URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Submission: On March 24 via api from US

Summary

This website contacted 49 IPs in 8 countries across 35 domains to perform 235 HTTP transactions. The main IP is 104.20.60.209, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.bleepingcomputer.com.
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on May 12th 2018. Valid for: 2 years.
This is the only time www.bleepingcomputer.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
43 104.20.60.209 13335 (CLOUDFLAR...)
4 104.26.13.6 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 151.101.12.193 54113 (FASTLY)
4 2a00:1450:400... 15169 (GOOGLE)
4 151.139.128.10 20446 (HIGHWINDS3)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
1 212.71.236.117 63949 (LINODE-AP...)
2 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:205... 16509 (AMAZON-02)
1 172.217.18.166 15169 (GOOGLE)
2 2a03:2880:f01... 32934 (FACEBOOK)
3 35.188.71.214 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 143.204.178.2 16509 (AMAZON-02)
1 3 35.190.59.101 15169 (GOOGLE)
2 35.201.67.47 15169 (GOOGLE)
2 2600:9000:214... 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
8 172.217.16.194 15169 (GOOGLE)
2 2a03:2880:f11... 32934 (FACEBOOK)
1 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:214... 16509 (AMAZON-02)
6 99.86.0.120 16509 (AMAZON-02)
3 151.101.13.194 54113 (FASTLY)
1 35.190.40.172 15169 (GOOGLE)
2 99.86.3.44 16509 (AMAZON-02)
1 143.204.201.21 16509 (AMAZON-02)
2 2 52.19.221.77 16509 (AMAZON-02)
2 2 18.202.137.180 16509 (AMAZON-02)
7 35.226.36.58 15169 (GOOGLE)
1 99.86.3.23 16509 (AMAZON-02)
1 52.2.175.122 14618 (AMAZON-AES)
2 2 147.75.102.200 54825 (PACKET)
1 195.181.175.55 60068 (CDN77)
4 2a02:fa8:8806... 41041 (VCLK-EU-)
10 54.93.119.217 16509 (AMAZON-02)
8 185.33.223.200 29990 (ASN-APPNEX)
6 69.173.144.140 26667 (RUBICONPR...)
4 35.157.40.44 16509 (AMAZON-02)
19 51 152.199.21.89 15133 (EDGECAST)
4 12 34.95.120.147 15169 (GOOGLE)
4 95.101.185.51 20940 (AKAMAI-ASN1)
8 104.16.68.69 13335 (CLOUDFLAR...)
18 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
4 8 35.157.108.20 16509 (AMAZON-02)
4 95.101.184.231 20940 (AKAMAI-ASN1)
1 23.8.15.54 20940 (AKAMAI-ASN1)
235 49
Apex Domain
Subdomains
Transfer
51 advertising.com
adserver-us.adtech.advertising.com
14 KB
43 bleepingcomputer.com
www.bleepingcomputer.com
164 KB
14 googlesyndication.com
tpc.googlesyndication.com
pagead2.googlesyndication.com
39 KB
12 openx.net
freestar-d.openx.net
eu-u.openx.net
2 KB
12 3lift.com
tlx.3lift.com
eb2.3lift.com
3 KB
12 adnxs.com
ib.adnxs.com
acdn.adnxs.com
10 KB
12 pub.network
a.pub.network
d.pub.network
c.pub.network
229 KB
11 skimresources.com
s.skimresources.com
r.skimresources.com
t.skimresources.com
p.skimresources.com
x.skimresources.com
20 KB
10 sharethrough.com
btlr.sharethrough.com
1 KB
9 doubleclick.net
ad.doubleclick.net
securepubads.g.doubleclick.net
117 KB
8 districtm.io
dmx.districtm.io
cdn.districtm.io
491 B
7 ampproject.org
cdn.ampproject.org
166 KB
7 rubiconproject.com
fastlane.rubiconproject.com
eus.rubiconproject.com
10 KB
7 consensu.org
quantcast.mgr.consensu.org
static.quantcast.mgr.consensu.org
vendorlist.consensu.org
api.skimlinks.mgr.consensu.org
api.quantcast.mgr.consensu.org
audit.quantcast.mgr.consensu.org
141 KB
6 amazon-adsystem.com
c.amazon-adsystem.com
30 KB
6 google.com
apis.google.com
adservice.google.com
accounts.google.com
101 KB
4 casalemedia.com
as-sec.casalemedia.com
4 KB
4 dotomi.com
web.hb.ad.cpe.dotomi.com
2 KB
4 bleepstatic.com
www.bleepstatic.com
8 KB
3 exelator.com
loadeu.exelator.com
load77.exelator.com
4 KB
3 fastly.net
confiant-integrations.global.ssl.fastly.net
68 KB
3 googletagservices.com
www.googletagservices.com
69 KB
2 gstatic.com
fonts.gstatic.com
22 KB
2 crwdcntrl.net
sync.crwdcntrl.net
1 KB
2 ad-delivery.net
ad-delivery.net
1 KB
2 facebook.com
www.facebook.com
2 facebook.net
connect.facebook.net
113 KB
2 google-analytics.com
www.google-analytics.com
18 KB
2 imgur.com
i.imgur.com
5 KB
1 googleapis.com
fonts.googleapis.com
824 B
1 cdnjquery.com
cluster-na.cdnjquery.com
356 B
1 google.de
adservice.google.de
839 B
1 videoplayerhub.com
freestar-io.videoplayerhub.com
26 KB
1 analysis.fi
ecdn.analysis.fi
2 KB
1 googletagmanager.com
www.googletagmanager.com
28 KB
235 35
Domain Requested by
51 adserver-us.adtech.advertising.com 19 redirects a.pub.network
43 www.bleepingcomputer.com www.bleepingcomputer.com
11 tpc.googlesyndication.com securepubads.g.doubleclick.net
tpc.googlesyndication.com
www.bleepingcomputer.com
cdn.ampproject.org
confiant-integrations.global.ssl.fastly.net
10 btlr.sharethrough.com a.pub.network
8 eu-u.openx.net 4 redirects a.pub.network
8 eb2.3lift.com 4 redirects a.pub.network
8 ib.adnxs.com a.pub.network
8 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
www.bleepingcomputer.com
7 cdn.ampproject.org confiant-integrations.global.ssl.fastly.net
securepubads.g.doubleclick.net
7 c.pub.network a.pub.network
6 fastlane.rubiconproject.com a.pub.network
6 c.amazon-adsystem.com a.pub.network
