130572214&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame D3CF 0
0 234ms
233ms Document
text/html 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=2269224024&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&ea=0&flash=0&wgl=1&dt=1570114051217&bpp=12&bdt=548&fdt=376&idt=376&shv=r20190926&cbv=r20190131&saldr=sa&correlator=4015125597002&frm=23&ife=5&pv=1&ga_vid=93375021.1570114052&ga_sid=1570114052&ga_hid=1175174461&ga_fc=0&iag=3&icsg=10600&nhd=1&dssz=18&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=2577&biw=1585&bih=1200&isw=300&ish=250&ifk=594379831&scr_x=0&scr_y=0&eid=20199336%2C21064654&oid=3&pvsid=1055331794180263&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.t4scx2mh2cu7&fsb=1&dtd=384

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=2269224024&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&ea=0&flash=0&wgl=1&dt=1570114051217&bpp=12&bdt=548&fdt=376&idt=376&shv=r20190926&cbv=r20190131&saldr=sa&correlator=4015125597002&frm=23&ife=5&pv=1&ga_vid=93375021.1570114052&ga_sid=1570114052&ga_hid=1175174461&ga_fc=0&iag=3&icsg=10600&nhd=1&dssz=18&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=2577&biw=1585&bih=1200&isw=300&ish=250&ifk=594379831&scr_x=0&scr_y=0&eid=20199336%2C21064654&oid=3&pvsid=1055331794180263&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.t4scx2mh2cu7&fsb=1&dtd=384
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnxzJR9aMw3cvcvUbhCrqELcYxH8XClZkM94T7weCwVWsFk8w4UQmXMDaRS
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 03 Oct 2019 14:47:31 GMT
server: cafe
content-length: 4201
x-xss-protection: 0
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 19D3 77 KB
29 KB 43ms
40ms Script
text/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

a7708a738c64bd02df7ae231ab503159ab3336fa03de1853675631309ec07ada

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1569842443931303"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29108
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 12ms
10ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=352&fi=1&apd=357&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271463540&S1id=23605329&S2id=23619609&ord=1570114051232&r=139183733176&t=hdn&os=1&fi2=0&div1=0&ait=174&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatPS=top&zMoatPT=article&bedc=1&q=4&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H2 200 ping
ping.chartbeat.net/ 43 B
168 B 94ms
93ms Image
image/gif 107.23.115.104
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F&u=DSrogqCWXKnexY2L3&d=zdnet.com&g=65713&g0=security&g1=danny%20palmer&n=1&f=00001&c=0.04&x=0&m=0&y=4276&o=1585&w=1200&j=30&R=1&W=0&I=0&E=2&e=2&r=&b=1056&t=DPlZj-CSh1urDJEzIbBcT0cxCDy1Vl&V=116&tz=-120&_acct=anon&_vi=Turn%20your%20Android%20smartphone%20into%20a%20bunker%20with%2010%20simple%20steps&_vp=/video/manifest/the-10-best-ways-to-secure-your-android-phone.m3u8&_vdd=video%40zdnet.com&_vs=s1&_vt=ct&_vtn=null&_vd=71000&sn=2&sv=D1L-AIDcpicsDEmeIYCihflaCtMhsC&sd=1&im=067b2ff3&_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.23.115.104 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-107-23-115-104.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Thu, 03 Oct 2019 14:47:31 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
expires: 0

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 8ms
7ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=321&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1570114051305&r=79274661091&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatPS=middle&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 8ms
7ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=316&fi=1&apd=317&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271463546&S1id=23605329&S2id=23619609&ord=1570114051341&r=230134117977&t=hdn&os=1&fi2=0&div1=0&ait=157&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatPS=top&zMoatPT=article&bedc=1&q=4&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 9ms
9ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=304&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1570114051359&r=335063639721&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatPS=bottom&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570114051305&de=79274661091&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=17&cb=0&ym=0&cu=1570114051305&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25299489%3A251370729%3A241984809%3A75375443409&zMoatPS=middle&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=300&zMoatH=250&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=middle&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20middle&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=114354836&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:31 GMT

POST
H/1.1 200
OK / Show response
inqlnfvog763mmf771rou737u.litix.io/ 43 B
349 B 96ms
95ms XHR
image/gif 34.224.154.10
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://inqlnfvog763mmf771rou737u.litix.io/
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/mux.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.224.154.10 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-224-154-10.compute-1.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Access-Control-Allow-Methods: POST, GET
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-cache,no-store,must-revalidate
Connection: keep-alive
Content-Length: 43
Expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ 0
56 B 45ms
45ms Other
image/gif 2a00:1450:4013:c03::5e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~k1atd6sy&c=4015125597002&slotId=2007562798501&eee=missing-element&bi=missing-id
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/instream/html5/ima3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4013:c03::5e Groningen, Netherlands, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 03 Oct 2019 14:47:31 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
status: 204
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 204
No Content / Show response
686eb51a.akstat.io/ 0
354 B 69ms
54ms XHR
image/gif 104.111.214.229
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://686eb51a.akstat.io/?h.pg=article&when=1570114051767&cdim.Site_View=desktop&t_other=custom3%7C1343&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=f63a1aef9475726dff3ca2aa242aa877d89924ec&h.t=1570114050278&http.initiator=api&rt.start=api&rt.si=a4991800-e3ef-4faa-abe0-eb9fbc4b2b43&rt.ss=1570114051290&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1

Requested by

Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.214.229 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-214-229.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 6ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=316&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1570114051572&r=808856345338&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatPS=bottom&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:31 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:31 GMT

GET
H/1.1 404
Not Found OAS_Countdown_EG_5_700.webm
cbsadsales-a.akamaihd.net/Q1/ 16 B
0 216ms
24ms Media
text/html 2.16.186.88
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cbsadsales-a.akamaihd.net/Q1/OAS_Countdown_EG_5_700.webm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.88 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-88.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range: bytes=0-

Response headers

Date: Thu, 03 Oct 2019 14:47:32 GMT
Server: Apache
Connection: keep-alive
Content-Length: 16
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 7ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=https%3A%2F%2Fbeacon-eu2.rubiconproject.com%2Fbeacon%2Fd%2F521def61-1a69-4359-a1e5-fafb175fd28e&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1570114051305&de=79274661091&cu=1570114051305&m=13&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4276&le=1&lf=0&lg=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A-%3A-&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=0&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5&cd=0&ah=5&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=25299489%3A251370729%3A241984809%3A75375443409&bo=23605329&bp=23619609&bd=middle&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=300x250&zMoatPS=middle&zMoatSZPS=300x250%20%7C%20middle&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatSlotId=mpu-middle&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-middle-5d960148a8346&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-middle&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=28457372&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
5ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570114051341&de=230134117977&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=21&cb=0&ym=0&cu=1570114051341&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25299489%3A251370729%3A253246569%3A138271463546&zMoatPS=top&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=300&zMoatH=250&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1568899634&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
5ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=https%3A%2F%2Fbeacon-eu2.rubiconproject.com%2Fbeacon%2Fd%2F1e2a4399-6a0b-43c5-97bd-a1c731ccfe74&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1570114051341&de=230134117977&cu=1570114051341&m=13&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4276&le=1&lf=0&lg=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&as=0&ag=2&an=0&gf=2&gg=0&ix=2&ic=2&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=2&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=3&cd=0&ah=3&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A138271463546&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=300x250&zMoatPS=top&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatSlotId=mpu-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-plus-top-5d960148a8346&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1912995051&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
5ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570114051359&de=335063639721&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=25&cb=0&ym=0&cu=1570114051359&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25299489%3A251370729%3A253246569%3A75374362809&zMoatPS=bottom&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=728&zMoatH=90&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=728x90&zMoatSZPS=728x90%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=54234233&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H2 200 the-10-best-ways-to-secure-your-android-phone.m3u8 Show response
www.zdnet.com/video/manifest/ 3 KB
1 KB 174ms
173ms XHR
application/x-mpegurl 2.18.233.143
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/video/manifest/the-10-best-ways-to-secure-your-android-phone.m3u8?device=ott&change-to-host=techrepublicmedia.akamaized.net&secure=true

Requested by

Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a2-18-233-143.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

f831384a4eb77209b6aaa10c474bd5566952144113832922148e329cf5e2be70

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 383
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 03 Oct 2019 14:09:58 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Thu, 03 Oct 2019 14:47:32 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: e0632d60-3f63-4a9b-9650-4940ccb08b15
content-type: application/x-mpegURL
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=5400, private
accept-ranges: bytes
expires: Thu, 03 Oct 2019 15:39:58 GMT

GET
H/1.1 200
OK 10d31225525ff5790a490d4d-adobeorg.xml Show response
cbsinteractive.hb.omtrdc.net/settings/ 228 B
624 B 290ms
97ms XHR
application/xml 52.5.99.108
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cbsinteractive.hb.omtrdc.net/settings/10d31225525ff5790a490d4d-adobeorg.xml?r=1570114052229
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.5.99.108 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-5-99-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 0e4e46fa1aa04c24e793912d7aabaa2f2b0f7dc03d73cf74fbe12cb84f062554

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:37 GMT
Last-Modified: Mon, 30 Sep 2019 22:25:32 GMT
Server: nginx
ETag: "5d9280dc-e4"
Access-Control-Allow-Methods: OPTIONS,GET
Content-Type: application/xml
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Location
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Content-Type
Content-Length: 228

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 30 KB
8 KB 135ms
134ms XHR
text/plain 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=100901377703250&correlator=2046291051191560&output=ldjh&callback=googletag.impl.pubads.callbackProxy2&impl=fifs&adsid=NT&eid=21064579%2C21062833%2C21064370%2C21064581&vrg=2019092602&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20191003&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=320x50%7C11x11%2C641x321&fluid=height%2C0&prev_scp=pos%3Dtop%26strnativekey%3D8ec3a4f3%7Cpos%3Dtop&eri=1&cust_params=buyingcycle%3Ddiscover%26topic%3Dsecurity%252Candroid%26tag%3Dmalware%252Ccyber-security%26prodtype%3Dandroid%26mfr%3Dgoogle%252Cmicrosoft%26pid%3Dskype%26collection%3Da-winning-strategy-for-cybersecurity%26device%3Ddesktop%26ptype%3Darticle%26cid%3Da-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%26env%3Dprod%26firstpg%3D1%26vguid%3Deaa95f35-b837-473b-90a5-6449462fcf2d%26session%3Df%26subses%3D2%26ftag%3DRSSbaffb68%257C&cookie=ID%3Db866e66ec582a3e8-22bba9c512a500d5%3AT%3D1570114050%3AS%3DALNI_MaU2ruIi998ApyT96M0-tNnhaJGlQ&cookie_enabled=1&bc=31&abxe=1&lmt=1570111817&dt=1570114052251&dlt=1570114048471&idt=497&frm=20&biw=1585&bih=1200&oid=3&adxs=208%2C-12245933&adys=2058%2C-12245933&adks=2474256018%2C2919082154&ucis=h%7Ci&ifi=10&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&dssz=99&icsg=0&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=770x11%7C770x2888&msz=770x11%7C641x361&psts=Ci4ItqWH1xFCA9GcH3gB6AGp_dT9ggSCAgyZ0q4H0eCgC5nQoQvRAssWaNRrclqs%2CCiYI6fjgeOgB9LD8jIMEggIMmdKuB9HgoAuZ0KEL0QJxKKwMvbGsgw%2CCiYI6fjgeOgB-rD8jIMEggIMmdKuB9HgoAuZ0KEL0QLN_1M1A4yNjg%2CCiYIqcqxc-gB0fvn5ZgCggIMmdKuB9HgoAuZ0KEL0QILTyNsBvgz2g%2CCiYI6fjgeOgB0fvn5ZgCggIMmdKuB9HgoAuZ0KEL0QJqAY6Z7jx9Rw%2CCiYI6fjgeOgBuYGm5ZgCggIMmdKuB9HgoAuZ0KEL0QLNVVtqE72dlA%2CCicIhNOZ_RHoAbnfqIGDBIICDJnSrgfR4KALmdChC9ECQomW8ikf3NY&ga_vid=718268121.1570114050&ga_sid=1570114050&ga_hid=962638165&fws=4%2C132&ohw=1585%2C1585

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_2019092602.js?21064579

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

41e2e99eafec37716ecb18633a26d71af745835ad862829e03a9c9d93fbfe518

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:32 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7551
x-xss-protection: 0
google-lineitem-id: 4745189935,4745327422
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138239344481,138239368367
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 / Show response
www.zdnet.com/m3d0s1/xhr/right-rail/ 11 KB
3 KB 374ms
374ms XHR
application/json 2.18.233.143
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/m3d0s1/xhr/right-rail/

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a2-18-233-143.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

22e9fd274625cd03626f2779689569cddfcbf85aaf30740fb00c0dce25705193

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: cors
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 1668
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: no-referrer-when-downgrade
server: nginx
x-frame-options: SAMEORIGIN
date: Thu, 03 Oct 2019 14:47:32 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: 4e111a98-4a4d-4820-949d-238d8ad9b951
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H2 200 s04050042237480
saa.cbsi.com/b/ss/cnetzdnetglobalsite/1/JS-2.3.0/ 43 B
223 B 30ms
30ms Image
image/gif 108.128.130.224
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://saa.cbsi.com/b/ss/cnetzdnetglobalsite/1/JS-2.3.0/s04050042237480?AQB=1&ndh=1&pf=1&t=3%2F9%2F2019%2016%3A47%3A32%204%20-120&mid=53510638259362554562209093715854961023&aid=2ECB050105158000-401AA844C0D0EA62&aamlh=6&ce=UTF-8&g=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&c.&siteSection=editorial&siteType=responsive%20web&articleId=1b0217ac-3a72-470b-9289-742af80ceb70&articleType=content_article&articleTitle=this%20huge%20android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made%20basic%20security%20mistakes&pageType=article&pageViewGuid=eaa95f35-b837-473b-90a5-6449462fcf2d&userState=not%20authenticated&userType=anon&deviceType=desktop&siteRsids=cnetzdnetglobalsite&siteCode=zdnet&pageUrl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&sitePrimaryRsid=cnetzdnetglobalsite&userStatus=not%20authenticated&siteHier=zdnet%3Asecurity&topicPrimaryId=113c25b6-ec91-11e3-95d2-02911863765e&videoAuthor=zdnet%20editors&Network=zdnet&tl=Turn%20your%20Android%20smartphone%20into%20a%20bunker%20with%2010%20simple%20steps&mediaAutoPlay=true&mediaMuted=true&mediaIsPaidContent=false&a.&contentType=vod&media.&name=b17cc96b-012d-463d-a47c-a7201e8a7645&friendlyName=Turn%20your%20Android%20smartphone%20into%20a%20bunker%20with%2010%20simple%20steps&length=71&playerName=UVPJS_0.42.297&view=true&vsid=1570114052232228166898&.media&.a&.c&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&pe=ms_s&pev3=video&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.128.130.224 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-108-128-130-224.eu-west-1.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:32 GMT
x-content-type-options: nosniff
x-c: master-1021.Ic37195.M0-288
p3p: CP="This is not a P3P policy"
status: 200
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 04 Oct 2019 14:47:32 GMT
server: jag
xserver: anedge-5d695d76d8-rttbw
etag: 2ECB050205158000-400C68EB20D58453
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 02 Oct 2019 14:47:32 GMT

GET
H2 200 loader.js Show response
cdn.taboola.com/libtrc/cbsinteractive-zdnet/ 84 KB
19 KB 21ms
6ms Script
application/javascript 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 43095cdd48698241d8b986d242496f785256fea03bdac2b1fa1e00321d536a9f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: vERHKGIhMT.xCcTqt3uO5VmbPj3.3CUY
content-encoding: gzip
etag: "88c110f7dcf348814f4cce2a22eea12b"
age: 62
x-cache: HIT
status: 200
content-length: 18761
x-amz-id-2: JVfqImwvaOizs0ByjqHS05majqZkvJtF28ql/DO+cNxFkqSwVFRsHy3kqTwvzYEL13NjmVGdE38=
x-served-by: cache-hhn4066-HHN
last-modified: Wed, 02 Oct 2019 12:32:58 GMT
server: AmazonS3
x-timer: S1570114052.324636,VS0,VE1
date: Thu, 03 Oct 2019 14:47:32 GMT
vary: Accept-Encoding
x-amz-request-id: A6C01FD231B30B96
via: 1.1 varnish
cache-control: private,max-age=14401
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 55
x-cache-hits: 1

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
5ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=https%3A%2F%2Fbeacon-eu2.rubiconproject.com%2Fbeacon%2Fd%2F94808f42-6c1e-493a-8343-9445bee6b5bc&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1570114051359&de=335063639721&cu=1570114051359&m=12&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4276&le=1&lf=0&lg=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A-%3A-&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=0&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5&cd=0&ah=5&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A75374362809&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=728x90&zMoatPS=bottom&zMoatSZPS=728x90%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=728&zMoatH=90&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatSlotId=leader-plus-bottom&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-bottom-5d960148a8346&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-bottom&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1124171967&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
5ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570114051572&de=808856345338&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=29&cb=0&ym=0&cu=1570114051572&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25299489%3A251370729%3A253246569%3A75375443409&zMoatPS=bottom&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=300&zMoatH=250&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1384045171&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 7ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=https%3A%2F%2Fbeacon-eu2.rubiconproject.com%2Fbeacon%2Fd%2Fbdbcdab8-5e1d-4909-a0f9-13edb0986400&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1570114051572&de=808856345338&cu=1570114051572&m=14&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4276&le=1&lf=0&lg=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A-%3A-&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=0&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5&cd=0&ah=5&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A75375443409&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=300x250&zMoatPS=bottom&zMoatSZPS=300x250%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatSlotId=mpu-bottom&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-bottom-5d960148a8346&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-bottom&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1809902367&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H/1.1 200
OK beacon.js Show response
sb.scorecardresearch.com/ 1 KB
1 KB 15ms
15ms Script
application/x-javascript 2.16.31.65
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.16.31.65 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-16-31-65.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: d0fd74148f4cbe78bd0e6328dc5ce5955f0a0ecdb1eb2919da4a7e596ac65912