c.amazon-adsystem.com
4 cdn.districtm.io a.pub.network
4 acdn.adnxs.com a.pub.network
4 dmx.districtm.io a.pub.network
4 as-sec.casalemedia.com a.pub.network
4 freestar-d.openx.net a.pub.network
4 tlx.3lift.com a.pub.network
4 web.hb.ad.cpe.dotomi.com a.pub.network
4 apis.google.com www.bleepingcomputer.com
apis.google.com
4 www.bleepstatic.com www.bleepingcomputer.com
3 pagead2.googlesyndication.com securepubads.g.doubleclick.net
3 confiant-integrations.global.ssl.fastly.net a.pub.network
confiant-integrations.global.ssl.fastly.net
3 p.skimresources.com www.bleepingcomputer.com
3 r.skimresources.com 1 redirects www.bleepingcomputer.com
3 www.googletagservices.com a.pub.network
www.bleepingcomputer.com
securepubads.g.doubleclick.net
3 d.pub.network a.pub.network
2 fonts.gstatic.com cdn.ampproject.org
2 loadeu.exelator.com 2 redirects
2 x.skimresources.com 2 redirects
2 sync.crwdcntrl.net 2 redirects
2 ad-delivery.net freestar-io.videoplayerhub.com
2 www.facebook.com connect.facebook.net
2 static.quantcast.mgr.consensu.org quantcast.mgr.consensu.org
2 t.skimresources.com www.bleepingcomputer.com
s.skimresources.com
2 connect.facebook.net www.bleepingcomputer.com
connect.facebook.net
2 www.google-analytics.com www.googletagmanager.com
www.bleepingcomputer.com
2 a.pub.network www.bleepingcomputer.com
a.pub.network
2 i.imgur.com www.bleepingcomputer.com
1 eus.rubiconproject.com a.pub.network
1 fonts.googleapis.com confiant-integrations.global.ssl.fastly.net
1 load77.exelator.com
1 cluster-na.cdnjquery.com freestar-io.videoplayerhub.com
1 audit.quantcast.mgr.consensu.org static.quantcast.mgr.consensu.org
1 api.quantcast.mgr.consensu.org quantcast.mgr.consensu.org
1 api.skimlinks.mgr.consensu.org s.skimresources.com
1 vendorlist.consensu.org quantcast.mgr.consensu.org
1 accounts.google.com apis.google.com
1 adservice.google.com www.googletagservices.com
1 adservice.google.de www.googletagservices.com
1 freestar-io.videoplayerhub.com a.pub.network
1 ad.doubleclick.net www.bleepingcomputer.com
1 quantcast.mgr.consensu.org www.bleepstatic.com
1 ecdn.analysis.fi www.bleepingcomputer.com
1 s.skimresources.com www.bleepingcomputer.com
1 www.googletagmanager.com www.bleepingcomputer.com
235 56
Subject Issuer Validity Valid
bleepingcomputer.com
COMODO RSA Domain Validation Secure Server CA
2018-05-12 -
2020-05-17
2 years crt.sh
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2
2019-11-11 -
2020-10-09
a year crt.sh
*.google-analytics.com
GTS CA 1O1
2020-03-03 -
2020-05-26
3 months crt.sh
*.imgur.com
DigiCert SHA2 Secure Server CA
2020-01-15 -
2022-03-16
2 years crt.sh
*.apis.google.com
GTS CA 1O1
2020-03-03 -
2020-05-26
3 months crt.sh
*.skimresources.com
DigiCert SHA2 Secure Server CA
2018-09-13 -
2020-10-07
2 years crt.sh
*.analysis.fi
Sectigo RSA Domain Validation Secure Server CA
2019-06-13 -
2020-06-12
a year crt.sh
quantcast.mgr.consensu.org
Amazon
2019-05-06 -
2020-06-06
a year crt.sh
*.doubleclick.net
GTS CA 1O1
2020-03-03 -
2020-05-26
3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2020-03-01 -
2020-05-30
3 months crt.sh
*.pub.network
Go Daddy Secure Certificate Authority - G2
2019-02-09 -
2020-05-16
a year crt.sh
*.g.doubleclick.net
GTS CA 1O1
2020-03-03 -
2020-05-26
3 months crt.sh
*.videoplayerhub.com
Amazon
2019-07-18 -
2020-08-18
a year crt.sh
*.google.com
GTS CA 1O1
2020-03-03 -
2020-05-26
3 months crt.sh
accounts.google.com
GTS CA 1O1
2020-03-03 -
2020-05-26
3 months crt.sh
vendorlist.consensu.org
Amazon
2020-02-07 -
2021-03-07
a year crt.sh
c.amazon-adsystem.com
Amazon
2019-10-07 -
2020-09-29
a year crt.sh
*.freetls.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-12-18 -
2020-12-18
a year crt.sh
api.skimlinks.mgr.consensu.org
DigiCert SHA2 Secure Server CA
2019-10-04 -
2021-10-07
2 years crt.sh
ad-delivery.net
Amazon
2019-03-07 -
2020-04-07
a year crt.sh
*.assetbucket.net
Amazon
2019-09-11 -
2020-10-11
a year crt.sh
1605158521.rsc.cdn77.org
Let's Encrypt Authority X3
2020-01-21 -
2020-04-20
3 months crt.sh
ad.cpe.dotomi.com
GlobalSign RSA OV SSL CA 2018
2019-10-16 -
2020-05-25
7 months crt.sh
*.sharethrough.com
Amazon
2019-10-07 -
2020-11-07
a year crt.sh
*.adnxs.com
DigiCert ECC Secure Server CA
2019-01-23 -
2021-03-08
2 years crt.sh
*.rubiconproject.com
DigiCert SHA2 Secure Server CA
2019-01-10 -
2021-01-14
2 years crt.sh
*.3lift.com
Amazon
2019-07-17 -
2020-08-17
a year crt.sh
*.adtech.advertising.com
DigiCert SHA2 High Assurance Server CA
2018-05-22 -
2020-05-26
2 years crt.sh
*.openx.net
GeoTrust RSA CA 2018
2018-01-04 -
2020-07-09
3 years crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018
2020-03-02 -
2021-04-01
a year crt.sh
districtm.io
CloudFlare Inc ECC CA-2
2020-02-25 -
2020-10-09
7 months crt.sh
tpc.googlesyndication.com
GTS CA 1O1
2020-03-03 -
2020-05-26
3 months crt.sh
misc-sni.google.com
GTS CA 1O1
2020-03-03 -
2020-05-26
3 months crt.sh
*.storage.googleapis.com
GTS CA 1O1
2020-03-03 -
2020-05-26
3 months crt.sh
cdn.adnxs.com
GeoTrust RSA CA 2018
2020-01-02 -
2021-04-02
a year crt.sh