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:32 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=86400
Connection: keep-alive
Content-Length: 901
Expires: Fri, 04 Oct 2019 14:47:32 GMT

GET
H2 200 load.js Show response
widget.perfectmarket.com/cbsinteractive-zdnet/ 13 KB
5 KB 28ms
6ms Script
binary/octet-stream 151.101.113.181
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: rwr9L97XovW8QPypI62jHvd7E2HiNZm2
content-encoding: gzip
etag: "fc0de48a0976cde02ddee0bd49a81832"
age: 79
x-cache: HIT, HIT
status: 200
content-length: 4742
x-amz-id-2: Bz2c9kwNodx0L6M8xAJpExrz7GFvRlfRtLOPWcHSIojvVdRDzBqnQn8nRTx6YzRGVaK4v96+5vg=
x-served-by: cache-lax8629-LAX, cache-hhn4061-HHN
last-modified: Thu, 20 Oct 2016 17:48:07 GMT
server: AmazonS3
x-timer: S1570114052.365740,VS0,VE1
date: Thu, 03 Oct 2019 14:47:32 GMT
vary: Accept-Encoding,,
x-amz-request-id: 1BFE0E96C42427AE
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=300
accept-ranges: bytes
content-type: binary/octet-stream
x-cache-hits: 1, 1

GET
H2 200 impl.20191002-10-RELEASE.js Show response
cdn.taboola.com/libtrc/ 394 KB
112 KB 6ms
6ms Script
application/javascript 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/impl.20191002-10-RELEASE.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0cae80c9382e2b3e8045ba09797fd66d1a65a936d70af2eed09897be81ea436e

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: MWFHdpWI_mQOMXUM8TI1gLlg0gl1K5pN
content-encoding: gzip
etag: "c863c8ea08069847bb5c761bac45dda6"
age: 35
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 113914
x-amz-id-2: KZQ331HLPwKAM5p4SgPTw91EVwLUW1F6iCeqHyNr6GY8BJhdcyit1/M+5leJD7g4m2xQYShBEKA=
x-served-by: cache-hhn4066-HHN
last-modified: Wed, 02 Oct 2019 22:32:20 GMT
server: AmazonS3
x-timer: S1570114052.344438,VS0,VE0
date: Thu, 03 Oct 2019 14:47:32 GMT
vary: Accept-Encoding
x-amz-request-id: EC5559FF9EDC3E26
via: 1.1 varnish
cache-control: private,max-age=31536000
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 67
x-cache-hits: 242

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
5ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570114051853&de=856548105435&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=33&cb=0&ym=0&cu=1570114051853&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4746066197%3A138239375540&zMoatPT=article&zMoatW=372&zMoatH=142&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=-&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=372x142&zMoatPS=Not%20Specified&zMoatSZPS=Not%20Specified&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1727150727&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570114051876&de=839406947222&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=37&cb=0&ym=0&cu=1570114051876&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4746066197%3A138239479696&zMoatPT=article&zMoatW=372&zMoatH=142&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=-&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=372x142&zMoatPS=Not%20Specified&zMoatSZPS=Not%20Specified&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=2083527674&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H/1.1 204
No Content b
sb.scorecardresearch.com/ 0
248 B 9ms
7ms Image
text/plain 2.16.31.65
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1570114052356&ns_c=UTF-8&cv=3.1&c8=This%20huge%20Android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made%20basic%20security%20mistakes%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&c9=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.16.31.65 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-16-31-65.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1570114051232&de=139183733176&cu=1570114051232&m=1162&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4276&le=1&lf=0&lg=1&lh=174&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1137&an=5&gi=1&gf=1137&gg=5&ix=1137&ic=1137&ez=1&ck=1137&kw=928&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1137&bx=5&ci=1137&jz=928&dj=1&aa=0&ad=959&cn=0&gk=959&gl=0&ik=959&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=928&cd=10&ah=928&am=10&rf=0&re=1&ft=959&fv=0&fw=959&wb=1&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A138271463540&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=728x90&zMoatPS=top&zMoatSZPS=728x90%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=728&zMoatH=90&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatSlotId=leader-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-top-5d960148a8346&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1407082345&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 6ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=928&tet=1137&fi=1&apd=1142&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271463540&S1id=23605329&S2id=23619609&ord=1570114051232&r=139183733176&t=iv&os=1&fi2=0&div1=1&ait=959&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatPS=top&zMoatPT=article&bedc=1&q=5&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H/1.1 200
OK pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 43 B
409 B 6ms
5ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=839&tet=1066&fi=1&apd=1067&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271463546&S1id=23605329&S2id=23619609&ord=1570114051341&r=230134117977&t=iv&os=1&fi2=0&div1=1&ait=907&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatPS=top&zMoatPT=article&bedc=1&q=5&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H2 200 pmk-201618008.1.js Show response
widget.perfectmarket.com/cbsinteractive-zdnet/ 323 KB
89 KB 7ms
7ms Script
text/javascript 151.101.113.181
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Requested by: Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: bVoOWfmxkMrYwv2s6Uu9D96fE._5IBqu
content-encoding: gzip
etag: "da73fb2066df9f51d08b6688cfb35441"
age: 29818468
x-cache: HIT, HIT
status: 200
content-length: 91236
x-amz-id-2: T2A7wWXMDNgx2Z35EWhae8i8jDSVEo/Aqmbmta3HbEBKVMhwoZJKjGQuEf/CaAEiaINfKwR6uJs=
x-served-by: cache-lax8632-LAX, cache-hhn4061-HHN
last-modified: Thu, 20 Oct 2016 17:47:53 GMT
server: AmazonS3
x-timer: S1570114052.423522,VS0,VE0
date: Thu, 03 Oct 2019 14:47:32 GMT
vary: Accept-Encoding,,
x-amz-request-id: 58FF20717A687DE4
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000
accept-ranges: bytes
content-type: text/javascript
x-cache-hits: 1694, 3

GET
H2 200 2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_800.m3u8 Show response
techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_800/ 1 KB
465 B 80ms
48ms XHR
application/x-mpegurl 2.16.186.72
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_800/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_800.m3u8
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-72.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: fe1a137b7f1482e8ee5bcfd4774abb7d34398f060b90d647d7e95c3be995330a

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:32 GMT
content-encoding: gzip
last-modified: Fri, 02 Mar 2018 17:07:44 GMT
server: AkamaiNetStorage
status: 200
etag: "18217ea96eb959d5e2303506f37d157f:1520010466"
vary: Accept-Encoding
content-type: application/x-mpegURL
access-control-allow-origin: https://www.zdnet.com
akamai-mon-iucid-del: 525165
accept-ranges: bytes
content-length: 241

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame 4F6F 0
66 B 18ms
17ms Fetch
image/gif 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuJ8THpBm7XlMl-f9lidMnOjEE5-G-EMgbV02f_iCb-3NJ7uaoGLnRD5C0ZXD_mBSAO12VriX_IJHm7DcuskbvFCAk2q32-bL5mqV6Xe4LLbYoyLJ9IdgP5V_pgwCTOpaTNlaBHzaVP1T4pqFLOK3cq4gpXX2QJTC87z7Kt0thhn2pfj-VjQ6ZZ6bXZP1gd4fwVju-S9o_cOAzl9T9OMvQhrYJ3F3t3G0-ogotr66ZX4g0cfJp7jwhM9lLpMqEr5Wiw3DxsIx9M&sai=AMfl-YRKOYxoyEmpzRQW167DdaWZ60rjQQbVrfQTMnLaysEl9Ovsr5lEiCGfGsdETeRtJs1eoe3jFQ5v9VZxEApB94IjwrtHdf5qysgFltGqn4ga4fOonhDjGC_Dd_abrgFr&sig=Cg0ArKJSzHJqNikXdMW8EAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:32 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4F6F 78 KB
29 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5f224a13a15499778526423761125cbae8b8063bf0f90a46862671e17ccc9e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1569842443931303"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29671
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 4F6F 305 KB
101 KB 8ms
7ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_rendering_2019092602.js?21064579
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:32 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Oct 2019 19:12:57 GMT
Server: AmazonS3
x-amz-request-id: 9073494F6B56554C
ETag: "90057ee6dd9ded5b49509cb6336f58d4"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=52650
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 103402
x-amz-id-2: JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame B085 0
66 B 19ms
15ms Fetch
image/gif 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv5oKje55AfMPbUdbxmlr-2KAYs8mplCG14_6bePxMNO6xOuG6ZpqsT9A2DWtZt1w7PmbFtVO_6u21ZMBLBAPquGCjF9MLzQXfcpk1rkIc4X2Q6MZoh2BehrdNeK2T6J7yC1Cnhgvr_yLivIQnEY6CjmWQ58JmrGmUaRf8qBEYoTx2b_3PI0V418mbahJU-UfKEkG-h7NMqG9eZoTAVQ0uNZ6dwzakVJHiRk2ArwL2NrrHGBN1zALwgpKgINoARyYTzA9d-RSu-&sai=AMfl-YSZF3SFk6k78LDYYDMyiXZccn9NVNhh2PV-iKXdJ3wzzI7RwzYJmLRZuqr3NPxE76Hd3KNojrOSeidkDj3G9MTBJA1UWqJD3JTwMLlWFJQDAUX9GcjOpwXHTUeu_uK1&sig=Cg0ArKJSzJdH-GG9rAvpEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Oct 2019 14:47:32 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame B085 78 KB
29 KB 46ms
44ms Script
text/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5f224a13a15499778526423761125cbae8b8063bf0f90a46862671e17ccc9e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1569842443931303"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29671
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame B085 305 KB
101 KB 17ms
16ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_rendering_2019092602.js?21064579
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:32 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Oct 2019 19:12:57 GMT
Server: AmazonS3
x-amz-request-id: 9073494F6B56554C
ETag: "90057ee6dd9ded5b49509cb6336f58d4"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=52650
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 103402
x-amz-id-2: JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1570114051232&de=139183733176&cu=1570114051232&m=1164&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4276&le=1&lf=0&lg=1&lh=174&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1137&an=1137&gi=1&gf=1137&gg=1137&ix=1137&ic=1137&ez=1&ck=1137&kw=928&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1137&bx=1137&ci=1137&jz=928&dj=1&aa=0&ad=959&cn=959&gk=959&gl=959&ik=959&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=928&cd=928&ah=928&am=928&rf=0&re=1&ft=959&fv=959&fw=959&wb=1&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A138271463540&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=728x90&zMoatPS=top&zMoatSZPS=728x90%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=728&zMoatH=90&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatSlotId=leader-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-top-5d960148a8346&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1277711923&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame D8BF 42 B
110 B 20ms
18ms Image
image/gif 2a00:1450:4001:81a::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstr4j8paOslkxvvFmvbTOIcMF0beZqDq_Fd8y-UufI-SEuBzky32Hfxz2E047P9nIzWDsGJuGJe4Q7tRLlc0eQdopmp_LNvlvSsoYtL9eA&sig=Cg0ArKJSzAnZNHniJ1I6EAE&adk=3169268714&tt=1698&bs=1585%2C1200&mtos=1038,1038,1038,1038,1038&tos=1038,0,0,0,0&p=478,429,568,1157&iza=1&mcvt=1038&rs=3&ht=0&tfs=684&tls=1722&mc=1&lte=1&bas=0&bac=0&met=no&avms=nio&niot_obs=23&niot_cbk=101&md=2&lm=2&rst=1570114050592&rpt=622&isd=0&msd=0&oseid=3&xdi=0&uup=1&ps=1585%2C4265&ss=1600%2C1200&pt=27&bin=1&deb=1-7-9-20-11-28-155-9-0-0-0&tvt=1707&r=v&id=osdim&vs=4&za&uc=8&upc=1&tgt=DIV&cl=1&cec=1&clc=1&cac=1&cd=0x0&itpl=19&v=20190930

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Oct 2019 14:47:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 0337 42 B
115 B 16ms
15ms Image
image/gif 2a00:1450:4001:81a::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstHdA_sKpWBMbwJkjq6PViyJbMjnP3oSzGJn_elA_mpei5iYg97oCEtxLnRWgjThuy2wl_WCNOpkrSEZmIoJO73L0YwQXd6hVLAOVrZy9g&sig=Cg0ArKJSzHiCMndgrbWFEAE&adk=3675382948&tt=1698&bs=1585%2C1200&mtos=1038,1038,1038,1038,1038&tos=1038,0,0,0,0&p=598,1043,848,1343&iza=1&mcvt=1038&rs=3&ht=0&tfs=684&tls=1722&mc=1&lte=1&bas=0&bac=0&met=no&avms=nio&niot_obs=23&niot_cbk=101&md=2&lm=2&rst=1570114050597&rpt=723&isd=0&msd=0&oseid=3&xdi=0&uup=1&ps=1585%2C4265&ss=1600%2C1200&pt=27&bin=1&deb=1-7-9-20-11-28-155-9-0-0-0&tvt=1707&r=v&id=osdim&vs=4&za&uc=8&upc=1&tgt=DIV&cl=1&cec=1&clc=1&cac=1&cd=0x0&itpl=19&v=20190930

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Oct 2019 14:47:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80b::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 2246
date: Thu, 03 Oct 2019 14:10:06 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17803
expires: Thu, 03 Oct 2019 16:10:06 GMT

GET
H/1.1 200
OK beacon.js Show response
sb.scorecardresearch.com/ 1 KB
1 KB 11ms
11ms Script
application/x-javascript 2.16.31.65
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.16.31.65 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-16-31-65.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: d0fd74148f4cbe78bd0e6328dc5ce5955f0a0ecdb1eb2919da4a7e596ac65912

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 03 Oct 2019 14:47:32 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=86400
Connection: keep-alive
Content-Length: 901
Expires: Fri, 04 Oct 2019 14:47:32 GMT

GET
H2 404 tboptevent.html
widget.perfectmarket.com/opt/ Frame 6B7B 0
0 6ms
5ms Document
text/plain 151.101.113.181
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
Requested by: Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: Varnish /
Resource Hash

Request headers

:method: GET
:authority: widget.perfectmarket.com
:scheme: https
:path: /opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Response headers

status: 404
server: Varnish
retry-after: 0
accept-ranges: bytes
date: Thu, 03 Oct 2019 14:47:32 GMT
via: 1.1 varnish
x-served-by: cache-hhn4061-HHN
x-cache: MISS
x-cache-hits: 0
x-timer: S1570114053.540709,VS0,VE0
content-length: 0

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
5ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1570114051232&de=139183733176&cu=1570114051232&m=1165&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4276&le=1&lf=0&lg=1&lh=174&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1137&an=1137&gi=1&gf=1137&gg=1137&ix=1137&ic=1137&ez=1&ck=1137&kw=928&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1137&bx=1137&ci=1137&jz=928&dj=1&aa=0&ad=959&cn=959&gk=959&gl=959&ik=959&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=928&cd=928&ah=928&am=928&rf=0&re=1&ft=959&fv=959&fw=959&wb=1&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A138271463540&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=728x90&zMoatPS=top&zMoatSZPS=728x90%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=728&zMoatH=90&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatSlotId=leader-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-top-5d960148a8346&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=715446541&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H2 200 2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_800_0.ts Show response
techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_800/ 665 KB
666 KB 79ms
79ms XHR
video/mp2t 2.16.186.72
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_800/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_800_0.ts
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-72.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 3eb8469a360e8872f26eac9dfc6c82a92bc36db2b0a9d6acdfde44efc4d10c01

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:32 GMT
last-modified: Fri, 02 Mar 2018 17:07:44 GMT
server: AkamaiNetStorage
etag: "3cc0866c2362bb50a8a076e8a31744a2:1520010467"
status: 200
content-type: video/MP2T
access-control-allow-origin: https://www.zdnet.com
akamai-mon-iucid-del: 525165
accept-ranges: bytes
content-length: 680748

GET
BLOB 200
OK 32928084-c48a-4409-91f2-7361a135bc87
https://www.zdnet.com/ 65 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.zdnet.com/32928084-c48a-4409-91f2-7361a135bc87
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1722a27cadd97e2f3f990df7a2dc01965a8eb41fdad860be096ad984dfecec7e

Request headers

Sec-Fetch-Mode: same-origin
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length: 66527
Content-Type: text/javascript

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
101 B 14ms
13ms Image
image/gif 2a00:1450:4001:80b::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j79&aip=1&a=962638165&t=pageview&_s=1&dl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&ul=en-us&de=UTF-8&dt=This%20huge%20Android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made%20basic%20security%20mistakes%20%7C%20ZDNet&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YAhAAEAB~&jid=2065632867&gjid=113955094&cid=718268121.1570114050&tid=UA-33613588-22&_gid=2061954277.1570114053&_r=1&cd2=other&z=580227295

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Oct 2019 14:47:32 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vglnk.js Show response
cdn.viglink.com/api/ 78 KB
27 KB 26ms
26ms Script
text/javascript 2606:4700::6810:a20d
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.viglink.com/api/vglnk.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a20d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:32 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1452721
cf-ray: 51ffb63dcc87cbb4-VIE
status: 200
content-length: 27719
x-amz-id-2: HNEV4caKoOdziBrXGZIDp4CzG6boiBMb4TLu65nU6otYm4+p2OQwr1vWix1CX0FBodMy916W6w4=
last-modified: Mon, 16 Sep 2019 19:15:01 GMT
server: cloudflare
etag: "1545d811432c0074356408ee8f6c1e23"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: FB54A2C70C0BB866
cache-control: public, max-age=1800
accept-ranges: bytes
content-type: text/javascript
expires: Thu, 03 Oct 2019 15:17:32 GMT

GET
H2 200 0.4290822007143673
saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/ 43 B
137 B 30ms
29ms Image
image/gif 108.128.130.224
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/0.4290822007143673?AQB=1&ce=UTF%2D8&events=event66&v0=ftag_cd:LGN22ef1e6&v2=en&v3=desktop&v4=right-rail&v5=zdnet&v10=article&v20=this+huge+android+trojan+malware+campaign+was+discovered+after+the+gang+behind+it+made+basic+security+mistakes&v22=content_article&v23=&v24=eaa95f35-b837-473b-90a5-6449462fcf2d&v30=1b0217ac-3a72-470b-9289-742af80ceb70&v60=33161585,177482,4275939&v64=2150&v69=&c0=D%3Dv0&c2=D%3Dv2&c3=D%3Dv3&c4=D%3Dv4&c5=D%3Dv5&c10=D%3Dv10&c20=D%3Dv20&c22=D%3Dv22&c23=D%3Dv23&c24=D%3Dv24&c30=D%3Dv30&c60=D%3Dv60&c64=D%3Dv64&c69=D%3Dv69&pe=lnk_o&pev2=medusa_impression&vid=20191032-leadgen-zdnet&mid=90240133173074011141898988208131324462&aid=2D535D450507F28B-40000106A0001145&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.128.130.224 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-108-128-130-224.eu-west-1.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:32 GMT
x-content-type-options: nosniff
x-c: master-1021.Ic37195.M0-288
p3p: CP="This is not a P3P policy"
status: 200
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 04 Oct 2019 14:47:32 GMT
server: jag
xserver: anedge-5d695d76d8-xsm8z
etag: 2ECB05027FFF8000-40169FF0E0CFF3B3
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 02 Oct 2019 14:47:32 GMT

GET
H/1.1 200
OK e.gif
dw.cbsi.com/levt/ria/ 43 B
369 B 150ms
149ms Image
image/gif 64.30.230.22
CBS Interactive Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dw.cbsi.com/levt/ria/e.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=1b0217ac-3a72-470b-9289-742af80ceb70&assettitle=this%20huge%20android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made%20basic%20security%20mistakes&assettype=content_article&pubdate=2019-10-03%2011%3A07%3A27&viewguid=eaa95f35-b837-473b-90a5-6449462fcf2d&devicetype=desktop&sitetype=responsive%20web&author=danny%20palmer&authorid=1aa87593-0f1d-4577-862b-a59b5ec9bc57&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&s8=cnetzdnetglobalsite&v23=cnetzdnetglobalsite&v19=article&v17=113c25b6-ec91-11e3-95d2-02911863765e&v20=1b0217ac-3a72-470b-9289-742af80ceb70&v16=eaa95f35-b837-473b-90a5-6449462fcf2d&riaevent=impression&comptyp=spot&mapp=medusa_app&objtyp=medusa&eventt=log&v18=security&comp=ucwc&ts=1570114052762&tcset=utf8&im=dsjs&title=This%20huge%20Android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made%20basic%20security%20mistakes%20%7C%20ZDNet&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS: phx2-dw-cbsi-xw-ext-lb.cnet.com
Software: Apache/2.4.25 /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Server: Apache/2.4.25
Vary: *
Content-Type: image/gif
Cache-Control: no-cache, must-revalidate, no-transform
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=80, max=487
Content-Length: 43
Expires: Fri, 23 Jan 1970 12:12:12 GMT

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1570114051341&de=230134117977&cu=1570114051341&m=1073&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4276&le=1&lf=0&lg=1&lh=159&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1066&an=2&gi=1&gf=1066&gg=2&ix=1066&ic=1066&ez=1&ck=1066&kw=839&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1066&bx=2&ci=1066&jz=839&dj=1&aa=0&ad=907&cn=0&gk=907&gl=0&ik=907&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=839&cd=3&ah=839&am=3&rf=0&re=1&ft=907&fv=0&fw=907&wb=1&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A138271463546&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=300x250&zMoatPS=top&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatSlotId=mpu-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-plus-top-5d960148a8346&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1708952810&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H/1.1 204
No Content / Show response
cbsinteractive.hb.omtrdc.net/ 0
163 B 96ms
95ms XHR
text/plain 52.5.99.108
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=saa.cbsi.com&h:sc:ssl=1&s:user:aid=2ECB050105158000-401AA844C0D0EA62&s:user:mid=53510638259362554562209093715854961023&s:aam:blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&l:aam:loc_hint=6&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_0.42.297&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1570114052232228166898&s:event:type=start&l:event:duration=2&l:event:playhead=0&l:event:ts=1570114052239&l:event:prev_ts=-1&s:asset:type=main&s:asset:name=Turn%20your%20Android%20smartphone%20into%20a%20bunker%20with%2010%20simple%20steps&s:asset:video_id=b17cc96b-012d-463d-a47c-a7201e8a7645&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=71&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0&s:meta:siteSection=editorial&s:meta:siteType=responsive%20web&s:meta:articleId=1b0217ac-3a72-470b-9289-742af80ceb70&s:meta:articleType=content_article&s:meta:articleTitle=this%20huge%20android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made%20basic%20security%20mistakes&s:meta:pageType=article&s:meta:pageViewGuid=eaa95f35-b837-473b-90a5-6449462fcf2d&s:meta:userState=not%20authenticated&s:meta:userType=anon&s:meta:deviceType=desktop&s:meta:siteRsids=cnetzdnetglobalsite&s:meta:siteCode=zdnet&s:meta:pageUrl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&s:meta:sitePrimaryRsid=cnetzdnetglobalsite&s:meta:userStatus=not%20authenticated&s:meta:siteHier=zdnet%3Asecurity&s:meta:topicPrimaryId=113c25b6-ec91-11e3-95d2-02911863765e&s:meta:videoAuthor=zdnet%20editors&s:meta:Network=zdnet&s:meta:tl=Turn%20your%20Android%20smartphone%20into%20a%20bunker%20with%2010%20simple%20steps&s:meta:mediaAutoPlay=true&s:meta:mediaMuted=true&s:meta:mediaIsPaidContent=false
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.5.99.108 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-5-99-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 03 Oct 2019 14:47:37 GMT
X-VaRouter-Backend: prod14
Server: nginx
Connection: keep-alive

GET
H/1.1 204
No Content / Show response
cbsinteractive.hb.omtrdc.net/ 0
163 B 191ms
95ms XHR
text/plain 52.5.99.108
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=saa.cbsi.com&h:sc:ssl=1&s:user:aid=2ECB050105158000-401AA844C0D0EA62&s:user:mid=53510638259362554562209093715854961023&s:aam:blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&l:aam:loc_hint=6&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_0.42.297&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1570114052232228166898&s:event:type=play&l:event:duration=0&l:event:playhead=0&l:event:ts=1570114052238&l:event:prev_ts=-1&s:asset:type=main&s:asset:name=Turn%20your%20Android%20smartphone%20into%20a%20bunker%20with%2010%20simple%20steps&s:asset:video_id=b17cc96b-012d-463d-a47c-a7201e8a7645&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=71&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.5.99.108 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-5-99-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 03 Oct 2019 14:47:38 GMT
X-VaRouter-Backend: prod14
Server: nginx
Connection: keep-alive

GET
H/1.1 204
No Content / Show response
cbsinteractive.hb.omtrdc.net/ 0
163 B 285ms
95ms XHR
text/plain 52.5.99.108
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=saa.cbsi.com&h:sc:ssl=1&s:user:aid=2ECB050105158000-401AA844C0D0EA62&s:user:mid=53510638259362554562209093715854961023&s:aam:blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&l:aam:loc_hint=6&s:cuser:userId.as=0&s:cuser:puuid.as=0&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_0.42.297&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1570114052232228166898&s:event:type=aa_start&l:event:duration=0&l:event:playhead=0&l:event:ts=1570114052302&l:event:prev_ts=-1&s:asset:type=main&s:asset:name=Turn%20your%20Android%20smartphone%20into%20a%20bunker%20with%2010%20simple%20steps&s:asset:video_id=b17cc96b-012d-463d-a47c-a7201e8a7645&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=71&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.5.99.108 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-5-99-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 03 Oct 2019 14:43:37 GMT
X-VaRouter-Backend: prod14
Server: nginx
Connection: keep-alive

GET
H2 404 tboptevent.html
widget.perfectmarket.com/opt/ Frame D472 0
0 6ms
6ms Document
text/plain 151.101.113.181
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
Requested by: Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: Varnish /
Resource Hash

Request headers

:method: GET
:authority: widget.perfectmarket.com
:scheme: https
:path: /opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/

Response headers

status: 404
server: Varnish
retry-after: 0
accept-ranges: bytes
date: Thu, 03 Oct 2019 14:47:32 GMT
via: 1.1 varnish
x-served-by: cache-hhn4061-HHN
x-cache: MISS
x-cache-hits: 0
x-timer: S1570114053.825041,VS0,VE0
content-length: 0

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 7ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1570114051341&de=230134117977&cu=1570114051341&m=1074&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4276&le=1&lf=0&lg=1&lh=159&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1066&an=1066&gi=1&gf=1066&gg=1066&ix=1066&ic=1066&ez=1&ck=1066&kw=839&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1066&bx=1066&ci=1066&jz=839&dj=1&aa=0&ad=907&cn=907&gk=907&gl=907&ik=907&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=839&cd=839&ah=839&am=839&rf=0&re=1&ft=907&fv=907&fw=907&wb=1&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A138271463546&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=300x250&zMoatPS=top&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatSlotId=mpu-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-plus-top-5d960148a8346&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1415067906&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
5ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1570114051341&de=230134117977&cu=1570114051341&m=1075&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4276&le=1&lf=0&lg=1&lh=159&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1066&an=1066&gi=1&gf=1066&gg=1066&ix=1066&ic=1066&ez=1&ck=1066&kw=839&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1066&bx=1066&ci=1066&jz=839&dj=1&aa=0&ad=907&cn=907&gk=907&gl=907&ik=907&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=839&cd=839&ah=839&am=839&rf=0&re=1&ft=907&fv=907&fw=907&wb=1&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A138271463546&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=300x250&zMoatPS=top&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatSlotId=mpu-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-plus-top-5d960148a8346&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1295907940&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
5ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570114052714&de=832766757920&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=41&cb=0&ym=0&cu=1570114052714&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745189935%3A138239344481&zMoatPS=top&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=11&zMoatH=11&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=11x11&zMoatSZPS=11x11%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1853590820&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
5ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=1&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1570114051232&de=139183733176&cu=1570114051232&m=1512&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4265&le=1&lf=0&lg=1&lh=174&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1487&an=1137&gi=1&gf=1487&gg=1137&ix=1487&ic=1487&ez=1&ck=1137&kw=928&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1487&bx=1137&ci=1137&jz=928&dj=1&aa=1&ad=1309&cn=959&gn=1&gk=1309&gl=959&ik=1309&co=1309&cp=1142&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1142&cd=928&ah=1142&am=928&rf=0&re=1&ft=1309&fv=959&fw=959&wb=1&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A138271463540&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=728x90&zMoatPS=top&zMoatSZPS=728x90%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=728&zMoatH=90&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatSlotId=leader-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-top-5d960148a8346&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1477669757&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H2 200 2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800.m3u8 Show response
techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/ 1 KB
463 B 32ms
32ms XHR
application/x-mpegurl 2.16.186.72
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800.m3u8
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-72.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 165e8df930ccd26b9ea1e73cebe5d93b5875176e4eb0a67b4da6417782cce5ba

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:32 GMT
content-encoding: gzip
last-modified: Fri, 02 Mar 2018 17:07:44 GMT
server: AkamaiNetStorage
status: 200
etag: "009a899cf520c89d297ff94ccc350151:1520010466"
vary: Accept-Encoding
content-type: application/x-mpegURL
access-control-allow-origin: https://www.zdnet.com
akamai-mon-iucid-del: 525165
accept-ranges: bytes
content-length: 238

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
5ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=1&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1570114051341&de=230134117977&cu=1570114051341&m=1406&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4265&le=1&lf=0&lg=1&lh=159&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1400&an=1066&gi=1&gf=1400&gg=1066&ix=1400&ic=1400&ez=1&ck=1066&kw=839&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1400&bx=1066&ci=1066&jz=839&dj=1&aa=1&ad=1241&cn=907&gn=1&gk=1241&gl=907&ik=1241&co=1241&cp=1067&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1067&cd=839&ah=1067&am=839&rf=0&re=1&ft=1241&fv=907&fw=907&wb=1&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A138271463546&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=300x250&zMoatPS=top&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatSlotId=mpu-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-plus-top-5d960148a8346&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1929910793&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
5ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1570114052780&de=859193472951&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=45&cb=0&ym=0&cu=1570114052780&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745327422%3A138239368367&zMoatPS=top&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatW=641&zMoatH=321&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatSZ=641x321&zMoatSZPS=641x321%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1904636198&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:32 GMT

GET
H2 200 2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_1.ts Show response
techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/ 1 MB
1 MB 35ms
35ms XHR
video/mp2t 2.16.186.72
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_1.ts
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-72.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9d0c671fae9b03bb7a65a1af38eac21192533c84c6402fae92cc2ef353bc70bc

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:32 GMT
last-modified: Fri, 02 Mar 2018 17:07:45 GMT
server: AkamaiNetStorage
etag: "6767d92cbbd954a4308621cb32e10ac5:1520010467"
status: 200
content-type: video/MP2T
access-control-allow-origin: https://www.zdnet.com
akamai-mon-iucid-del: 525165
accept-ranges: bytes
content-length: 1433688

GET
H/1.1 200
OK p
sb.scorecardresearch.com/ 43 B
309 B 10ms
9ms Image
image/gif 2.16.31.65
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1570114050451&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=71000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=b17cc96b-012d-463d-a47c-a7201e8a7645&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1570114052949&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=2498&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=ZDNet%20Video&ns_st_sn=*null&ns_st_en=*null&ns_st_ct=vc12&ns_st_ge=*null&ns_st_st=3000074&ns_st_ce=0&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=zdnet&c3=UVPJS%7C0_42_297&c4=3000074&c6=Turn%20your%20Android%20smartphone%20into%20a%20bunker%20with%2010%20simple%20steps&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&c8=This%20huge%20Android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made%20basic%20security%20mistakes%20%7C%20ZDNet&c9=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.16.31.65 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-16-31-65.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ping
ping.chartbeat.net/ 43 B
168 B 92ms
92ms Image
image/gif 107.23.115.104
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=video%40zdnet.com&g=65713&p=%2Fvideo%2Fmanifest%2Fthe-10-best-ways-to-secure-your-android-phone.m3u8&i=Turn%20your%20Android%20smartphone%20into%20a%20bunker%20with%2010%20simple%20steps&g0=security&g1=danny%20palmer&u=CTY6-7C_mDQtCU1XzA&t=C9yZ4WBuJbw7DZ7xoesJzrrmVEYC&x=0&y=0&V=116&VS=VS&n=1&b=1599&_vd=71000&_vi=This%20huge%20Android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made%20basic%20securit&_vp=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F&_vh=zdnet.com&_pu=DSrogqCWXKnexY2L3&_pt=DPlZj-CSh1urDJEzIbBcT0cxCDy1Vl&_pr=&_vdd=zdnet.com&_vt=ct&_vs=s2&_vcs=1&_vvs=0.0006879999999999999&_vpt=0.019265&_vaup=man&_vplt=0.42.297&_vce=0&c=0.04&W=0&R=1&I=0&E=0&j=20&tz=-120&_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.23.115.104 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-107-23-115-104.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Thu, 03 Oct 2019 14:47:33 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
expires: 0

POST
H/1.1 200
OK domains Show response
api.viglink.com/api/ 42 B
721 B 30ms
30ms XHR
text/javascript 99.80.15.126
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api.viglink.com/api/domains
Requested by: Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: 5cb6c790a9135464a9b54bde7faa4129632bc03ecde0427374e447a77238cfb6

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Server: Apache-Coyote/1.1
P3P: CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_2.ts Show response
techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/ 1 MB
1 MB 33ms
33ms XHR
video/mp2t 2.16.186.72
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_2.ts
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-72.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 8a7103c2d1731c8453becf879304b1bfc7c176d6e296f0dd716a34c888c0c066

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
last-modified: Fri, 02 Mar 2018 17:07:48 GMT
server: AkamaiNetStorage
etag: "c46eb5c58998a5a4235b65d724f3a20b:1520010468"
status: 200
content-type: video/MP2T
access-control-allow-origin: https://www.zdnet.com
akamai-mon-iucid-del: 525165
accept-ranges: bytes
content-length: 1450608

GET
H2 200 2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_3.ts Show response
techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/ 1 MB
1 MB 48ms
48ms XHR
video/mp2t 2.16.186.72
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_3.ts
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-72.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: e442e838711752b98d785df50ad6f7765504bc9e49d742b329f93595fd3749ca

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
last-modified: Fri, 02 Mar 2018 17:07:48 GMT
server: AkamaiNetStorage
etag: "d8a91fe38125afbc2d2becb9e5d945ed:1520010468"
status: 200
content-type: video/MP2T
access-control-allow-origin: https://www.zdnet.com
akamai-mon-iucid-del: 525165
accept-ranges: bytes
content-length: 1445720

GET
H2 200 2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_4.ts Show response
techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/ 1 MB
1 MB 53ms
53ms XHR
video/mp2t 2.16.186.72
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_4.ts
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-72.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: e667d66fe244bfe8c171933025895da11478b613f04f0e11fed881119f7d0382