This page contains 28 frames:

Primary Page: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Frame ID: 458278B8BF8AF76EEA64B5EE9378DB75
Requests: 190 HTTP requests in this frame

Frame: https://t.skimresources.com/api/v2/robots.txt?__skimjs_preflight__please_ignore__=true&rnd=0.11936128862369255
Frame ID: A18AD4C9C1F43643EC038585DED51093
Requests: 3 HTTP requests in this frame

Frame: https://static.quantcast.mgr.consensu.org/v31/cmp-3pc-check.html
Frame ID: 3DAD892B03959975A5B8CD9384F5F373
Requests: 1 HTTP requests in this frame

Frame: https://apis.google.com/se/0/_/+1/fastbutton?usegapi=1&count=false&size=small&hl=en-GB&origin=https%3A%2F%2Fwww.bleepingcomputer.com&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.JKCQ2Hvuo0E.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCOl3FsgYnTqVeIFUJJD2j4-pO09lQ%2Fm%3D__features__
Frame ID: EAD86FC4C3958EECD54EE7BBC9EFA753
Requests: 1 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.bleepingcomputer.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.JKCQ2Hvuo0E.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCOl3FsgYnTqVeIFUJJD2j4-pO09lQ%2Fm%3D__features__
Frame ID: FC0D708EA65BBB959791E7815C2418D6
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?action=like&app_id=942111685863795&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D46%23cb%3Df3e04f63c509834%26domain%3Dwww.bleepingcomputer.com%26origin%3Dhttps%253A%252F%252Fwww.bleepingcomputer.com%252Ff202a9bfc0b44ec%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&layout=button_count&locale=en_US&sdk=joey&send=false&show_faces=false&width=150
Frame ID: 51EF80F2A1A75D1A1AD56F0330601E12
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv-2C56Umcfc9NMysR5DTKUlnEQAY_RdqykDuEsyiwmpxbpn7xb_c97Q0Jml6HYxHn5GxB3gcCaMvYOANeJoozyGcG8_shObXB1dFH52_9mrHpVCft7qFKBsucHsNyTdUITDvUxpyi4aLsOJ6ta-punHuuAuHc8qsdu_Imsi3M8TzK9N2IQfRt_NaZdMEE7sxz_v8zRqkw61e9NEw3YJ38PbK6espQPFxI-_sUmjMy-5SChdT5Zz1y4xpuKOB2MEp5e4cJG3XLZcFE5rl80_oUJRvLH_8o2ef9PpUYR4e9xKM9s&sai=AMfl-YTOlr9m8-06bbIqdOgID1uA1sigaoQwiqYGirJrCfqElLCJ59yRUssIfIcqiElI5N09gfcD28HReUmbl7GhGAVH6S8e-RgB_iEd0zfdrA&sig=Cg0ArKJSzILDBXnu1mh4EAE&urlfix=1&adurl=
Frame ID: 7E47186C1590321A1BED831CA77541DA
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: F65A4DE0F0C515AD139B8E49BB93606F
Requests: 1 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Frame ID: F31E8B210EDFCE7729F7B544C9AA5C22
Requests: 19 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: D0FAC83400B3E5306C933F293380757A
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 1B8B72D87979BA1DCDDD119C21787E32
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: 29F2FD45B0633E6C21FBD9D8D911081C
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
Frame ID: F4A72E65660A301E4AB73F8A953CE528
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: 90B3664A86F486838B880D9E3B62FAF2
Requests: 1 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: B187C6C187B358E030445CBC72E321F7
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
Frame ID: 0543898E2032AD4518E8F001607B3F99
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: E955E528B780C3988A8D1445F062499F
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: D22EA3BFE41E6791D7031D5F8225C2E1
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
Frame ID: 03D1690D4B672D8D4C38DC6B07942095
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
Frame ID: 40E0156E9797B4F031980F6078A36432
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: 2CF0C7627A3CA9036364212C855B507E
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: 6162EB383F3A0602F580CCF0E23C205B
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: 416ABB19B5146D072BA55537BEEA9602
Requests: 1 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: 9A69B4CBE25F6B95169C45C516D2E76A
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: DF2137D3E4212B4A88648BEEB677EC6A
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: 0E1288122704D764D53ED2C24E6CF605
Requests: 1 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: 72BC122D995D379250922A1FB471F22F
Requests: 1 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: F121298AE2A289AC98C1EC40DF8108C7
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Overall confidence: 100%
Detected patterns
  • script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

235
Requests

100 %
HTTPS

33 %
IPv6

35
Domains

56
Subdomains

49
IPs

8
Countries

1407 kB
Transfer

4373 kB
Size

11
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 62
  • https://r.skimresources.com/api/ HTTP 307
  • https://r.skimresources.com/api/?xguid=01E46Q6FZWH548J2TC1A6QW2WA&persistence=1&checksum=027e9c786929d3d77f86ea60cae0a332780755a2948909637cadd2ec1771ea8d
Request Chain 90
  • https://sync.crwdcntrl.net/map/c=7505/tp=SKIM/?https%3A%2F%2Fx.skimresources.com%2F%3Fprovider%3Dlotame%26skim_mapping%3Dtrue%26provider_id%3D%24%7Bprofile_id%7D HTTP 302
  • https://sync.crwdcntrl.net/map/ct=y/c=7505/tp=SKIM/?https%3A%2F%2Fx.skimresources.com%2F%3Fprovider%3Dlotame%26skim_mapping%3Dtrue%26provider_id%3D%24%7Bprofile_id%7D HTTP 302
  • https://x.skimresources.com/?provider=lotame&skim_mapping=true&provider_id=ee70cc2d1a429c56bcf768ad2c12ffd7 HTTP 302
  • https://p.skimresources.com/?provider_id=ee70cc2d1a429c56bcf768ad2c12ffd7&skim_mapping=true
Request Chain 98
  • https://x.skimresources.com/?provider=exelate HTTP 302
  • https://loadeu.exelator.com/load/?p=787&g=001&j=0& HTTP 302
  • https://loadeu.exelator.com/load/?p=787&g=001&j=0&&xl8blockcheck=1 HTTP 302
  • https://load77.exelator.com/pixel.gif
Request Chain 111
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=61b14b3255fa6b8;misc=1585068590542; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=61b14b3255fa6b8;misc=1585068590542
Request Chain 112
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=62eb4c1c9ae5c45;misc=1585068590543; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=62eb4c1c9ae5c45;misc=1585068590543
Request Chain 113
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=635519aa1e3d53d;misc=1585068590543; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=635519aa1e3d53d;misc=1585068590543
Request Chain 114
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=644cbeb9e5d6a0b;misc=1585068590543; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=644cbeb9e5d6a0b;misc=1585068590543
Request Chain 115
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=65a841ff63cdc0b;misc=1585068590543; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=65a841ff63cdc0b;misc=1585068590543
Request Chain 116
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=660a38cfdd8ff61;misc=1585068590543; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=660a38cfdd8ff61;misc=1585068590543
Request Chain 117
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=673b4b033264c56;misc=1585068590543; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=673b4b033264c56;misc=1585068590543
Request Chain 121
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=644cbeb9e5d6a0b;misc=1585068590543 HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A7a77982c-6def-11ea-ba5b-1274c1fe5bf6;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=644cbeb9e5d6a0b;misc=1585068590543
Request Chain 122
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=65a841ff63cdc0b;misc=1585068590543 HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A7a77a060-6def-11ea-bacd-12052abf3156;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=65a841ff63cdc0b;misc=1585068590543
Request Chain 123
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=62eb4c1c9ae5c45;misc=1585068590543 HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A7a7808f2-6def-11ea-ad61-129e10192f46;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=62eb4c1c9ae5c45;misc=1585068590543
Request Chain 124
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=673b4b033264c56;misc=1585068590543 HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A7a78445c-6def-11ea-8043-121b89dbed5a;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=673b4b033264c56;misc=1585068590543
Request Chain 159
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=15936571e64c8e16;misc=1585068591744; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=15936571e64c8e16;misc=1585068591744
Request Chain 160
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=160c5ff9281107a3;misc=1585068591744; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=160c5ff9281107a3;misc=1585068591744
Request Chain 161
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=161969f8aca6eff9;misc=1585068591744; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=161969f8aca6eff9;misc=1585068591744
Request Chain 176
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=162de21c90b59251;misc=1585068591856; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=162de21c90b59251;misc=1585068591856
Request Chain 182
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=161969f8aca6eff9;misc=1585068591744 HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A7b286e04-6def-11ea-bab4-12107816840e;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=161969f8aca6eff9;misc=1585068591744
Request Chain 183
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=160c5ff9281107a3;misc=1585068591744 HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A7b289064-6def-11ea-8c91-12359aeea65a;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=160c5ff9281107a3;misc=1585068591744
Request Chain 185
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=15936571e64c8e16;misc=1585068591744 HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A7b3bc4ea-6def-11ea-b513-1222202f268e;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=15936571e64c8e16;misc=1585068591744
Request Chain 186
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=162de21c90b59251;misc=1585068591856 HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A7b4aa26c-6def-11ea-bb2f-12d2f833f2cc;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=162de21c90b59251;misc=1585068591856
Request Chain 220
  • https://eb2.3lift.com/sync HTTP 302
  • https://eb2.3lift.com/sync?&ld=1
Request Chain 221
  • https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 HTTP 302
  • https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
Request Chain 224
  • https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 HTTP 302
  • https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
Request Chain 226
  • https://eb2.3lift.com/sync HTTP 302
  • https://eb2.3lift.com/sync?&ld=1
Request Chain 227
  • https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 HTTP 302
  • https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
Request Chain 228
  • https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 HTTP 302
  • https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
Request Chain 233
  • https://eb2.3lift.com/sync HTTP 302
  • https://eb2.3lift.com/sync?&ld=1
Request Chain 234
  • https://eb2.3lift.com/sync HTTP 302
  • https://eb2.3lift.com/sync?&ld=1

235 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
173 KB
33 KB
Document
General
Full URL
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8bcc67dca0129075934b6b8ffe78f5eb03ed8df094e9ae5e5c57d4a589e1ecf8
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

:method
GET
:authority
www.bleepingcomputer.com
:scheme
https
:path
/forums/t/715480/coronavirus-dns-router-hijack/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
document
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document