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
last-modified: Fri, 02 Mar 2018 17:07:49 GMT
server: AkamaiNetStorage
etag: "47968417c2f964c64f8715777c73118b:1520010469"
status: 200
content-type: video/MP2T
access-control-allow-origin: https://www.zdnet.com
akamai-mon-iucid-del: 525165
accept-ranges: bytes
content-length: 1338936

GET
H2 200 json Show response
trc.taboola.com/cbsinteractive-zdnet/trc/3/ 12 KB
5 KB 140ms
139ms Script
application/javascript 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/cbsinteractive-zdnet/trc/3/json?tim=16%3A47%3A33.322&lti=deflated&data=%7B%22id%22%3A424%2C%22ii%22%3A%22%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22vi%22%3A1570114053320%2C%22cv%22%3A%2220191002-10-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22cmps%22%3A3%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1585%2C%22dh%22%3A4295%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A8%2C%22uim%22%3A%22alternating-thumbnails-a%3Aabp%3D0%22%2C%22uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22orig_uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22cd%22%3A3735.125%2C%22mw%22%3A770%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22deflated%22%7D
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191002-10-RELEASE.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx /
Resource Hash: 942c3f203c18c030a2bb5296b46e77390e31e8d74f8c6058435b37bb5efa68cc

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
content-encoding: gzip
server: nginx
x-timer: S1570114053.328688,VS0,VE133
status: 200
x-served-by: cache-hhn4066-HHN
vary: Accept-Encoding
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: *
access-control-allow-credentials: true
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
x-cache-hits: 0

GET
H2 200 userx.20191002-10-RELEASE.es6.js Show response
cdn.taboola.com/libtrc/ 22 KB
8 KB 6ms
6ms Script
application/javascript 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/userx.20191002-10-RELEASE.es6.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e85ba4d66717e8de5dcba1b5e0285ced20874b84f316ff3c0840277352b9c9ea

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: 7czDtX8TJp.OUfK2QYR9kQhkSDorEoft
content-encoding: gzip
etag: "68efda98343f3a646119692abafb484d"
age: 11
x-cache: HIT
status: 200
x-amz-replication-status: PENDING
content-length: 7734
x-amz-id-2: QPd6mBrMe7OS2Q0zCsGsUkKeOz9Fp/l+LNeHi9xyDpuo955im+Taey5jlU5+sdQU3GQtF/V4yz8=
x-served-by: cache-hhn4066-HHN
last-modified: Wed, 02 Oct 2019 22:32:45 GMT
server: AmazonS3
x-timer: S1570114053.490785,VS0,VE0
date: Thu, 03 Oct 2019 14:47:33 GMT
vary: Accept-Encoding
x-amz-request-id: 0C72CF643987F764
via: 1.1 varnish
cache-control: private,max-age=14400
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 67
x-cache-hits: 35

GET
H2 204 social
trc.taboola.com/cbsinteractive-zdnet/log/3/ 0
54 B 15ms
14ms Image
image/gif 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=deflated&ri=c9a758c6b6ea6401e97fb5d56a9ce002&sd=v2_006307001d56390818a583ab655602ed_fa015b6c-db63-4dd4-970a-1e68d6a4b267-tuct48f8f85_1570114053_1570114053_CNawjgYQzro_GMjJ3JDZLSABKAEwODib4wlAgooQSJjEF1Cl7BBYAWAA&pi=/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&wi=-1661037844285130911&pt=text&vi=1570114053320&st=social-available&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22ctx%22%2C%22ism%22%3Afalse%2C%22srx%22%3A1600%2C%22sry%22%3A1200%2C%22pd%22%3Anull%2C%22tpl%22%3A%22%22%2C%22url%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%22%2C%22rref%22%3A%22%22%2C%22sref%22%3A%22_sessionPending_%22%2C%22hdl%22%3A%22%22%2C%22sec%22%3A%22%22%2C%22aut%22%3A%22%22%2C%22img%22%3A%22%22%2C%22v%22%3A13%7D%5D%7D&tim=16%3A47%3A33.502&id=9280&llvl=1&cv=20191002-10-RELEASE&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Oct 2019 14:47:33 GMT
via: 1.1 varnish
server: nginx
x-timer: S1570114054.508852,VS0,VE8
x-served-by: cache-hhn4066-HHN
status: 204
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
content-type: image/gif
x-cache-hits: 0

GET
H2 204 social
trc.taboola.com/cbsinteractive-zdnet/log/3/ 0
83 B 14ms
14ms Image
image/gif 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=deflated&ri=c9a758c6b6ea6401e97fb5d56a9ce002&sd=v2_006307001d56390818a583ab655602ed_fa015b6c-db63-4dd4-970a-1e68d6a4b267-tuct48f8f85_1570114053_1570114053_CNawjgYQzro_GMjJ3JDZLSABKAEwODib4wlAgooQSJjEF1Cl7BBYAWAA&pi=/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&wi=-1661037844285130911&pt=text&vi=1570114053320&st=social-visible&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A1%2C%22ln%22%3A%22above-fold%22%2C%22lx%22%3A362%2C%22ly%22%3A603%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%2C%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A1%2C%22ln%22%3A%22above-fold%22%2C%22lx%22%3A670%2C%22ly%22%3A603%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%5D%7D&tim=16%3A47%3A33.502&id=6586&llvl=1&cv=20191002-10-RELEASE&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Oct 2019 14:47:33 GMT
via: 1.1 varnish
server: nginx
x-timer: S1570114054.508835,VS0,VE8
x-served-by: cache-hhn4066-HHN
status: 204
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
content-type: image/gif
x-cache-hits: 0

POST
H2 204 available Show response
trc.taboola.com/cbsinteractive-zdnet/log/3/ 0
286 B 18ms
17ms XHR
image/gif 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/cbsinteractive-zdnet/log/3/available?route=AM%3AAM%3AV&lti=deflated
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191002-10-RELEASE.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Thu, 03 Oct 2019 14:47:33 GMT
via: 1.1 varnish
server: nginx
x-timer: S1570114054.517980,VS0,VE10
x-served-by: cache-hhn4066-HHN
status: 204
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
content-type: image/gif
x-cache-hits: 0

GET
H2 200 1a1ac15271660f3d945b4904ef437371.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 5 KB
6 KB 13ms
8ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1a1ac15271660f3d945b4904ef437371.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 2f179c0918ddb8af28b17040e1822625ffa2635a08e4fa98521d0a95dc9a554b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
via: 1.1 varnish, 1.1 varnish
age: 827653
edge-cache-tag: 616089906201828448420340560109273106143,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Wed, 16 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1a1ac15271660f3d945b4904ef437371.jpg
content-length: 5431
x-served-by: cache-hhn4047-HHN, cache-hhn4066-HHN
last-modified: Sun, 15 Sep 2019 13:12:03 GMT
server: cloudinary
x-timer: S1570114054.524989,VS0,VE0
etag: "033e210ecc99607a94af83829efcf625"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1

GET
H2 200 05c672b8aa748b6cc9f544b15c9bb109.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 14 KB
14 KB 13ms
9ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/05c672b8aa748b6cc9f544b15c9bb109.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 8d9e2d77a1628184056c06e30f86feded8f5f16f24c40a266b9479611f345a2b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
via: 1.1 varnish, 1.1 varnish
age: 2018149
edge-cache-tag: 465768806677159802898277598684303907690,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Fri, 20 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: HIT, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/05c672b8aa748b6cc9f544b15c9bb109.jpg
content-length: 14230
x-served-by: cache-hhn4044-HHN, cache-hhn4066-HHN
last-modified: Tue, 20 Aug 2019 19:09:57 GMT
server: cloudinary
x-timer: S1570114054.525187,VS0,VE0
etag: "b6b27a8822f7be1435a57f419570f9dc"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 1, 1

GET
H2 200 8a357e4cb4282bc1486082aab2f7fd35.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 26 KB
26 KB 10ms
6ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/8a357e4cb4282bc1486082aab2f7fd35.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: f31aa040b6c5d23d9150f643a70d82b3bf70d33b097507dfae18e2b60e62b3ac

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
via: 1.1 varnish, 1.1 varnish
age: 1737626
edge-cache-tag: 367226180691610006852220696191132687533,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200, 200 OK
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/8a357e4cb4282bc1486082aab2f7fd35.jpg
content-length: 26306
x-request-id: c994047f3a98d1a2
x-served-by: cache-hhn4038-HHN, cache-hhn4066-HHN
last-modified: Thu, 12 Sep 2019 15:11:22 GMT
server: cloudinary
x-timer: S1570114054.524940,VS0,VE0
etag: "7a4c83b179537212ef0efe081a55f42d"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 3

GET
H2 200 5af30d10e51791645293e75e6697bb22.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 13 KB
13 KB 10ms
7ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/5af30d10e51791645293e75e6697bb22.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: f310fe51f00fc62052f6683ce59c40b4b90e09e0972c211db2be3cbd09fb6dda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
via: 1.1 varnish, 1.1 varnish
age: 603185
edge-cache-tag: 562740323100177803605715048935782352595,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Sun, 27 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/5af30d10e51791645293e75e6697bb22.jpg
content-length: 12930
x-served-by: cache-hhn4080-HHN, cache-hhn4066-HHN
last-modified: Thu, 26 Sep 2019 15:12:53 GMT
server: cloudinary
x-timer: S1570114054.524963,VS0,VE0
etag: "5c8060e8fa3764bf0f35560aa613a3eb"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 3

GET
H2 200 f4cc57ff8e5448fd74aa0bd36201615a.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 12 KB
12 KB 9ms
6ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f4cc57ff8e5448fd74aa0bd36201615a.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 560615fa52f72d6eadecf1d05e714947965bed2c88e8d4ad6cd0d9f679932440

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
via: 1.1 varnish, 1.1 varnish
age: 1102693
edge-cache-tag: 324462488377992944272640379917953778861,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Mon, 23 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f4cc57ff8e5448fd74aa0bd36201615a.jpg
content-length: 11904
x-served-by: cache-hhn4078-HHN, cache-hhn4066-HHN
last-modified: Fri, 23 Aug 2019 01:11:19 GMT
server: cloudinary
x-timer: S1570114054.524888,VS0,VE0
etag: "d5327f6cb0b3bc61978e0e6d8a136122"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2

GET
H2 200 f19ff2ebc4b758002c9dc413db9f8181.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 8 KB
9 KB 8ms
5ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f19ff2ebc4b758002c9dc413db9f8181.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: aa46af37e4eb7cfb817074ce31d43620cf1414e04997f54e1c058fee68476005

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
via: 1.1 varnish, 1.1 varnish
age: 1516867
edge-cache-tag: 450630234765926582538263118379552414965,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Mon, 23 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f19ff2ebc4b758002c9dc413db9f8181.jpg
content-length: 8400
x-served-by: cache-hhn4059-HHN, cache-hhn4066-HHN
last-modified: Fri, 23 Aug 2019 06:34:17 GMT
server: cloudinary
x-timer: S1570114054.524573,VS0,VE0
etag: "94fe7c2e2d4551ce9e0db1cb2667bce2"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 3

GET
H2 200 4730e0a4dab2b61e06f956144628023a.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 15 KB
16 KB 9ms
5ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4730e0a4dab2b61e06f956144628023a.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 103eedd2ed4e48c35d657dd30200931da56794a89a93fd450fc54556720654b6

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
via: 1.1 varnish, 1.1 varnish
age: 1340800
edge-cache-tag: 584055100435810448798779673539094932871,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Wed, 18 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4730e0a4dab2b61e06f956144628023a.jpg
content-length: 15553
x-served-by: cache-hhn4038-HHN, cache-hhn4066-HHN
last-modified: Sun, 18 Aug 2019 23:57:40 GMT
server: cloudinary
x-timer: S1570114054.535281,VS0,VE0
etag: "faf229ad9d28d3fb7b61f99f8543ee32"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1

GET
H2 200 98acfa7a2cedb3b3cd2a93d242ebb05b.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 11 KB
12 KB 11ms
8ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/98acfa7a2cedb3b3cd2a93d242ebb05b.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: c4b9d4f37ea05b9943096f4a439cf92343c43ffcf2368b8ebb9f4d6eccf47ca4

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
via: 1.1 varnish, 1.1 varnish
age: 35199
edge-cache-tag: 304756102764379383471380946821037392716,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Fri, 18 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/98acfa7a2cedb3b3cd2a93d242ebb05b.jpg
content-length: 11610
x-served-by: cache-hhn4052-HHN, cache-hhn4066-HHN
last-modified: Tue, 17 Sep 2019 13:04:25 GMT
server: cloudinary
x-timer: S1570114054.535324,VS0,VE0
etag: "e1b4e42d67347fdfdd233d63f8d26203"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1

GET
H2 200 f539211219b796ffbb49949997c764f0.png
cdn.taboola.com/libtrc/static/thumbnails/ 254 B
740 B 6ms
6ms Image
image/png 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191002-10-RELEASE.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC
via: 1.1 varnish
etag: "dfa7b52c86e56bd67fa4002f6ed19854"
age: 26358
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 254
x-amz-id-2: grODyaFUyHwi27S6u2hd746yPHwUf+y1im5Wn93DxT7wozhn8KMFUP712WAAG3eD1t2rnF4k3Bs=
x-served-by: cache-hhn4066-HHN
last-modified: Wed, 24 Jun 2015 07:14:11 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567
x-timer: S1570114054.540132,VS0,VE0
date: Thu, 03 Oct 2019 14:47:33 GMT
x-amz-request-id: 29D722C296265892
cache-control: private,max-age=31536000
accept-ranges: bytes
content-type: image/png
abp: 67
x-cache-hits: 58227

GET
H2 200 2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_5.ts Show response
techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/ 1 MB
1 MB 56ms
56ms XHR
video/mp2t 2.16.186.72
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_5.ts
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-72.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 82f5d9f304ef1bc2703af96751d1a0df640e61764047af253696e67adb388b70

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
last-modified: Fri, 02 Mar 2018 17:07:50 GMT
server: AkamaiNetStorage
etag: "0d062d21cf38eafe99f6808c9eabddb6:1520010470"
status: 200
content-type: video/MP2T
access-control-allow-origin: https://www.zdnet.com
akamai-mon-iucid-del: 525165
accept-ranges: bytes
content-length: 1436508

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1a1ac15271660f3d945b4904ef437371.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 2f179c0918ddb8af28b17040e1822625ffa2635a08e4fa98521d0a95dc9a554b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
via: 1.1 varnish, 1.1 varnish
age: 827653
edge-cache-tag: 616089906201828448420340560109273106143,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Wed, 16 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1a1ac15271660f3d945b4904ef437371.jpg
content-length: 5431
x-served-by: cache-hhn4047-HHN, cache-hhn4066-HHN
last-modified: Sun, 15 Sep 2019 13:12:03 GMT
server: cloudinary
x-timer: S1570114054.558803,VS0,VE0
etag: "033e210ecc99607a94af83829efcf625"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/05c672b8aa748b6cc9f544b15c9bb109.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 8d9e2d77a1628184056c06e30f86feded8f5f16f24c40a266b9479611f345a2b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
via: 1.1 varnish, 1.1 varnish
age: 2018149
edge-cache-tag: 465768806677159802898277598684303907690,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Fri, 20 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: HIT, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/05c672b8aa748b6cc9f544b15c9bb109.jpg
content-length: 14230
x-served-by: cache-hhn4044-HHN, cache-hhn4066-HHN
last-modified: Tue, 20 Aug 2019 19:09:57 GMT
server: cloudinary
x-timer: S1570114054.559372,VS0,VE0
etag: "b6b27a8822f7be1435a57f419570f9dc"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 1, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/8a357e4cb4282bc1486082aab2f7fd35.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: f31aa040b6c5d23d9150f643a70d82b3bf70d33b097507dfae18e2b60e62b3ac

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
via: 1.1 varnish, 1.1 varnish
age: 1737626
edge-cache-tag: 367226180691610006852220696191132687533,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200, 200 OK
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/8a357e4cb4282bc1486082aab2f7fd35.jpg
content-length: 26306
x-request-id: c994047f3a98d1a2
x-served-by: cache-hhn4038-HHN, cache-hhn4066-HHN
last-modified: Thu, 12 Sep 2019 15:11:22 GMT
server: cloudinary
x-timer: S1570114054.559402,VS0,VE0
etag: "7a4c83b179537212ef0efe081a55f42d"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 4

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/5af30d10e51791645293e75e6697bb22.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: f310fe51f00fc62052f6683ce59c40b4b90e09e0972c211db2be3cbd09fb6dda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
via: 1.1 varnish, 1.1 varnish
age: 603185
edge-cache-tag: 562740323100177803605715048935782352595,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Sun, 27 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/5af30d10e51791645293e75e6697bb22.jpg
content-length: 12930
x-served-by: cache-hhn4080-HHN, cache-hhn4066-HHN
last-modified: Thu, 26 Sep 2019 15:12:53 GMT
server: cloudinary
x-timer: S1570114054.559545,VS0,VE0
etag: "5c8060e8fa3764bf0f35560aa613a3eb"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 4

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f4cc57ff8e5448fd74aa0bd36201615a.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 560615fa52f72d6eadecf1d05e714947965bed2c88e8d4ad6cd0d9f679932440

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
via: 1.1 varnish, 1.1 varnish
age: 1102693
edge-cache-tag: 324462488377992944272640379917953778861,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Mon, 23 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f4cc57ff8e5448fd74aa0bd36201615a.jpg
content-length: 11904
x-served-by: cache-hhn4078-HHN, cache-hhn4066-HHN
last-modified: Fri, 23 Aug 2019 01:11:19 GMT
server: cloudinary
x-timer: S1570114054.559558,VS0,VE0
etag: "d5327f6cb0b3bc61978e0e6d8a136122"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f19ff2ebc4b758002c9dc413db9f8181.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: aa46af37e4eb7cfb817074ce31d43620cf1414e04997f54e1c058fee68476005

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
via: 1.1 varnish, 1.1 varnish
age: 1516867
edge-cache-tag: 450630234765926582538263118379552414965,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Mon, 23 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f19ff2ebc4b758002c9dc413db9f8181.jpg
content-length: 8400
x-served-by: cache-hhn4059-HHN, cache-hhn4066-HHN
last-modified: Fri, 23 Aug 2019 06:34:17 GMT
server: cloudinary
x-timer: S1570114054.559504,VS0,VE0
etag: "94fe7c2e2d4551ce9e0db1cb2667bce2"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 4

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4730e0a4dab2b61e06f956144628023a.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 103eedd2ed4e48c35d657dd30200931da56794a89a93fd450fc54556720654b6

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
via: 1.1 varnish, 1.1 varnish
age: 1340800
edge-cache-tag: 584055100435810448798779673539094932871,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Wed, 18 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4730e0a4dab2b61e06f956144628023a.jpg
content-length: 15553
x-served-by: cache-hhn4038-HHN, cache-hhn4066-HHN
last-modified: Sun, 18 Aug 2019 23:57:40 GMT
server: cloudinary
x-timer: S1570114054.569310,VS0,VE0
etag: "faf229ad9d28d3fb7b61f99f8543ee32"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/98acfa7a2cedb3b3cd2a93d242ebb05b.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: c4b9d4f37ea05b9943096f4a439cf92343c43ffcf2368b8ebb9f4d6eccf47ca4

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
via: 1.1 varnish, 1.1 varnish
age: 35199
edge-cache-tag: 304756102764379383471380946821037392716,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Fri, 18 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/98acfa7a2cedb3b3cd2a93d242ebb05b.jpg
content-length: 11610
x-served-by: cache-hhn4052-HHN, cache-hhn4066-HHN
last-modified: Tue, 17 Sep 2019 13:04:25 GMT
server: cloudinary
x-timer: S1570114054.569387,VS0,VE0
etag: "e1b4e42d67347fdfdd233d63f8d26203"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2

POST
H/1.1 200
OK domains Show response
api.viglink.com/api/ 79 B
524 B 30ms
30ms XHR
text/javascript 99.80.15.126
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api.viglink.com/api/domains
Requested by: Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.15.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-99-80-15-126.eu-west-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: 161d84b55a75c00b27b3dd85f6a2b8ec6faf97da4779e6bb2f6b9b7924b1ca2c

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:32 GMT
Server: Apache-Coyote/1.1
P3P: CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
Content-Length: 79
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_6.ts Show response
techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/ 1 MB
1 MB 35ms
34ms XHR
video/mp2t 2.16.186.72
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_6.ts
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-72.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 91ff35b28c317d4e9e5ddd2831e945ae5c867f5d6c0c7e04e6993011d02f6d77

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
last-modified: Fri, 02 Mar 2018 17:07:51 GMT
server: AkamaiNetStorage
etag: "1b5d4d76e103077908cce5bd1c03ca82:1520010471"
status: 200
content-type: video/MP2T
access-control-allow-origin: https://www.zdnet.com
akamai-mon-iucid-del: 525165
accept-ranges: bytes
content-length: 1429176

GET
H2 200 2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_7.ts Show response
techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/ 1 MB
1 MB 52ms
52ms XHR
video/mp2t 2.16.186.72
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_7.ts
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-72.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 637f61a5ad1c39b23ca94f3eaad479d3dcf7f3c721bcfe1670f000c7c45a5427

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:33 GMT
last-modified: Fri, 02 Mar 2018 17:07:51 GMT
server: AkamaiNetStorage
etag: "f739485da0f4f515f02850d6e5d787f9:1520010471"
status: 200
content-type: video/MP2T
access-control-allow-origin: https://www.zdnet.com
akamai-mon-iucid-del: 525165
accept-ranges: bytes
content-length: 1471664

GET
H2 200 gn
secure-us.imrworldwide.com/cgi-bin/ 44 B
424 B 34ms
33ms Image
image/gif 52.49.22.89
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-us.imrworldwide.com/cgi-bin/gn?prd=dcr&ci=us-700144&ch=us-700144_c01_P&asn=defChnAsset&sessionId=0VaDdmShYVEXISQsqIImULfgIf0s61570114050&tl=Turn%20your%20Android%20smartphone%20into%20a%20bunker%20with%2010%20simple%20steps&prv=1&c6=vc,c01&ca=us-700144_c01_b17cc96b-012d-463d-a47c-a7201e8a7645&cg=ZDNet%20Video&c13=asid,PF7B87067-BF4D-F80F-E040-070AAD316CE6&c32=segA,NA&c33=segB,NA&c34=segC,NA&c15=apn,UVPJS|0_42_297&plugv=&playerv=&sup=0&segment2=&segment1=&forward=1&ad=0&cr=4_00_99_V1_00000&c9=devid,&enc=true&c1=nuid,999&at=view&rt=video&c16=sdkv,bj.6.0.0&c27=cln,0&crs=&lat=&lon=&c29=plid,15701140508527453&c30=bldv,6.0.0.428&st=dcr&c7=osgrp,&c8=devgrp,&c10=plt,&c40=adbid,&c14=osver,NA&c26=dmap,1&dd=&hrd=&wkd=&c35=adrsid,&c36=cref1,b17cc96b-012d-463d-a47c-a7201e8a7645&c37=cref2,&c11=agg,1&c12=apv,&c51=adl,0&c52=noad,0&sd=71&devtypid=&pc=NA&c53=fef,n&c54=oad,&c55=cref3,&c57=adldf,2&ai=b17cc96b-012d-463d-a47c-a7201e8a7645&c3=st,c&c64=starttm,1570114053&adid=b17cc96b-012d-463d-a47c-a7201e8a7645&c58=isLive,false&c59=sesid,7UMYwqSeVKrxJiD1kdktzXXem2w9N1570114053&c61=createtm,1570114053&c63=pipMode,&c68=bndlid,&nodeTM=&logTM=&c73=phtype,&c74=dvcnm,&c76=adbsnid,&c77=adsuprt,1&uoo=&evdata=&c71=ottflg,0&c72=otttyp,none&c44=progen,&davty=0&si=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&c66=mediaurl,&c62=sendTime,1570114053&rnd=621614
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.49.22.89 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-49-22-89.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Oct 2019 14:47:33 GMT
server: nginx
status: 200
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
content-type: image/gif
content-length: 44
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 m
secure-us.imrworldwide.com/cgi-bin/ 44 B
425 B 31ms
31ms Image
image/gif 52.49.22.89
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-700144&c29=plid,15701140508527453&c30=bldv,6.0.0.428&c6=vc,c01&c3=&cg=ZDNet%20Video&tl=dav0-Turn%20your%20Android%20smartphone%20into%20a%20bunker%20with%2010%20simple%20steps&c9=devid,&pr=iag.sid,1000011&pr=iag.tfid,902&pr=iag.bcr,us-700144&pr=iag.pgm,Turn%20your%20Android%20smartphone%20into%20a%20bunker%20with%2010%20simple%20steps&pr=iag.epi,Turn%20your%20Android%20smartphone%20into%20a%20bunker%20with%2010%20simple%20steps%7C%7C%7Csf&pr=iag.seg,1&pr=iag.pd,www.zdnet.com&pr=iag.oad,na&pr=iag.fp,sf&pr=iag.cp,soc&c10=plt,&c26=dmap,3&tp=gg&c24=zip,99&uoo=&c68=bndlid,&c61=createtm,1570114053&nodeTM=&logTM=&c73=phtype,&c74=dvcnm,&c62=sendTime,1570114053&rnd=47185
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.49.22.89 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-49-22-89.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Oct 2019 14:47:33 GMT
server: nginx
status: 200
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
content-type: image/gif
content-length: 44
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 settings.js Show response
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/variation/var-8bfb225b-f103-49ab-955c-32d3183cf24c/ 7 KB
6 KB 18ms
18ms Script
application/javascript 2606:4700::6810:4fa5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/variation/var-8bfb225b-f103-49ab-955c-32d3183cf24c/settings.js?cb=637048605067352348
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637048605074139690
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe074214a9c301f8c3ba319d4bab7cba8d65164dcc2077272a9cacedf8941ae2

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 03 Oct 2019 14:47:33 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: 2VqL9ACwktkYsY/Ec2Z++Q==
age: 245057
cf-polished: origSize=7074
status: 200
last-modified: Mon, 23 Sep 2019 18:34:57 GMT
x-ms-lease-status: unlocked
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-ms-request-id: 7084f032-801e-009d-7b3d-722f81000000
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
cf-ray: 51ffb6456ee2cba8-VIE
expires: Fri, 02 Oct 2020 14:47:33 GMT

GET
H2 200 lightbox_builder.js Show response
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 54F7 200 KB
28 KB 19ms
19ms Script
application/javascript 2606:4700::6810:4fa5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=637048605067352348
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637048605074139690
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 35f3de772fc88b09b9f866de6d38f50d8716aecc446bb10456585f61834ae2c8

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 03 Oct 2019 14:47:33 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: DPY02gsPpNVzBSyytYwMZw==
age: 245498
cf-polished: origSize=326600
status: 200
last-modified: Mon, 23 Sep 2019 18:35:06 GMT
x-ms-lease-status: unlocked
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-ms-request-id: 3afa8c39-501e-0131-7d3d-724843000000
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
cf-ray: 51ffb6456ef8cba8-VIE
expires: Fri, 02 Oct 2020 14:47:33 GMT

GET
H2 200 ping
ping.chartbeat.net/ 43 B
168 B 92ms
92ms Image
image/gif 107.23.115.104
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F&u=DSrogqCWXKnexY2L3&d=zdnet.com&g=65713&g0=security&g1=danny%20palmer&n=1&f=00001&c=0.08&x=0&m=0&y=4823&o=1585&w=1200&j=30&R=1&W=0&I=0&E=4&e=2&r=&b=1056&t=DPlZj-CSh1urDJEzIbBcT0cxCDy1Vl&V=116&tz=-120&_acct=anon&_vi=Turn%20your%20Android%20smartphone%20into%20a%20bunker%20with%2010%20simple%20steps&_vp=/video/manifest/the-10-best-ways-to-secure-your-android-phone.m3u8&_vdd=video%40zdnet.com&_vs=s2&_vt=ct&_vtn=null&_vd=71000&sn=3&sv=D1L-AIDcpicsDEmeIYCihflaCtMhsC&sd=1&im=067b2ff3&_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.23.115.104 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-107-23-115-104.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Thu, 03 Oct 2019 14:47:34 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
expires: 0

GET
H2 200 2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_8.ts Show response
techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/ 1 MB
1 MB 53ms
53ms XHR
video/mp2t 2.16.186.72
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_8.ts
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-72.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: e39edf5f193e5ae765b8b0274a1583ec1e0b587f28ef554e1b95f4d69e93d333

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:34 GMT
last-modified: Fri, 02 Mar 2018 17:07:52 GMT
server: AkamaiNetStorage
etag: "883b5e3ba721c4439457c22d765d0f93:1520010472"
status: 200
content-type: video/MP2T
access-control-allow-origin: https://www.zdnet.com
akamai-mon-iucid-del: 525165
accept-ranges: bytes
content-length: 1307352

GET
H2 200 2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_9.ts Show response
techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/ 991 KB
993 KB 46ms
45ms XHR
video/mp2t 2.16.186.72
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_9.ts
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-72.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: f125abd5576ca817044dc1470c8b5e03a4ccd488e45f78c82d57b370a1b26f1f

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:34 GMT
last-modified: Fri, 02 Mar 2018 17:07:53 GMT
server: AkamaiNetStorage
etag: "4340990759ec14de6dcde19ff798d650:1520010473"
status: 200
content-type: video/MP2T
access-control-allow-origin: https://www.zdnet.com
akamai-mon-iucid-del: 525165
accept-ranges: bytes
content-length: 1014448

GET
H2 200 css
fonts.googleapis.com/ Frame 54F7 783 B
440 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:817::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway

Requested by

Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=637048605067352348

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

3147026ff99804131affcb3cadbdfd49c0a07583682aefcc1198f57e2614d5b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Thu, 03 Oct 2019 14:47:34 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
date: Thu, 03 Oct 2019 14:47:34 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
expires: Thu, 03 Oct 2019 14:47:34 GMT

GET
H2 200 fancybox_sprite.png
cdn.jsdelivr.net/fancybox/2.1.5/ 1 KB
2 KB 21ms
5ms Image
image/png 2a04:4e42:3::621
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.jsdelivr.net/fancybox/2.1.5/fancybox_sprite.png

Requested by

Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637048605074139690

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::621 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

Resource Hash

b9d6fddb0988440902fcfc72f371ecfa80ee2eb36073f9eebc17449ee41c886f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
status: 200
etag: W/"552-F98Z+XYo53vgnDUr8nQl+uokglE"
vary: Accept-Encoding
x-cache: HIT, HIT
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
date: Thu, 03 Oct 2019 14:47:34 GMT
accept-ranges: bytes
timing-allow-origin: *
content-length: 1362
x-served-by: cache-ams21048-AMS, cache-fra19128-FRA

GET
H2 200 1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2
fonts.gstatic.com/s/raleway/v14/ Frame 54F7 13 KB
13 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:806::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v14/1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2

Requested by

Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637048605074139690

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Raleway
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 25 Aug 2019 01:25:37 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:48:04 GMT
server: sffe
age: 3417717
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 13428
x-xss-protection: 0
expires: Mon, 24 Aug 2020 01:25:37 GMT

GET
H2 200 2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_10.ts Show response
techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/ 1 MB
1 MB 49ms
49ms XHR
video/mp2t 2.16.186.72
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_10.ts
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-72.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 1ee9ba8184faa49e8e854d1e197e6412b1036d36e7823d94c1ba828534914246

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:34 GMT
last-modified: Fri, 02 Mar 2018 17:07:46 GMT
server: AkamaiNetStorage
etag: "6578e7348ba3aba624283197f25f6c4f:1520010467"
status: 200
content-type: video/MP2T
access-control-allow-origin: https://www.zdnet.com
akamai-mon-iucid-del: 525165
accept-ranges: bytes
content-length: 1384620

GET
H2 200 2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_11.ts Show response
techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/ 809 KB
811 KB 441ms
441ms XHR
video/mp2t 2.16.186.72
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://techrepublicmedia.akamaized.net/media/2018/03/02/1175165507566/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800/2018-03-02-wochit-the-10-best-ways-to-secure-your-android-phone_1513024_1800_11.ts
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-72.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: f163a85a9d1611ade0544382ac55f9cd6febda4697a8cdfa72a56a332b1563b9

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:34 GMT
last-modified: Fri, 02 Mar 2018 17:07:47 GMT
server: AkamaiNetStorage
etag: "ecbbade48daa282a4b1636a7789d2e67:1520010468"
status: 200
content-type: video/MP2T
access-control-allow-origin: https://www.zdnet.com
akamai-mon-iucid-del: 525165
accept-ranges: bytes
content-length: 828328

GET
H2 200 t.gif
www.lightboxcdn.com/z9g/ 35 B
129 B 17ms
17ms Image
image/gif 2606:4700::6810:4fa5
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lightboxcdn.com/z9g/t.gif?c=1570114054843&h=www.zdnet.com&e=i&u=40913&b=193988&v=2544&s=empty
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 03 Oct 2019 14:47:34 GMT
cf-cache-status: HIT
content-md5: KNaBTzCeoon4R8ac+RGUxg==
age: 2360781
cf-polished: status=not_needed
x-ms-meta-cbmodifiedtime: Tue, 26 Feb 2019 00:59:40 GMT
status: 200
content-length: 35
x-ms-lease-status: unlocked
last-modified: Tue, 26 Feb 2019 01:15:02 GMT
server: cloudflare
etag: 0x8D69B87D5A1B25F
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
x-ms-request-id: 48b7eafb-401e-010c-457d-f6fd65000000
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 51ffb64ad80dcba8-VIE
cf-bgj: imgq:85

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
6ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1570114051232&de=139183733176&cu=1570114051232&m=5184&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4823&le=1&lf=0&lg=1&lh=174&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=5159&an=1487&gi=1&gf=5159&gg=1487&ix=5159&ic=5159&ez=1&ck=1137&kw=928&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5159&bx=1487&ci=1137&jz=928&dj=1&aa=1&ad=4981&cn=1309&gn=1&gk=4981&gl=1309&ik=4981&co=1309&cp=1142&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4959&cd=1142&ah=4959&am=1142&rf=0&re=1&ft=4981&fv=1309&fw=959&wb=2&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A138271463540&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=728x90&zMoatPS=top&zMoatSZPS=728x90%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=728&zMoatH=90&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatSlotId=leader-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-top-5d960148a8346&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1777417463&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:36 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:36 GMT

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 14ms
13ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1570114051341&de=230134117977&cu=1570114051341&m=5076&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4823&le=1&lf=0&lg=1&lh=159&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=5070&an=1400&gi=1&gf=5070&gg=1400&ix=5070&ic=5070&ez=1&ck=1066&kw=839&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5070&bx=1400&ci=1066&jz=839&dj=1&aa=1&ad=4911&cn=1241&gn=1&gk=4911&gl=1241&ik=4911&co=1241&cp=1067&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4864&cd=1067&ah=4864&am=1067&rf=0&re=1&ft=4911&fv=1241&fw=907&wb=2&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A138271463546&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=300x250&zMoatPS=top&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatSlotId=mpu-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-plus-top-5d960148a8346&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=215682690&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:36 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:36 GMT