Response headers

status
200
date
Tue, 24 Mar 2020 16:49:48 GMT
content-type
text/html;charset=ISO-8859-1
set-cookie
__cfduid=d62deb40f6978098539d9e6e6bb75b0961585068587; expires=Thu, 23-Apr-20 16:49:47 GMT; path=/; domain=.bleepingcomputer.com; HttpOnly; SameSite=Lax; Secure session_id=a06ba1247ebf42f0189170f29b01beae; path=/; domain=.bleepingcomputer.com; httponly;Secure modpids=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.bleepingcomputer.com;Secure
content-security-policy
upgrade-insecure-requests;
x-frame-options
SAMEORIGIN
cache-control
no-cache, no-store, must-revalidate, max-age=0
expires
Mon, 23 Mar 2020 16:49:48 GMT
pragma
no-cache
vary
Accept-Encoding,User-Agent
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
5791e331aebed8bd-AMS
content-encoding
br
prettify.css
www.bleepingcomputer.com/forums/public/style_css/
1 KB
573 B
Stylesheet
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_css/prettify.css?ipbv=2c77595800f56bf9d8365767f85624ab
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bfd753d445592a633d4e3b8f74fe6e4ca85ab95a1f0b2fc00f11afeaaeed8194
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
content-encoding
br
cf-cache-status
HIT
age
1133
cf-polished
origSize=2207
status
200
last-modified
Wed, 29 May 2013 16:10:52 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"89f-4dddda0323b00-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
max-age=18000
content-security-policy
upgrade-insecure-requests;
cf-ray
5791e336ef50d8bd-AMS
cf-bgj
minify
prototype.js
www.bleepingcomputer.com/forums/public/js/3rd_party/
134 KB
33 KB
Script
General
Full URL
https://www.bleepingcomputer.com/forums/public/js/3rd_party/prototype.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c2a0ed3ea5aebdf80781e96b0e677656f9db72ea592b679299953852fef84b02
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
content-encoding
br
cf-cache-status
HIT
age
2965
cf-polished
origSize=180829
status
200
last-modified
Wed, 29 May 2013 16:10:44 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"2c25d-4dddd9fb82900-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=18000
content-security-policy
upgrade-insecure-requests;
cf-ray
5791e3370fb1d8bd-AMS
cf-bgj
minify
ipb.js
www.bleepingcomputer.com/forums/public/js/
81 KB
19 KB
Script
General
Full URL
https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=2c77595800f56bf9d8365767f85624ab&load=quickpm,hovercard,sharelinks,topic,like
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
914053e444ff358317ec2778690f8dfff7c41eeb985a6b3ee2906280bbc4b61a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
content-encoding
br
cf-cache-status
HIT
age
1133
cf-polished
origSize=128615
status
200
last-modified
Thu, 02 Jan 2020 17:02:01 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"1f667-59b2b26d979c8-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=18000
content-security-policy
upgrade-insecure-requests;
cf-ray
5791e3370fb3d8bd-AMS
cf-bgj
minify
scriptaculous-cache.js
www.bleepingcomputer.com/forums/public/js/3rd_party/scriptaculous/
55 KB
13 KB
Script
General
Full URL
https://www.bleepingcomputer.com/forums/public/js/3rd_party/scriptaculous/scriptaculous-cache.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
61e225f0d67c03cc5a2cdfa2f63e971048d0201711c3cda27c4d4ea0f9f65176
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
content-encoding
br
cf-cache-status
HIT
age
1133
cf-polished
origSize=79618
status
200
last-modified
Wed, 29 May 2013 16:10:52 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"13702-4dddda0323b00-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=18000
content-security-policy
upgrade-insecure-requests;
cf-ray
5791e3370fb6d8bd-AMS
cf-bgj
minify
ipb.lang.js
www.bleepingcomputer.com/forums/cache/lang_cache/1/
28 KB
7 KB
Script
General
Full URL
https://www.bleepingcomputer.com/forums/cache/lang_cache/1/ipb.lang.js?nck=4b93cd7f1f76df9c2c1783aae5cc39b1
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ebbdc09f56e8b9cba9117f0d84b4903fdc89508496a9b5d5b8d6bf59ff13ebbf
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
content-encoding
br
cf-cache-status
HIT
age
1133
cf-polished
origSize=30126
status
200
last-modified
Fri, 25 Oct 2019 14:30:02 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"75ae-595bcfc4bde67-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=18000
content-security-policy
upgrade-insecure-requests;
cf-ray
5791e3370fb8d8bd-AMS
cf-bgj
minify
qc-consent.js
www.bleepstatic.com/js/qc-consent/
3 KB
1 KB
Script
General
Full URL
https://www.bleepstatic.com/js/qc-consent/qc-consent.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3b6a84a416edfb98ed7608dad8cd26ffd7123e54bce2bb13a4a3394e0b948382

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
content-encoding
br
cf-cache-status
HIT
age
2028163
cf-polished
origSize=3848
status
200
cf-bgj
minify
last-modified
Thu, 07 Feb 2019 13:49:44 GMT
server
cloudflare
etag
W/"3981350888"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=3024000
cf-ray
5791e3377eb3ee03-CDG
expires
Sun, 05 Apr 2020 05:27:05 GMT
js
www.googletagmanager.com/gtag/
75 KB
28 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-91740-1
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
025e7e180ec38cee031546ed3a613dc266575a90fb028db4572236863b185c70
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
content-encoding
br
status
200
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28648
x-xss-protection
0
last-modified
Tue, 24 Mar 2020 15:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 24 Mar 2020 16:49:48 GMT
twitter.png
www.bleepingcomputer.com/forums/public/style_images/master/loginmethods/
545 B
689 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_images/master/loginmethods/twitter.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
92597d72536ce2725db3f04c7ad34252f8d4037ae0a61cdec08f93a0c2db05f2
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
1943922
cf-polished
origSize=575, status=vary_header_present
status
200
content-length
545
last-modified
Mon, 03 May 2010 23:34:02 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"23f-485b90722ae80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Wed, 01 Apr 2020 04:51:05 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337ca0dd8bd-AMS
cf-bgj
imgq:100
forum-logo.png
www.bleepstatic.com/logo/
5 KB
5 KB
Image
General
Full URL
https://www.bleepstatic.com/logo/forum-logo.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
311b90855c9f23f4f7531137aa339d941b81af0409120d0281a535f0d2920d49

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
1096560
cf-polished
origFmt=png, origSize=9361
status
200
content-disposition
inline; filename="forum-logo.webp"
cf-bgj
imgq:85
content-length
4670
last-modified
Fri, 26 Nov 2010 18:53:37 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
5791e337dfffee03-CDG
expires
Sat, 11 Apr 2020 00:13:47 GMT
useropts_arrow.png
www.bleepingcomputer.com/forums/public/style_images/master/
94 B
460 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_images/master/useropts_arrow.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
114af008615fbe18f9cc0dfd36ebafd202e12eda91137d48d8a2cab529274d9f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
210571
cf-polished
pngoptimizer, origSize=129, status=vary_header_present
status
200
content-length
94
last-modified
Mon, 03 May 2010 23:34:02 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"81-485b90722ae80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Tue, 21 Apr 2020 06:20:17 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337ca0fd8bd-AMS
cf-bgj
imgq:100
default_large.png
www.bleepingcomputer.com/forums/public/style_images/master/profile/
2 KB
3 KB
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_images/master/profile/default_large.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
48100a7efdd07d27ede8e151c39cad2a2b55853d038c25fc2a846316ea0184ef
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
1680611
cf-polished
pngoptimizer, origSize=2589, status=vary_header_present
status
200
content-length
2503
last-modified
Wed, 09 Mar 2011 20:59:50 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"a1d-49e13027a9d80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Sat, 04 Apr 2020 05:59:37 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337ca13d8bd-AMS
cf-bgj
imgq:100
icon_share.png
www.bleepingcomputer.com/forums/public/style_images/master/
169 B
346 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_images/master/icon_share.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b5a35aa59af15012b03c44769087fb85282ed12e3c417030d78f95f61697b53
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
717625
cf-polished
pngoptimizer, origSize=1201, status=vary_header_present
status
200
content-length
169
last-modified
Fri, 12 Oct 2012 09:31:38 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"4b1-4cbd95ac45280"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Wed, 15 Apr 2020 09:29:23 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337ca16d8bd-AMS
cf-bgj
imgq:100
quicktime.gif
www.bleepingcomputer.com/forums/public/style_extra/mime_types/
213 B
346 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_extra/mime_types/quicktime.gif
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8856e209b20c00bc8b3f47cb603948302c4171b14518936952660eca422901f3
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
1678059
cf-polished
status=not_needed
status
200
content-length
213
last-modified
Fri, 30 Apr 2010 22:16:02 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"d5-4857b96a96c80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/gif
expires
Sat, 04 Apr 2020 06:42:09 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337ca17d8bd-AMS
cf-bgj
imgq:100
post_top.png
www.bleepstatic.com/skin_images/bc/
369 B
805 B
Image
General
Full URL
https://www.bleepstatic.com/skin_images/bc/post_top.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f05e5537bc91bd6026cd2ee7a4ce48d5141ba791f68f1ce1264283c8af6c3aeb