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 7ms
7ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1570114051305&de=79274661091&cu=1570114051305&m=5315&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4823&le=1&lf=0&lg=1&lh=123&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A0%3A-&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&aj=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&dj=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&cq=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5108&cd=5&ah=5108&am=5&rf=0&re=1&wb=1&cl=0&at=0&d=25299489%3A251370729%3A241984809%3A75375443409&bo=23605329&bp=23619609&bd=middle&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=300x250&zMoatPS=middle&zMoatSZPS=300x250%20%7C%20middle&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatSlotId=mpu-middle&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-middle-5d960148a8346&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-middle&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1391655138&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:36 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:36 GMT

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 10ms
10ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1570114051359&de=335063639721&cu=1570114051359&m=5264&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4823&le=1&lf=0&lg=1&lh=149&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A0%3A-&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&aj=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&dj=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&cq=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5056&cd=5&ah=5056&am=5&rf=0&re=1&wb=1&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A75374362809&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=728x90&zMoatPS=bottom&zMoatSZPS=728x90%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=728&zMoatH=90&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatSlotId=leader-plus-bottom&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-bottom-5d960148a8346&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-bottom&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1941872953&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:36 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:36 GMT

POST
H/1.1 200
OK / Show response
inqlnfvog763mmf771rou737u.litix.io/ 43 B
349 B 96ms
95ms XHR
image/gif 34.224.154.10
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://inqlnfvog763mmf771rou737u.litix.io/
Requested by: Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/mux.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.224.154.10 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-224-154-10.compute-1.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:36 GMT
Access-Control-Allow-Methods: POST, GET
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-cache,no-store,must-revalidate
Connection: keep-alive
Content-Length: 43
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 6ms
5ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C&id=1&f=0&j=&t=1570114051572&de=808856345338&cu=1570114051572&m=5247&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4823&le=1&lf=0&lg=1&lh=99&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A0%3A-&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&aj=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&dj=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&cq=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5040&cd=5&ah=5040&am=5&rf=0&re=1&wb=1&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A75375443409&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=RSSbaffb68%7C&zMoatSZ=300x250&zMoatPS=bottom&zMoatSZPS=300x250%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=eaa95f35-b837-473b-90a5-6449462fcf2d&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes&zMoatDev=Desktop&zMoatSlotId=mpu-bottom&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-bottom-5d960148a8346&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-bottom&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1031168834&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:36 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 03 Oct 2019 14:47:36 GMT

GET
H2 200 ping
ping.chartbeat.net/ 43 B
168 B 92ms
92ms Image
image/gif 107.23.115.104
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=video%40zdnet.com&g=65713&p=%2Fvideo%2Fmanifest%2Fthe-10-best-ways-to-secure-your-android-phone.m3u8&i=Turn%20your%20Android%20smartphone%20into%20a%20bunker%20with%2010%20simple%20steps&g0=security&g1=danny%20palmer&u=CTY6-7C_mDQtCU1XzA&t=C9yZ4WBuJbw7DZ7xoesJzrrmVEYC&x=0&y=0&V=116&VS=VS&n=1&b=1599&_vd=71000&_vi=This%20huge%20Android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made%20basic%20securit&_vp=zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F&_vh=zdnet.com&_pu=DSrogqCWXKnexY2L3&_pt=DPlZj-CSh1urDJEzIbBcT0cxCDy1Vl&_pr=&_vdd=zdnet.com&_vt=ct&_vs=s2&_vcs=1&_vvs=0.005687&_vpt=5.004456&_vaup=man&_vplt=0.42.297&_vce=5&c=0.13&W=0&R=1&I=0&E=5&j=20&tz=-120&_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.23.115.104 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-107-23-115-104.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Thu, 03 Oct 2019 14:47:38 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
expires: 0

GET
H2 200 / Show response
www.zdnet.com/homepage/xhr/ 250 KB
28 KB 154ms
153ms XHR
application/json 2.18.233.143
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/homepage/xhr/

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a2-18-233-143.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

c2d45daf8967c871c5184f9fcf5f6b11ee9cfd5725b69806511112711b135d9d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 26972
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 03 Oct 2019 13:33:27 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Thu, 03 Oct 2019 14:47:40 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: 41c57331-9abc-4530-9a04-cbd4cc114c9f
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=5400, private
accept-ranges: bytes
expires: Thu, 03 Oct 2019 15:03:27 GMT

GET
H2 200 ring.gif
zdnet1.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/logos/ 16 KB
9 KB 6ms
6ms Image
image/gif 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/logos/ring.gif

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://zdnet2.cbsistatic.com/fly/1814-fly/css/core/main-a78f3c243e-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83055
status: 200
vary: Accept-Encoding
content-length: 9039
x-xss-protection: 1; mode=block
last-modified: Wed, 02 Oct 2019 15:35:27 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d94c3bf-3f75"
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 09 Oct 2019 15:43:17 GMT

GET
H2 200 ZDLogoMicroRed-x2.png
zdnet2.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/logos/ 2 KB
2 KB 6ms
6ms Image
image/png 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/logos/ZDLogoMicroRed-x2.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://zdnet2.cbsistatic.com/fly/1814-fly/css/core/main-a78f3c243e-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83056
status: 200
vary: Accept-Encoding
content-length: 1513
x-xss-protection: 1; mode=block
last-modified: Wed, 02 Oct 2019 15:35:27 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d94c3bf-6fa"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 09 Oct 2019 15:43:17 GMT

GET
H2 200 ZDLogoMicroWhite-x2.png
zdnet1.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/logos/ 2 KB
2 KB 6ms
6ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/fly/1570030527-fly/bundles/zdnetcss/images/logos/ZDLogoMicroWhite-x2.png

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://zdnet2.cbsistatic.com/fly/1814-fly/css/core/main-a78f3c243e-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83058
status: 200
vary: Accept-Encoding
content-length: 1398
x-xss-protection: 1; mode=block
last-modified: Wed, 02 Oct 2019 15:35:27 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d94c3bf-691"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 09 Oct 2019 15:43:18 GMT

GET
H2 200 river-time-ago-f2210a157b-rev.js Show response
zdnet4.cbsistatic.com/fly/js/components/ 753 B
538 B 6ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/js/components/river-time-ago-f2210a157b-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

2d3e9015bb665cc4e62a0aada26a74311bf87ba40e12b896724f447a98e68a89

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 377704
status: 200
vary: Accept-Encoding
content-length: 426
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Sep 2019 14:07:16 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d8cc614-2f1"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 06 Oct 2019 05:52:31 GMT

GET
H2 200 tr-premium-promo-49ebdaab89-rev.js Show response
zdnet2.cbsistatic.com/fly/js/components/ 461 B
394 B 6ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/components/tr-premium-promo-49ebdaab89-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f0c8ad030a90f1ee3cdcd5910587eab25da7bb0ec6f942d979bba4d506b38380

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 111362
status: 200
vary: Accept-Encoding
content-length: 287
x-xss-protection: 1; mode=block
last-modified: Tue, 01 Oct 2019 15:04:57 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d936b19-1cd"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 09 Oct 2019 07:51:38 GMT

GET
H2 200 image-gallery-modal-e49526b449-rev.js Show response
zdnet1.cbsistatic.com/fly/js/components/ 5 KB
2 KB 17ms
17ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/js/components/image-gallery-modal-e49526b449-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f5b52ad70c5d645388b52d2fadaf8a5311aee9a01436866ab9b3e2c5f02e1c22

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 282844
status: 200
vary: Accept-Encoding
content-length: 1909
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Sep 2019 14:07:16 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d8cc614-13d0"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 07 Oct 2019 08:13:35 GMT

GET
H2 200 load-more-34f6119ea4-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 5 KB
2 KB 10ms
10ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/load-more-34f6119ea4-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f1f493f2418d851d9c9d5a6522417b0faa8e54fc93255abe5939b309a6e1465e

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484169
status: 200
vary: Accept-Encoding
content-length: 1803
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Sep 2019 14:07:16 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d8cc614-12a2"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 05 Oct 2019 00:18:09 GMT

GET
H2 200 / Show response
www.zdnet.com/newsletter/xhr/widget-login/ 2 KB
2 KB 402ms
402ms XHR
application/json 2.18.233.143
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/newsletter/xhr/widget-login/?topic=

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a2-18-233-143.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

8ce77239e966b03cdcd393b20bd579a44f7b4085efce826baa31cffbbe0a736b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 734
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: no-referrer-when-downgrade
server: nginx
x-frame-options: SAMEORIGIN
date: Thu, 03 Oct 2019 14:47:40 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: bcd6fadd-50d4-4510-99f7-627423a6b6d9
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
expires: Thu, 03 Oct 2019 14:47:40 GMT

POST
H2 200 / Show response
www.zdnet.com/m3d0s1/xhr/horizontal/ 14 KB
3 KB 481ms
481ms XHR
application/json 2.18.233.143
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/m3d0s1/xhr/horizontal/

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a2-18-233-143.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

92851d419b3ff2176fc6b234b574419f65417ec283eb211459cf72b9d7fd8c0b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: cors
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 1802
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: no-referrer-when-downgrade
server: nginx
x-frame-options: SAMEORIGIN
date: Thu, 03 Oct 2019 14:47:40 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: 57ea8099-2321-488d-b67a-d146884f6eef
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
expires: Thu, 03 Oct 2019 14:47:40 GMT

GET
H2 200 / Show response
www.zdnet.com/components/tr-promo-asset/xhr/ 2 KB
2 KB 150ms
149ms XHR
application/json 2.18.233.143
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/components/tr-promo-asset/xhr/?topic=0

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1814-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a2-18-233-143.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

d83a8c6b3d955d3f4b2a6e9905c61cdb5fe5ffb760777936c8d4fd1101a37e0a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 665
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 03 Oct 2019 14:35:10 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Thu, 03 Oct 2019 14:47:40 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: 2c6461cb-3610-4308-9be9-6c5be2d72fc1
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=5400, private
accept-ranges: bytes
expires: Thu, 03 Oct 2019 16:05:10 GMT

GET
H2 200 load-more-1.0.js Show response
zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/ 8 KB
3 KB 6ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/load-more-1.0.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1814-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 160819
status: 200
vary: Accept-Encoding
content-length: 2472
x-xss-protection: 1; mode=block
last-modified: Tue, 01 Oct 2019 15:03:47 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d936ad3-1f51"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 08 Oct 2019 18:07:20 GMT

GET
H2 200 trp-promo-thumb.jpg
zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/core/ 4 KB
4 KB 6ms
6ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/core/trp-promo-thumb.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

41e1b82b530a565f139da63948d96402471dadea6e3e912578cc2de4426bbe41

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1238501
status: 200
vary: Accept-Encoding
content-length: 3552
x-xss-protection: 1; mode=block
last-modified: Wed, 18 Sep 2019 19:25:47 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5d8284bb-f53"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Sep 2019 06:45:23 GMT

GET
H2 200 vglnk.js Show response
cdn.viglink.com/api/ 78 KB
27 KB 23ms
23ms Script
text/javascript 2606:4700::6810:a20d
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.viglink.com/api/vglnk.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a20d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:40 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1452729
cf-ray: 51ffb66fcadfcbb4-VIE
status: 200
content-length: 27719
x-amz-id-2: HNEV4caKoOdziBrXGZIDp4CzG6boiBMb4TLu65nU6otYm4+p2OQwr1vWix1CX0FBodMy916W6w4=
last-modified: Mon, 16 Sep 2019 19:15:01 GMT
server: cloudflare
etag: "1545d811432c0074356408ee8f6c1e23"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: FB54A2C70C0BB866
cache-control: public, max-age=1800
accept-ranges: bytes
content-type: text/javascript
expires: Thu, 03 Oct 2019 15:17:40 GMT

GET
H2 200 0.4513616150436256
saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/ 43 B
206 B 31ms
30ms Image
image/gif 108.128.130.224
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/0.4513616150436256?AQB=1&ce=UTF%2D8&events=event66&v0=&v2=en&v3=desktop&v4=horizontal&v5=zdnet&v10=article&v20=this+huge+android+trojan+malware+campaign+was+discovered+after+the+gang+behind+it+made+basic+security+mistakes&v22=content_article&v23=&v24=eaa95f35-b837-473b-90a5-6449462fcf2d&v30=1b0217ac-3a72-470b-9289-742af80ceb70&v60=33166380,239620,384917,177603&v64=22149&v69=&c0=D%3Dv0&c2=D%3Dv2&c3=D%3Dv3&c4=D%3Dv4&c5=D%3Dv5&c10=D%3Dv10&c20=D%3Dv20&c22=D%3Dv22&c23=D%3Dv23&c24=D%3Dv24&c30=D%3Dv30&c60=D%3Dv60&c64=D%3Dv64&c69=D%3Dv69&pe=lnk_o&pev2=medusa_impression&vid=20191032-leadgen-zdnet&mid=90240133173074011141898988208131324462&aid=2D535D450507F28B-40000106A0001145&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.128.130.224 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-108-128-130-224.eu-west-1.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:40 GMT
x-content-type-options: nosniff
x-c: master-1021.Ic37195.M0-288
p3p: CP="This is not a P3P policy"
status: 200
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 04 Oct 2019 14:47:40 GMT
server: jag
xserver: anedge-5d695d76d8-vmcxw
etag: 2ECB050605158000-4011E824E0D10823
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 02 Oct 2019 14:47:40 GMT

GET
H/1.1 200
OK e.gif
dw.cbsi.com/levt/ria/ 43 B
369 B 150ms
149ms Image
image/gif 64.30.230.22
CBS Interactive Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dw.cbsi.com/levt/ria/e.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=1b0217ac-3a72-470b-9289-742af80ceb70&assettitle=this%20huge%20android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made%20basic%20security%20mistakes&assettype=content_article&pubdate=2019-10-03%2011%3A07%3A27&viewguid=eaa95f35-b837-473b-90a5-6449462fcf2d&devicetype=desktop&sitetype=responsive%20web&author=danny%20palmer&authorid=1aa87593-0f1d-4577-862b-a59b5ec9bc57&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&s8=cnetzdnetglobalsite&v23=cnetzdnetglobalsite&v19=article&v17=113c25b6-ec91-11e3-95d2-02911863765e&v20=1b0217ac-3a72-470b-9289-742af80ceb70&v16=eaa95f35-b837-473b-90a5-6449462fcf2d&riaevent=impression&comptyp=spot&mapp=medusa_app&objtyp=medusa&eventt=log&v18=security&comp=ucwc&ts=1570114060765&tcset=utf8&im=dsjs&title=This%20huge%20Android%20trojan%20malware%20campaign%20was%20discovered%20after%20the%20gang%20behind%20it%20made%20basic%20security%20mistakes%20%7C%20ZDNet&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%23ftag%3DRSSbaffb68%7C
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS: phx2-dw-cbsi-xw-ext-lb.cnet.com
Software: Apache/2.4.25 /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Oct 2019 14:47:40 GMT
Server: Apache/2.4.25
Vary: *
Content-Type: image/gif
Cache-Control: no-cache, must-revalidate, no-transform
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=80, max=852
Content-Length: 43
Expires: Fri, 23 Jan 1970 12:12:12 GMT

GET
H2 200 json Show response
trc.taboola.com/cbsinteractive-zdnet/trc/3/ 6 KB
3 KB 147ms
146ms Script
application/javascript 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/cbsinteractive-zdnet/trc/3/json?tim=16%3A47%3A40.802&lti=deflated&data=%7B%22id%22%3A35%2C%22ii%22%3A%22%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22vi%22%3A1570114053320%2C%22cv%22%3A%2220191002-10-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fa-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes%2F%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22cmps%22%3A3%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1585%2C%22dh%22%3A9307%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A4%2C%22uim%22%3A%22thumbnails-a%3Aabp%3D0%22%2C%22uip%22%3A%22ZDNETfront_doorDesktop%2FTablet-Bottom%20Page%20Thumbnails%22%2C%22orig_uip%22%3A%22ZDNETfront_doorDesktop%2FTablet-Bottom%20Page%20Thumbnails%22%2C%22cd%22%3A8457.53125%2C%22mw%22%3A770%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_2%22%2C%22lt%22%3A%22deflated%22%7D
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191002-10-RELEASE.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx /
Resource Hash: ed3bede4b71a926075a14c9769041645c51c3de5102b92b0b20de05bf60cd04c

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:40 GMT
content-encoding: gzip
server: nginx
x-timer: S1570114061.807110,VS0,VE140
status: 200
x-served-by: cache-hhn4066-HHN
vary: Accept-Encoding
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: *
access-control-allow-credentials: true
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
x-cache-hits: 0

POST
H2 204 available Show response
trc.taboola.com/cbsinteractive-zdnet/log/3/ 0
263 B 16ms
16ms XHR
image/gif 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/cbsinteractive-zdnet/log/3/available?tvi2=-2&route=AM%3AAM%3AV&lti=deflated
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191002-10-RELEASE.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Thu, 03 Oct 2019 14:47:40 GMT
via: 1.1 varnish
server: nginx
x-timer: S1570114061.975928,VS0,VE10
x-served-by: cache-hhn4066-HHN
status: 204
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
content-type: image/gif
x-cache-hits: 0

GET
H2 200 7ef448e56b3166c6c20f2a1c151e39c1.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 7 KB
8 KB 6ms
5ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/7ef448e56b3166c6c20f2a1c151e39c1.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 537ae23ad3e3d380ff52fd6073f4c4b0a204f5353ebdae2eb20521073ca29d97