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
1507
cf-polished
origSize=3076, status=webp_bigger
status
200
cf-bgj
imgq:85
content-length
369
last-modified
Wed, 09 Jun 2010 03:08:32 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
5791e337d801ee03-CDG
expires
Thu, 14 Nov 2019 07:03:41 GMT
bot.jpg
www.bleepstatic.com/images/site/forum/bots/
880 B
1 KB
Image
General
Full URL
https://www.bleepstatic.com/images/site/forum/bots/bot.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
967e2ca4f6acdd30fe8199d905a42f91e578494c5ae014f79d8cae4423219edc

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
510965
cf-polished
qual=85, origFmt=jpeg, origSize=1566
status
200
content-disposition
inline; filename="bot.webp"
cf-bgj
imgq:85
content-length
880
last-modified
Tue, 20 Oct 2009 04:08:57 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
5791e337d802ee03-CDG
expires
Fri, 17 Apr 2020 18:53:43 GMT
av-26513.jpg
www.bleepingcomputer.com/forums/uploads/
3 KB
3 KB
Image
General
Full URL
https://www.bleepingcomputer.com/forums/uploads/av-26513.jpg?_r=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bd22135631e382a4d981e14dce6427a150d8c12cc5b779110652e0b00407eb69
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
1673422
cf-polished
origSize=3130, status=vary_header_present
status
200
content-length
2746
last-modified
Thu, 08 Sep 2005 19:07:06 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"c3a-400475df72a80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/jpeg
expires
Sat, 04 Apr 2020 07:59:26 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337da1ad8bd-AMS
cf-bgj
imgq:100
kO7xOZh.gif
i.imgur.com/
3 KB
3 KB
Image
General
Full URL
https://i.imgur.com/kO7xOZh.gif
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
608501196c0571ec771c62b340f68dbcd57d10b119d7c4fe87cca2ed81a79e2a

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
age
2221644
x-cache
HIT, HIT
status
200
content-length
3078
x-served-by
cache-bwi5127-BWI, cache-fra19136-FRA
last-modified
Thu, 01 Dec 2016 18:42:01 GMT
server
cat factory 1.0
x-timer
S1585068589.818074,VS0,VE1
etag
"c7ab4b049bf557e389fff83e16b8a451"
access-control-allow-methods
GET, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-cache-hits
1, 1
38WxTfO.gif
i.imgur.com/
1 KB
2 KB
Image
General
Full URL
https://i.imgur.com/38WxTfO.gif
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
154f3a9ed4f3ac0059fc18337f3cb4d28103f349b3e256458f6a39b23d3c092b

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
age
25858054
x-cache
HIT, HIT
status
200
content-length
1491
x-served-by
cache-bwi5133-BWI, cache-fra19136-FRA
last-modified
Fri, 09 Dec 2016 11:33:28 GMT
server
cat factory 1.0
x-timer
S1585068589.818334,VS0,VE1
etag
"74f7d23b80fa48165e56fd6193e83ae3"
access-control-allow-methods
GET, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-cache-hits
1, 1
photo-thumb-238592.png
www.bleepingcomputer.com/forums/uploads/profile/
13 KB
13 KB
Image
General
Full URL
https://www.bleepingcomputer.com/forums/uploads/profile/photo-thumb-238592.png?_r=1473891226
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0046b574f57cf9b0c63b743a3decdbe6ba204166f6cf786caa99f14be1bd2b52
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
554585
cf-polished
pngoptimizer, origSize=14491, status=vary_header_present
status
200
content-length
13138
last-modified
Wed, 14 Sep 2016 22:15:13 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"389b-53c7f10261e40"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Fri, 17 Apr 2020 06:46:43 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337da1bd8bd-AMS
cf-bgj
imgq:100
photo-thumb-900465.jpg
www.bleepingcomputer.com/forums/uploads/profile/
1 KB
2 KB
Image
General
Full URL
https://www.bleepingcomputer.com/forums/uploads/profile/photo-thumb-900465.jpg?_r=1441718638
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5c5493de2d83c24647a2da39b8abcbf696ddab1e53cf476f62ad80d97baea2bb
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
502596
cf-polished
origSize=1963, status=vary_header_present
status
200
content-length
1506
last-modified
Tue, 08 Sep 2015 13:23:58 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"7ab-51f3c4748b780"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/jpeg
expires
Fri, 17 Apr 2020 21:13:12 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337da1dd8bd-AMS
cf-bgj
imgq:100
smile.png
www.bleepingcomputer.com/forums/public/style_emoticons/default/
850 B
1016 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_emoticons/default/smile.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
18d824646c1147f2687333fa22e37718e5c666d078eb27ffffa017f59415cac5
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
676229
cf-polished
origSize=1042, status=vary_header_present
status
200
content-length
850
last-modified
Wed, 18 May 2011 11:51:58 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"412-4a38b840bf380"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Wed, 15 Apr 2020 20:59:19 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337da1fd8bd-AMS
cf-bgj
imgq:100
twitter.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/
545 B
676 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/twitter.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
92597d72536ce2725db3f04c7ad34252f8d4037ae0a61cdec08f93a0c2db05f2
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
639762
cf-polished
origSize=575, status=vary_header_present
status
200
content-length
545
last-modified
Fri, 30 Apr 2010 22:16:02 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"23f-4857b96a96c80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Thu, 16 Apr 2020 07:07:06 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337da21d8bd-AMS
cf-bgj
imgq:100
plusone.js
apis.google.com/js/
48 KB
19 KB
Script
General
Full URL
https://apis.google.com/js/plusone.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
91772941c245b12f8fcb8447413a0d7ceb9864bf67147894775ea9062c59f82a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
script-src 'report-sample' 'nonce-mO2djw2he4luh1ks3u8EMg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
status
200
strict-transport-security
max-age=31536000
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
x-xss-protection
0
x-ua-compatible
IE=edge, chrome=1
server
ESF
etag
"7208491ced726c2d16c8da79ffd8e90e"
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=1800, stale-while-revalidate=1800
timing-allow-origin
*
expires
Tue, 24 Mar 2020 16:49:48 GMT
digg.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/
357 B
529 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/digg.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
669641985eb1bb7b0e71762f8e734ae2d1832b6976a97f099218d714da1f214e
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
36334
cf-polished
pngoptimizer, origSize=431, status=vary_header_present
status
200
content-length
357
last-modified
Fri, 30 Apr 2010 22:16:02 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"1af-4857b96a96c80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Thu, 23 Apr 2020 06:44:14 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337ea57d8bd-AMS
cf-bgj
imgq:100
delicious.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/
245 B
402 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/delicious.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0bc2ee096d68f1de3dfd74d23e4a3d1550001d5a459a537e276b5bdf6f011893
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
36334
cf-polished
origSize=308, status=vary_header_present
status
200
content-length
245
last-modified
Fri, 30 Apr 2010 22:16:02 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"134-4857b96a96c80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Thu, 23 Apr 2020 06:44:14 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337ea5cd8bd-AMS
cf-bgj
imgq:100
reddit.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/
542 B
695 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/reddit.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
424b5f41dcbc693d32ca73f0e2b1daa5cf5524bc2220865c15b81f032bf3052d
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
2206531
cf-polished
pngoptimizer, origSize=614, status=vary_header_present
status
200
content-length
542
last-modified
Fri, 30 Apr 2010 22:16:02 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"266-4857b96a96c80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Sun, 29 Mar 2020 03:54:17 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337ea5fd8bd-AMS
cf-bgj
imgq:100
stumble.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/
418 B
570 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/stumble.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a915aab28857afeac49311ceff852888da1623eb0f589d7f43fbfbfbceb562e9
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
210571
cf-polished
pngoptimizer, origSize=519, status=vary_header_present
status
200
content-length
418
last-modified
Fri, 30 Apr 2010 22:16:02 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"207-4857b96a96c80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Tue, 21 Apr 2020 06:20:17 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337ea61d8bd-AMS
cf-bgj
imgq:100
email.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/
419 B
585 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/email.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ee469e3d281e77f7dcc2655ff8d187907f2240c76a03bf868e7dcfd67f08d880
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
652909
cf-polished
origSize=530, status=vary_header_present
status
200
content-length
419
last-modified
Thu, 04 Feb 2010 11:47:46 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"212-47ec4e74b3c80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Thu, 16 Apr 2020 03:27:59 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337ea62d8bd-AMS
cf-bgj
imgq:100
print.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/
272 B
415 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/print.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6e0533d6585c026d1f72a040b902b67d76994eafa3593049d16ee319e9ec9be8
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
658929
cf-polished
origSize=409, status=vary_header_present
status
200
content-length
272
last-modified
Fri, 30 Apr 2010 22:16:02 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"199-4857b96a96c80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Thu, 16 Apr 2020 01:47:39 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337ea64d8bd-AMS
cf-bgj
imgq:100
download.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/
633 B
807 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/download.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
563777fc54d07e48cbea78dd97911bdd12a62d1888d12fe4dfeaaa9b3563d676
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
35469
cf-polished
origSize=646, status=vary_header_present
status
200
content-length
633
last-modified
Fri, 12 Feb 2010 14:33:56 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"286-47f6828485d00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Thu, 23 Apr 2020 06:58:39 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337ea65d8bd-AMS
cf-bgj
imgq:100
prettify.js
www.bleepingcomputer.com/forums/public/js/3rd_party/prettify/
14 KB
6 KB
Script
General
Full URL
https://www.bleepingcomputer.com/forums/public/js/3rd_party/prettify/prettify.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b937537ed7f13e70dc6a69b6e9b308237cd369e11fa2a2b97a24d97d8487673e
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
content-encoding
br
cf-cache-status
HIT
age
1212
cf-polished
origSize=14551
status
200
last-modified
Wed, 29 May 2013 16:10:52 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"38d7-4dddda0323b00-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=18000
content-security-policy
upgrade-insecure-requests;
cf-ray
5791e337894ed8bd-AMS
cf-bgj
minify
lang-sql.js
www.bleepingcomputer.com/forums/public/js/3rd_party/prettify/
2 KB
1 KB
Script
General
Full URL
https://www.bleepingcomputer.com/forums/public/js/3rd_party/prettify/lang-sql.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
770cb6f8747e90dad261e049dfa5cf42e622dac61bcbc86ecb0a8c134228eb91
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
content-encoding
br
cf-cache-status
HIT
age
1132
cf-polished
origSize=1802
status
200
last-modified
Wed, 29 May 2013 16:10:52 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"70a-4dddda0323b00-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=18000
content-security-policy
upgrade-insecure-requests;
cf-ray
5791e337b9d4d8bd-AMS
cf-bgj
minify
top.png
www.bleepingcomputer.com/forums/public/style_images/master/
147 B
283 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_images/master/top.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7cc36f47b70988855c5cde9579581871e9dc92a285a8b1ba4602a89c915c902c
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
36382
cf-polished
origSize=207, status=vary_header_present
status
200
content-length
147
last-modified
Thu, 09 Jun 2011 17:25:44 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"cf-4a54abe32b600"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Thu, 23 Apr 2020 06:43:26 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337ea66d8bd-AMS
cf-bgj
imgq:100
feed.png
www.bleepingcomputer.com/forums/public/style_images/master/
641 B
800 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_images/master/feed.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9158290895e962ac081ae5856cf1c361811b63e1dadf7a6b09fa2f3abbd6ecb5
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
1758487
cf-polished
origSize=680, status=vary_header_present
status
200
content-length
641
last-modified
Mon, 03 May 2010 23:34:02 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"2a8-485b90722ae80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Fri, 03 Apr 2020 08:21:41 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337ea67d8bd-AMS
cf-bgj
imgq:100
lightbox.js
www.bleepingcomputer.com/forums/public/js/3rd_party/
9 KB
2 KB
Script
General
Full URL
https://www.bleepingcomputer.com/forums/public/js/3rd_party/lightbox.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1a78f7bf63f851cbab54a7f7e9ccb76b53ef79834c33cd242aa98d16d228e855
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
content-encoding
br
cf-cache-status
HIT
age
1132
cf-polished
origSize=10063
status
200
last-modified
Wed, 29 May 2013 16:10:44 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"274f-4dddd9fb82900-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=18000
content-security-policy
upgrade-insecure-requests;
cf-ray
5791e337ca0bd8bd-AMS
cf-bgj
minify
3687X620620.skimlinks.js
s.skimresources.com/js/
43 KB
16 KB
Script
General
Full URL
https://s.skimresources.com/js/3687X620620.skimlinks.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f988bd12377e5e223349a8283d2ff1b48c185d4ab13a11a9f9d0ed9bd374d071