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:40 GMT
via: 1.1 varnish, 1.1 varnish
age: 1337675
edge-cache-tag: 585886651351254468154948903926694772024,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Thu, 10 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/7ef448e56b3166c6c20f2a1c151e39c1.png
content-length: 7628
x-served-by: cache-hhn4029-HHN, cache-hhn4066-HHN
last-modified: Mon, 09 Sep 2019 10:35:38 GMT
server: cloudinary
x-timer: S1570114061.977936,VS0,VE0
etag: "9f9a883e2edb33a0e11ff67cde8a2380"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/05c672b8aa748b6cc9f544b15c9bb109.jpg
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191002-10-RELEASE.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 8d9e2d77a1628184056c06e30f86feded8f5f16f24c40a266b9479611f345a2b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:40 GMT
via: 1.1 varnish, 1.1 varnish
age: 2018156
edge-cache-tag: 465768806677159802898277598684303907690,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Fri, 20 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: HIT, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/05c672b8aa748b6cc9f544b15c9bb109.jpg
content-length: 14230
x-served-by: cache-hhn4044-HHN, cache-hhn4066-HHN
last-modified: Tue, 20 Aug 2019 19:09:57 GMT
server: cloudinary
x-timer: S1570114061.978023,VS0,VE0
etag: "b6b27a8822f7be1435a57f419570f9dc"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 1, 3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f4cc57ff8e5448fd74aa0bd36201615a.jpg
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191002-10-RELEASE.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 560615fa52f72d6eadecf1d05e714947965bed2c88e8d4ad6cd0d9f679932440

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:40 GMT
via: 1.1 varnish, 1.1 varnish
age: 1102700
edge-cache-tag: 324462488377992944272640379917953778861,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Mon, 23 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f4cc57ff8e5448fd74aa0bd36201615a.jpg
content-length: 11904
x-served-by: cache-hhn4078-HHN, cache-hhn4066-HHN
last-modified: Fri, 23 Aug 2019 01:11:19 GMT
server: cloudinary
x-timer: S1570114061.978393,VS0,VE0
etag: "d5327f6cb0b3bc61978e0e6d8a136122"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 4

GET
H2 200 184f40a89042083a88d6c2e12e53a479.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 22 KB
22 KB 6ms
6ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/184f40a89042083a88d6c2e12e53a479.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 35a03210019f4445f839b53ae46f70e28e8bfbfbb436b55cc8e8fdfd271896be

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:40 GMT
via: 1.1 varnish, 1.1 varnish
age: 1131414
edge-cache-tag: 599306192991471965979034689845158164246,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Mon, 21 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/184f40a89042083a88d6c2e12e53a479.jpg
content-length: 22190
x-served-by: cache-hhn4055-HHN, cache-hhn4066-HHN
last-modified: Fri, 20 Sep 2019 12:29:40 GMT
server: cloudinary
x-timer: S1570114061.978599,VS0,VE0
etag: "97532a55140f28e7884b06ff8a02f7a8"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 4

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/7ef448e56b3166c6c20f2a1c151e39c1.png
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 537ae23ad3e3d380ff52fd6073f4c4b0a204f5353ebdae2eb20521073ca29d97

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:40 GMT
via: 1.1 varnish, 1.1 varnish
age: 1337675
edge-cache-tag: 585886651351254468154948903926694772024,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Thu, 10 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/7ef448e56b3166c6c20f2a1c151e39c1.png
content-length: 7628
x-served-by: cache-hhn4029-HHN, cache-hhn4066-HHN
last-modified: Mon, 09 Sep 2019 10:35:38 GMT
server: cloudinary
x-timer: S1570114061.992093,VS0,VE0
etag: "9f9a883e2edb33a0e11ff67cde8a2380"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 9

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/05c672b8aa748b6cc9f544b15c9bb109.jpg
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 8d9e2d77a1628184056c06e30f86feded8f5f16f24c40a266b9479611f345a2b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:40 GMT
via: 1.1 varnish, 1.1 varnish
age: 2018156
edge-cache-tag: 465768806677159802898277598684303907690,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Fri, 20 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: HIT, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/05c672b8aa748b6cc9f544b15c9bb109.jpg
content-length: 14230
x-served-by: cache-hhn4044-HHN, cache-hhn4066-HHN
last-modified: Tue, 20 Aug 2019 19:09:57 GMT
server: cloudinary
x-timer: S1570114061.992354,VS0,VE0
etag: "b6b27a8822f7be1435a57f419570f9dc"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 1, 4

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f4cc57ff8e5448fd74aa0bd36201615a.jpg
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 560615fa52f72d6eadecf1d05e714947965bed2c88e8d4ad6cd0d9f679932440

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:40 GMT
via: 1.1 varnish, 1.1 varnish
age: 1102700
edge-cache-tag: 324462488377992944272640379917953778861,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Mon, 23 Sep 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f4cc57ff8e5448fd74aa0bd36201615a.jpg
content-length: 11904
x-served-by: cache-hhn4078-HHN, cache-hhn4066-HHN
last-modified: Fri, 23 Aug 2019 01:11:19 GMT
server: cloudinary
x-timer: S1570114061.992348,VS0,VE0
etag: "d5327f6cb0b3bc61978e0e6d8a136122"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 5

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/184f40a89042083a88d6c2e12e53a479.jpg
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 35a03210019f4445f839b53ae46f70e28e8bfbfbb436b55cc8e8fdfd271896be

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 03 Oct 2019 14:47:40 GMT
via: 1.1 varnish, 1.1 varnish
age: 1131414
edge-cache-tag: 599306192991471965979034689845158164246,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Mon, 21 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/184f40a89042083a88d6c2e12e53a479.jpg
content-length: 22190
x-served-by: cache-hhn4055-HHN, cache-hhn4066-HHN
last-modified: Fri, 20 Sep 2019 12:29:40 GMT
server: cloudinary
x-timer: S1570114061.992607,VS0,VE0
etag: "97532a55140f28e7884b06ff8a02f7a8"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 5

Verdicts & Comments Add Verdict or Comment

332 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.demdex.net/	1970-01-19 08:27:46	Name: demdex Value: 53382507390233673202233730399316405255
.zdnet.com/	1970-01-19 04:18:38	Name: RT Value: "sl=1&ss=1570114048240&tt=1652&obo=0&bcn=%2F%2F686eb51a.akstat.io%2F&sh=1570114049896%3D1%3A0%3A1652&dm=zdnet.com&si=a4991800-e3ef-4faa-abe0-eb9fbc4b2b43&ld=1570114049896"
.zdnet.com/	1970-01-19 12:54:10	Name: utag_main Value: _sn:1$_ss:0$_st:1570115849876$ses_id:1570114048977%3Bexp-session$_pn:1%3Bexp-session$linktag:undefined%3Bexp-session

89 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service pending (GDPR consent not granted): script_indexexchange
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service pending (GDPR consent not granted): script_mpulse
console-api	log	URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js(Line 522) Message: dom not ready, setting event
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service pending (GDPR consent not granted): script_sourcepoint
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service pending (GDPR consent not granted): script_gpt
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 757) Message: ADS: queuing nav-ad-5d960148a8346 for display
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 1227) Message: ADS: queuing intromercial-5d960148a8346 for display
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 1293) Message: ADS: queuing leader-plus-top-5d960148a8346 for display
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 1450) Message: ADS: queuing inpage-video-top-5d960148a8346 for display
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 1460) Message: ADS: queuing sharethrough-top-5d960148a8346 for display
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 1575) Message: ADS: queuing mpu-plus-top-5d960148a8346 for display
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 1679) Message: ADS: queuing dynamic-showcase-top-5d960148a8346 for display
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 1686) Message: ADS: queuing mpu-middle-5d960148a8346 for display
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 1946) Message: ADS: queuing mpu-bottom-5d960148a8346 for display
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 1964) Message: ADS: queuing leader-plus-bottom-5d960148a8346 for display
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service pending (GDPR consent not granted): script_sharethrough
console-api	log	URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js(Line 524) Message: dom ready, triggering load
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: GDPR consent granted
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent finally granted): script_indexexchange
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent finally granted): script_mpulse
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent finally granted): script_sourcepoint
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent finally granted): script_gpt
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent finally granted): script_sharethrough
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 9) Message: Missing adCookieData!
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92) Message: zdnet
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_mpulse
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): _injectQueryStringGCP
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_chartbeat_video
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_ad
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804(Line 177) Message: Service: sitecatalyst
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92) Message: zdnet
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_sharebar
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_video
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_sharebar
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_urban_airship
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_disqus_count
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_disqus_count
console-api	warning	URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js(Line 9) Message: VideoManager.initialize() did not receive a valid error callback function.
console-api	log	URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js(Line 9) Message: UVPJS 0.42.297 02/01/19 10:20:35 AM (PST)
console-api	log	URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js(Line 9) Message: [MUX] _initializePlugin
console-api	warning	URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js(Line 8) Message: mPulse: Custom Timer 'video_ploaded' is not defined
console-api	log	(Line 61) Message: blank creative loaded: 138239360681 (7 x 7, pos=nav)
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 164) Message: Dynamic Showcase Center container ::: creative id = 138247024569
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 6) Message: ********** register GGCMB
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 6) Message: ********** init GGCMB
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 6) Message: ********** register GLCFG
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 6) Message: ********** init GLCFG
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 7) Message: ********** register PLSTM
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 7) Message: ********** init PLSTM
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 7) Message: ********** register PLVBL
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 7) Message: ********** init PLVBL
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 8) Message: ********** register PLSIVT
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 8) Message: ********** init PLSIVT
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 8) Message: ********** register PLDPR
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 10) Message: ********** init PLDPR
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 10) Message: ********** register PLDCR
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 10) Message: ********** init PLDCR
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 10) Message: ********** init PLDPR
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 10) Message: ********** init PLDCR
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 7) Message: ********** init PLVBL
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 8) Message: ********** init PLSIVT
console-api	log	URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js(Line 7) Message: ********** init PLSTM
console-api	log	URL: https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js(Line 15) Message: getPageCorrelator undefined
console-api	log	URL: https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js(Line 15) Message: getPageCorrelator undefined
console-api	log	URL: https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js(Line 15) Message: getPageCorrelator undefined
console-api	log	URL: https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js(Line 15) Message: getPageCorrelator undefined
console-api	log	(Line 61) Message: blank creative loaded: 138239375540 (372 x 142, pos=)
console-api	log	(Line 61) Message: blank creative loaded: 138239479696 (372 x 142, pos=)
console-api	log	URL: https://pagead2.googlesyndication.com/pagead/js/r20190926/r20190131/show_ads_impl.js(Line 15) Message: getPageCorrelator undefined
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_taboola
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_async_load
console-api	log	(Line 61) Message: blank creative loaded: 138239344481 (11 x 11, pos=top)
console-api	log	(Line 61) Message: blank creative loaded: 138239368367 (641 x 321, pos=top)
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92) Message: zdnet
console-api	log	URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js(Line 28) Message: [16:47:32 GMT+0200 (Central European Summer Time).876] [ERROR] [MediaHeartbeat] API call trackPlay is unsupported in the current state.
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_taboola
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_async_load
console-api	log	URL: https://www.zdnet.com/article/a-huge-android-trojan-malware-campaign-was-discovered-after-the-gang-behind-it-made-basic-security-mistakes/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92) Message: zdnet

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0211c812.akstat.io
686eb51a.akstat.io
ad.doubleclick.net
ad.yieldmanager.com
ads.rubiconproject.com
adservice.google.com
adservice.google.de
api.viglink.com
api1.lightboxcdn.com
as-sec.casalemedia.com
beacon-eu2.rubiconproject.com
beacon.tru.am
c.evidon.com
c.go-mpulse.net
cbsadsales-a.akamaihd.net
cbsdfp5832910442.s.moatpixel.com
cbsi.demdex.net
cbsinteractive.hb.omtrdc.net
cdn-gl.imrworldwide.com
cdn-magiclinks.trackonomics.net
cdn.jsdelivr.net
cdn.taboola.com
cdn.viglink.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
csi.gstatic.com
dpm.demdex.net
dw.cbsi.com
eus.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
geo.moatads.com
googleads.g.doubleclick.net
idsync.rlcdn.com
iicbsi-a.akamaihd.net
images.taboola.com
imasdk.googleapis.com
in.ml314.com
inqlnfvog763mmf771rou737u.litix.io
js-sec.indexww.com
l.betrad.com
lightboxapi2.azurewebsites.net
match.adsrvr.org
ml314.com
native.sharethrough.com
optimized-by.rubiconproject.com
pagead2.googlesyndication.com
ping.chartbeat.net
pixel.everesttech.net
pixel.mathtag.com
ps.eyeota.net
px.moatads.com
rev.cbsi.com
s.update.rubiconproject.com
s0.2mdn.net
saa.cbsi.com
sb.scorecardresearch.com
secure-us.imrworldwide.com
secure.adnxs.com
securepubads.g.doubleclick.net
static.chartbeat.com
sync.crwdcntrl.net
tags.bluekai.com
tags.tiqcdn.com
techrepublicmedia.akamaized.net
tpc.googlesyndication.com
trc.taboola.com
tru.am
urs.zdnet.com
vidtech.cbsinteractive.com
web-sdk.urbanairship.com
widget.perfectmarket.com
www.everestjs.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagservices.com
www.lightboxcdn.com
www.summerhamster.com
www.zdnet.com
z.moatads.com
zdnet-1.disqus.com
zdnet1.cbsistatic.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
zdnet4.cbsistatic.com
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
104.111.214.229
104.111.241.32
104.17.209.240
107.23.115.104
108.128.130.224
13.224.196.129
151.101.112.134
151.101.113.181
151.101.114.2
151.101.14.133
152.199.23.241
172.217.16.162
172.217.18.98
18.130.64.138
18.197.149.199
18.200.54.67
18.203.131.207
2.16.186.72
2.16.186.88
2.16.31.65
2.18.233.143
2.18.233.201
2.18.234.21
2.18.235.40
216.58.205.230
23.0.46.190
23.37.55.184
23.99.128.52
2600:9000:20eb:b400:2:42d9:3100:93a1
2600:9000:2156:3000:18:1fcd:349:ca21
2600:9000:21f3:1000:1d:8c8c:47c0:93a1
2606:4700:20::6819:a322
2606:4700::6810:4fa5
2606:4700::6810:a20d
2a00:1288:110:c305::9000
2a00:1450:4001:800::2004
2a00:1450:4001:806::2003
2a00:1450:4001:80b::200e
2a00:1450:4001:815::2002
2a00:1450:4001:817::200a
2a00:1450:4001:818::2006
2a00:1450:4001:81a::2002
2a00:1450:4001:81c::2003
2a00:1450:4001:81f::2001
2a00:1450:4013:c03::5e
2a01:4a0:1338:28::c38a:ff18
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a04:4e42:1b::444
2a04:4e42:3::444
2a04:4e42:3::621
34.205.11.82
34.224.154.10
34.248.158.173
35.157.160.140
35.190.38.167
35.190.72.21
35.227.208.151
37.252.173.62
52.30.7.139
52.31.175.110
52.44.237.33
52.49.22.89
52.5.99.108
63.32.199.154
64.30.230.22
66.117.28.68
66.117.28.86
69.173.144.140
69.173.144.155
95.100.75.247
99.80.15.126
0025565f0cddfceb7ebdbc4b21d2552c894998e443153f97a6e8b353dfd9bebd
01b51130a9571ae465e70d2b7784d21610124932ead2cedaa2db0fd7ffc523b4
02f3b82bf48c364a56b75c12695031ce9fa6dbc0e39af44b677d65bab6fe90fd
03542957b7a5b6ff3e91d8df4dbfc3443568867cefc7b1bd7716ce324e83f9be
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0532a453613b2794bb06248e47c054774e515c65f524ec50f56bf06c6239721d
06378c6af4fed039d3d4c6e53aa51d0925d9c5b2a048ab3788ed5f93c41ff07f
07178558c596bc2fe33d99750a349d5413fa4571fc778cefbe4f4f367404f6d6
07b69027231d985f5bdcd4d5a539f120d26003feef6e9dc0a6b77a4b43a9b21f
081873caa83744b6d819ab294b08927e20b60841dd8f23a87c2a57e15f65591c
0ae0a49658a5d18b0d8022e298d55737fd40b5e0938fdd4a1e5de865543d9de2
0b9028c7ecccf4f31fafcfca176cd6ed38197d7b3d6ea4c107b98af8eecc525b
0bfe19716cf9c9ba0b1343bf813585bf7970dd9b3ad96d82c88874b28130edbf
0cae80c9382e2b3e8045ba09797fd66d1a65a936d70af2eed09897be81ea436e
0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017
0e4e46fa1aa04c24e793912d7aabaa2f2b0f7dc03d73cf74fbe12cb84f062554
0ed08b2eb6ca91d95304d2c126a6482fe12c541132516e95b0f30c93ab3beeea
0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d
0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae
10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d
10278e03a87d6b560b103fb65f04512603133e1bdfe880c9877860f8b82c1d2e
103eedd2ed4e48c35d657dd30200931da56794a89a93fd450fc54556720654b6
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
14d88b3a27f0e6de034f86ad42d6411081e9467daf754147f2f16bcb20782177
15102dc05e413115725f527ef7a26007562147b84910f3aa2b589d4ca52b114d
161d84b55a75c00b27b3dd85f6a2b8ec6faf97da4779e6bb2f6b9b7924b1ca2c
16579b3be4b9ff233cf69e36de77806864cbac2f7a9a38c260cd6bab1533a4e3
165e8df930ccd26b9ea1e73cebe5d93b5875176e4eb0a67b4da6417782cce5ba
1722a27cadd97e2f3f990df7a2dc01965a8eb41fdad860be096ad984dfecec7e
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c
18c80b69f54f5ecec1c56c3d0487d30d253b89afac6238fba5421b873d2bfe20
192a41b3a2ef7d13301354b3131babb5890472f61ebf9dbff4b461903ec719c6
1996fb8b37fe4cf668c07fcdf89eedf167a0467acadbd5d177c078585232c745
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9
1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1
1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53
1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b
1ee9ba8184faa49e8e854d1e197e6412b1036d36e7823d94c1ba828534914246
22e9fd274625cd03626f2779689569cddfcbf85aaf30740fb00c0dce25705193
2396ae574bcae1b010e4624dfcf1f3eb7789701edbf9cfe3affb223b4b70ace6
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
2513ba7a560574328b8cd642df510e26fe2b1a978b88d84e4f4b2a979bf4cc55
263b5d559df316e9b1b39680d4bd08e02c7d0ed695e4499536b7a09a2c19793d
2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff
2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab
2c1c4ca8a45d8978ba1b8be7aa9a60018ce4c2e4a2bf5a1cb80f043d4418e6eb
2d3e9015bb665cc4e62a0aada26a74311bf87ba40e12b896724f447a98e68a89
2e898a76df3a30aea7677eebcacab3ccbc9c03d2f655d04f853cfc429bad13b1
2f179c0918ddb8af28b17040e1822625ffa2635a08e4fa98521d0a95dc9a554b
2f528c7545091cd56a7605b14531a2ac0fa48b87b09c9c826ecf520d43b33524
309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6
3147026ff99804131affcb3cadbdfd49c0a07583682aefcc1198f57e2614d5b0
3487767fc72b5c9653ccb95a5662386c06ea137d901918c4a33ae55363d71b44
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
35a03210019f4445f839b53ae46f70e28e8bfbfbb436b55cc8e8fdfd271896be
35aefd2d1de0b25d9a5640cf3129dfc507a3c417a7da34f4bb6f9b4a79e19484
35c073a53df4dd054afab9758b90a88846802754ff15fc3b31cc9af133c8a401
35f3de772fc88b09b9f866de6d38f50d8716aecc446bb10456585f61834ae2c8
3624e97a6a4f6fb481369929e579039d00be03b0a2e5d1f5f961c44dfd98940c
390a28be2ca4bcea5b71fe050295281a1a8fc99175690cdd62de378190400acb
39f0e13a96fd029965b5b5fd3504853b6fe6ded07b4dd8862a0e033be626e655
3a3614a42534b29d568b64422700905b31ec791ef05f6a2aafb88ed1503c2007
3c9bb3631896aee1e930e140eb8fcbb4ad9cd9b96ec259b88b4b2fce0a55e805
3d5f6fa3e5acb251b5c5f3ab93c17237961d8dfcd1a5ea1265f1334e448dbf5e
3e7a5752fbc5eb7571f53132a305024cab6825bfaed3677a70c906b1ac47feb9
3eb8469a360e8872f26eac9dfc6c82a92bc36db2b0a9d6acdfde44efc4d10c01
3fe62dc6820ac4d4bd4bd0f7d28471fde967492b7cc3308ced0a195bdd37a9a3
3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22
41e1b82b530a565f139da63948d96402471dadea6e3e912578cc2de4426bbe41
41e2e99eafec37716ecb18633a26d71af745835ad862829e03a9c9d93fbfe518
420203ca7b0395ca062903c765b681e27062360484f8274a389461e4a4a071d6
43095cdd48698241d8b986d242496f785256fea03bdac2b1fa1e00321d536a9f
4974c54f5183f50fd1f3c3d49c496fd79602f8159b6d393d3fab09e4433555dd
4addcc6efa05d9d64766cfa58615e5f940455ca87b002340215c51ce5752352b
4bb0f33f40b38593e1cba1c8b2f15703d33753bbd80f30511dd9c464a959afe7
4d565f67641c732365c3180ec1e37c7a987825faad3e8632de8a07a9101feedd
4f37d9296cff8e33f3f254dca36386d60a0ef9b840196b263158f714c5371665
4f6a9ffb0b1f3aa3ef2bd4a9c137964c8315cf99c4eccee10798770067d449d0
4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13
4ff5a40256550a6f0d72038d0ec04c7719f348def3332a07ca50f91241985703
537ae23ad3e3d380ff52fd6073f4c4b0a204f5353ebdae2eb20521073ca29d97
53e7271ea612799bbe25590852879c43de518e88870169f2cc98220169787ef0
5574db931bbea790fb2c4188f4bc676c15b2464676b38ff8c0021358247b4084
560615fa52f72d6eadecf1d05e714947965bed2c88e8d4ad6cd0d9f679932440
5745383487c3952eea3e1897ef015b91ccd0b30b7400770b5c9000a9000225f9
577ef24f902f92dbb6b5c2a62c1b6b591415e8adad0773946af0d78b08907c9f
57e1e8e64fe95a0acc0822d690633b9450b26919fcedc32958ebcf7d39393181
585e68b616dc09fd14c7306595146b58e4f7178bd6d9397ccdb06035dcc90e6c
58c3593e62aeda27dc92790ddb33fd7ff8cfb0f7a9c154bc9ebad50afc2dd764
59261cdd3b53d64db22f1d9d4861cc28bca4faa6973bfd1d3e7dcc399514e7d4
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5ae3f698a2993e6c115f57c600b5b025776902c6796a85b8b2bbc754706a87b7
5b9f8d91fd1ac54f80ad47c1cb12cda6a08c30220a25b9a0b16a44e76ba68f97
5cb6c790a9135464a9b54bde7faa4129632bc03ecde0427374e447a77238cfb6
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3
5ecc6a93ec2939faa8dbf80084346c7d940f5a2181ee69343810da52902eb92d
5f224a13a15499778526423761125cbae8b8063bf0f90a46862671e17ccc9e7b
6227f18e898e5b7c708fc1eb1763bd1b2186bdecd6f8b81f4bc1bf84f4d7d4e6
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
637f61a5ad1c39b23ca94f3eaad479d3dcf7f3c721bcfe1670f000c7c45a5427
64cfd2a647408273e2609b638b29d1f10370824f0169ee4db637edac660dfb66
66ef1b7581d8ef7b82bfe2ca363a612a479d89b808e2241f68d3e8c75f4f06d4
67b52db6ed5b65b65fe31e571ea2fb05a59a32d890de15782f1a3166391a31ad
6847254cd547693a3f979c0ab7b824fc90b0054250790e33f64930de87c2c615
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
69a516dd1e5351070256dbb2eef13f0979338847151f250bb1032948aa8ee747
6ad7a1cd240e11691e154cbcb0a4cda0ab8e41fe9ff63bddd797883c3291b596
6c849673497b1b5c33c9a09e812aa0da912bc3564c30c1585ae151aa995e4e76
6de73873dd441f953668e77030299f082e0f3e6335bf944d88d44978162e6609
735dd6528ef8dd97886865a6ff4a0387d6cebab544c6288c8ba2169b1858c392
755c9ddf4b6ab524af31de451f3eeec2aa094beaa56416f61e12f3639612f90b
763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd
77682498c3ae319a10c59528b8e39180f6e08e6d5be63ef79b54cf21b8a6ec47
791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac
7e2d4be3aa4af820adeff7929ee539740102bd2619e4c5a546299c649e994c56
7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082
7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8
81ac79011df184d5e4b8dd0c5849f098ae0c2f9a5bc7a498d97628b40a308a1b
82f5d9f304ef1bc2703af96751d1a0df640e61764047af253696e67adb388b70
831d19d3c80ca082ccf9394743c71280aa5a2b7c40b8176382eb1ce20ad06ae7
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
835c5d5c553cbc118d7eea393ad44c36cafa97921317cf77292dacb1c7f88687
8712d548c2bf72289213c2eca9bcdd1e94c766bf9cf4653c422e91e07882f310
875bc944393483ad8a1a517bd4a0cc131dc62212bbdc93d8ec141d43131ba847
885fb8b9c3d2738bd627def3899f26d4d42641bbb868cc99d1fbc16f0ed9f4c6
88762480fb084c0725cf9c3abde10e540ebf64884fd50a86789b5eb661c38cdd
8998e68f9bb1686ca1e03fcf3f0d6ea669c32d1f3554aeea809f1b1824ff6625
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8a7103c2d1731c8453becf879304b1bfc7c176d6e296f0dd716a34c888c0c066
8c556813deb0bd2ee2613cf1dc08d4744b1aab6755f593f951e892a51c516845
8ce77239e966b03cdcd393b20bd579a44f7b4085efce826baa31cffbbe0a736b
8d9e2d77a1628184056c06e30f86feded8f5f16f24c40a266b9479611f345a2b
8e969090426570dfb96cc14e3e0bd3a52f04198469db46956b0350e7de31f70c
91ff35b28c317d4e9e5ddd2831e945ae5c867f5d6c0c7e04e6993011d02f6d77
9283c9192d43d20701bbb3e6877fe0213dd3d24da4e725e750d55f36f329fb6e
92851d419b3ff2176fc6b234b574419f65417ec283eb211459cf72b9d7fd8c0b
9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b
9342819f93f32a4dbb6f2d36222c9e768100640e1465450707bddcd5a8617211
942c3f203c18c030a2bb5296b46e77390e31e8d74f8c6058435b37bb5efa68cc
95afa5dd49afcfca5657bbb020523f5d9a5c8dd6723f49a3b5f34e46619f6a96
95ec4dea002be118a633dc5070c23358d10e179ad3de44f23ac97578c6971df7
99ee25a9f167f0de6f763814bccbd6f46d6de72ce93af8a319dab16fbf4e4571
9af9801de1b09aeecde53cd208449ab6dd1ee253ef070fddebb8b2b0a43bdf2d
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
9d0c671fae9b03bb7a65a1af38eac21192533c84c6402fae92cc2ef353bc70bc
9db8bd3e641dc88d54edf476a148e75e29b4e8ccd040cb340404d557578dcfbd
9f1b79d3e2a4d8a5c2c199991dd454f2dbba21ac76cbae03cddaefeb7caa85a6
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0846357a84bde9d83f32eff7da4622cda6456ff21ae9900628da7b9fafd398d
a1974a650dc2ae6fbadd2fe23f0af78c38de9674a5b2c343529befd77e6fc3a8
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a7708a738c64bd02df7ae231ab503159ab3336fa03de1853675631309ec07ada
aa46af37e4eb7cfb817074ce31d43620cf1414e04997f54e1c058fee68476005
acf3b5b3ade1391096f23120b725a032dce430448ba8aff2a6f0c3f9c598b2a3
ad7ed17bf4c8d9dd2511e7254670822d0f90c8fb89187f860cfbcb91821abc84
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b
b2ab8784d5ca4bc5e4e1990ba55c6d9f041b8fe8cf41ad9afa37bc1c3dd12756
b442294d74475ff92ff4f3669b4bed28c615e6196f5bfd8de33b1e7445c15bef
b4e9e9bef19c34422f55a7fdb9d10c4db5e39cff24b8c98a0be0e09b2ee6ac2b
b583dc0c3a23a12be525b041d586f6263f044673f9002101ff510fd6a42adf6f
b5bd040e94c4a87a1efe3d50ad481d5409fcf52d351fc070577299f2b9132d6b
b8c15c61feffdfe68b168cf2ac8cf58867f38547da3b15d7971a75c44f16bc26
b9d6fddb0988440902fcfc72f371ecfa80ee2eb36073f9eebc17449ee41c886f
bf069cddda8cd2b6740b460e576c56eaa88cc2e939d8d764b99fa4b87f26ffad
bf655fd1f2f66d50693282dd406bc60b585260db094c708f218b18ba2576de46
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
c2d45daf8967c871c5184f9fcf5f6b11ee9cfd5725b69806511112711b135d9d
c4b9d4f37ea05b9943096f4a439cf92343c43ffcf2368b8ebb9f4d6eccf47ca4
c6078d11c51e0bd1cf708d526df397c041d0c240d18b05b71a8b0e294c713d54
c649aaa88ce29f86caa50dc08e1745c9783e049656ff2d5a93ef813b7f0c662a
c70c7e618c549d422a49565742087872e453e74e0f43f06687eae8f5ba7d0f52
c79411685a096da27cca4df859f6ea32bda063e14d51e956b93a8da598e7d102
c8615d41121675d739ad8a05627ccfd2c6b99c576521ff17a2313f79a37fa6cc
c872580af551ba7c07a453c4a0b45a1ca614e3246afe7fc08f7bf2c7de4bd0b6
caab9bbec165591d5214448b624dae44a3cbc575721ba71da2f7130bbbcbc6dc
cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562
ce8562164c992f51fa43a7a9ba79612bed137fc4160c5262809342c36e65098a
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d0fd74148f4cbe78bd0e6328dc5ce5955f0a0ecdb1eb2919da4a7e596ac65912
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41
d44c1c3b519cd0b390eb41352d8f3e522e4ed7eac8bc5cf475638985a9c4af16
d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c
d696da403b0169c2191d0ec0b0fcdaa85487b21b19fd58f4b1fb5b9edf40b153
d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e
d83a8c6b3d955d3f4b2a6e9905c61cdb5fe5ffb760777936c8d4fd1101a37e0a
da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016
dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff
dba93ce15d94f490a3e2c7ef4adf1b5f8350917dc4d9b9051097e0e54c34b064
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dc758384fb85e15446a3272eee0ae16ed55c58ad320279b86e5183af0fcdbaba
dd787044f07fb551657e198707ea27bfddcf6cf53bd6e8bf5efd6322a5273cba
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb
dff4eb735fd3d80c028700698284f23d640934c14f8f0c2999b226c25095b7ba
e08209b44a15fd9f6b9977d2580034e8d3da36542235802c2722ff8db4c0a461
e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f
e39edf5f193e5ae765b8b0274a1583ec1e0b587f28ef554e1b95f4d69e93d333
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3c8c5266002e44c9001cf7a9dff6ae0957769e7b45122b4abe63f9311c90de9
e41f9d0fb2d51a0375967a0ef23dac71eabde665b7ad3af7cf65e2f5f0cb784a
e442e838711752b98d785df50ad6f7765504bc9e49d742b329f93595fd3749ca
e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e59c8c655db8c097ed0067789aeb44ed58f25f8c68a5772bbb3f1fdc18e5e336
e667d66fe244bfe8c171933025895da11478b613f04f0e11fed881119f7d0382
e812da2f13362e348f887e6eb8361bc247f6d043588aa436df4c64e4bd04e7f7
e85ba4d66717e8de5dcba1b5e0285ced20874b84f316ff3c0840277352b9c9ea
e8f4e59d72798de9c04d8e937b812a2cf159ab547c42fdd10cefcfb7642db8a9
eb07b53d262575cef96004e2be725ac235db39262e9bb8466a2a9b85cf532aa8
ed3bede4b71a926075a14c9769041645c51c3de5102b92b0b20de05bf60cd04c
ed7f448873eab8e03fbe308acf43d9bb0cc12fe665907b37bc3a71c7decf3af7
ede50408d9975eb59f99b6525984e2c1cf091977e1bbc37d49a1aee6e75bcc90
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0c8ad030a90f1ee3cdcd5910587eab25da7bb0ec6f942d979bba4d506b38380
f125abd5576ca817044dc1470c8b5e03a4ccd488e45f78c82d57b370a1b26f1f
f163a85a9d1611ade0544382ac55f9cd6febda4697a8cdfa72a56a332b1563b9
f1f493f2418d851d9c9d5a6522417b0faa8e54fc93255abe5939b309a6e1465e
f310fe51f00fc62052f6683ce59c40b4b90e09e0972c211db2be3cbd09fb6dda
f31aa040b6c5d23d9150f643a70d82b3bf70d33b097507dfae18e2b60e62b3ac
f376ec816553a1689505887acf667a213907fa9c9a3086cf1c4d49b9ce85886e
f4a55016f0aed60d4dfb0b5a4e33f19506ee81676255d4c44cf59c5723ae599f
f56e4fd9d58980747b23b3b61ec1c1094300e15fd95e043cd3c6301b64e89ca6
f5b52ad70c5d645388b52d2fadaf8a5311aee9a01436866ab9b3e2c5f02e1c22
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9
f68ec7cf550e86cb14e4d992724157c4f625ea3f0cd7d06e9e533c17c735401d
f831384a4eb77209b6aaa10c474bd5566952144113832922148e329cf5e2be70
f92514f4e39c16da9037f964148a09a79419744b77d611860ffc81c86aeace0a
f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee
f9784f57729f84391b084eed9e944e048f771129d65e9b58f34095fdfba86473
fa33d1db535d783b0baf4e74bdc7ce9e54633f87a03669b2803e567088d64ccb
fcfe0abaa04e858e1aade99a0cfa8090279713543a220e30e4b87ffc15c3f8ad
fd6a47c60a4311aba61b1ac66c31cc158743955642d4739066358cbb0b6cf6f8
fe074214a9c301f8c3ba319d4bab7cba8d65164dcc2077272a9cacedf8941ae2
fe1a137b7f1482e8ee5bcfd4774abb7d34398f060b90d647d7e95c3be995330a
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097
ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5

www.zdnet.com Open in urlscan Pro 2.18.233.143 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

442 Requests

100 %HTTPS

32 %IPv6

59 Domains

90 Subdomains

66 IPs

6 Countries

20830 kBTransfer

32421 kBSize

3 Cookies

45 Outgoing links

Redirected requests

442 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 12 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.zdnet.com Open in urlscan Pro
2.18.233.143 Public Scan

Screenshot
Live screenshot

Full Image

442
Requests

100 %
HTTPS

32 %
IPv6

59
Domains

90
Subdomains

66
IPs

6
Countries

20830 kB
Transfer

32421 kB
Size

3
Cookies

442 HTTP transactions
12 data transactions