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
content-encoding
gzip
last-modified
Thu, 12 Mar 2020 11:41:26 GMT
server
AmazonS3
x-amz-request-id
967E011529BB6B69
etag
"619308536919c770dd3664b272750328"
x-hw
1585068588.cds020.pa1.hn,1585068588.cds035.pa1.c
content-type
application/octet-stream
status
200
cache-control
max-age=3600
accept-ranges
bytes
content-length
16464
x-amz-id-2
h2aq2h587QQt8rdbLYhZmy9jU4Qlkw4GHdj7jsX9NnY1HvUXO6W2f7EPbqmYgk70L936AP9E/5c=
ips.quickpm.js
www.bleepingcomputer.com/forums/public/js/
5 KB
2 KB
Script
General
Full URL
https://www.bleepingcomputer.com/forums/public/js/ips.quickpm.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=2c77595800f56bf9d8365767f85624ab&load=quickpm,hovercard,sharelinks,topic,like
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f34544ddb27241b3eccb8e06d7447230005e8718b463a30d9dd83d1e8bada1a1
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
content-encoding
br
cf-cache-status
HIT
age
1236
cf-polished
origSize=7306
status
200
last-modified
Wed, 29 May 2013 16:10:52 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"1c8a-4dddda0323b00-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=18000
content-security-policy
upgrade-insecure-requests;
cf-ray
5791e337791bd8bd-AMS
cf-bgj
minify
ips.hovercard.js
www.bleepingcomputer.com/forums/public/js/
7 KB
2 KB
Script
General
Full URL
https://www.bleepingcomputer.com/forums/public/js/ips.hovercard.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=2c77595800f56bf9d8365767f85624ab&load=quickpm,hovercard,sharelinks,topic,like
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3e3b8f6c06d2d74cc294ee6439e67b08890587be0081249a158469ace2eaeaaf
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
content-encoding
br
cf-cache-status
HIT
age
1237
cf-polished
origSize=12576
status
200
last-modified
Wed, 29 May 2013 16:10:52 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"3120-4dddda0323b00-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=18000
content-security-policy
upgrade-insecure-requests;
cf-ray
5791e337791cd8bd-AMS
cf-bgj
minify
ips.sharelinks.js
www.bleepingcomputer.com/forums/public/js/
4 KB
1 KB
Script
General
Full URL
https://www.bleepingcomputer.com/forums/public/js/ips.sharelinks.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=2c77595800f56bf9d8365767f85624ab&load=quickpm,hovercard,sharelinks,topic,like
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f1e90548e911e24dedcb2ca0ffee6847a49a8648e9c615bcd0582bb7c7993fd
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
content-encoding
br
cf-cache-status
HIT
age
1132
cf-polished
origSize=5869
status
200
last-modified
Wed, 29 May 2013 16:10:44 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"16ed-4dddd9fb82900-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=18000
content-security-policy
upgrade-insecure-requests;
cf-ray
5791e337791fd8bd-AMS
cf-bgj
minify
ips.topic.js
www.bleepingcomputer.com/forums/public/js/
28 KB
6 KB
Script
General
Full URL
https://www.bleepingcomputer.com/forums/public/js/ips.topic.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=2c77595800f56bf9d8365767f85624ab&load=quickpm,hovercard,sharelinks,topic,like
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a51f645170637f10f3eba218020318af3fff3ad8e7087db87ef607896f19a940
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
content-encoding
br
cf-cache-status
HIT
age
1132
cf-polished
origSize=45653
status
200
last-modified
Tue, 29 Dec 2015 18:39:43 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"b255-5280dbeb879c0-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=18000
content-security-policy
upgrade-insecure-requests;
cf-ray
5791e3377920d8bd-AMS
cf-bgj
minify
ips.like.js
www.bleepingcomputer.com/forums/public/js/
4 KB
1018 B
Script
General
Full URL
https://www.bleepingcomputer.com/forums/public/js/ips.like.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=2c77595800f56bf9d8365767f85624ab&load=quickpm,hovercard,sharelinks,topic,like
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bf50c94253085740a5cce42e9c14f7b897cfc384303b38a5d9d7a0ab8ea5160f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
content-encoding
br
cf-cache-status
HIT
age
1132
cf-polished
origSize=6287
status
200
last-modified
Wed, 29 May 2013 16:10:44 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"188f-4dddd9fb82900-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=18000
content-security-policy
upgrade-insecure-requests;
cf-ray
5791e3377923d8bd-AMS
cf-bgj
minify
pubfig.min.js
a.pub.network/bleepingcomputer-com/
440 KB
117 KB
Script
General
Full URL
https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:18b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e099cbd4b2f4ddf8fc0c4715ac73f46a9c3134ec539a045c87db7252a854f77b

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
content-encoding
br
cf-cache-status
HIT
age
20
status
200
x-guploader-uploadid
AEnB2UoM-Yb_h_NuU9scUzxXe5tQ1IFaC-TrJuWYpuy7MntyjsNNXa60NRYV1shfzsOHee3w1NbJslK7_Xw6SP9IAsefATS30Q
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
last-modified
Fri, 20 Mar 2020 20:07:32 GMT
server
cloudflare
etag
W/"1173359ed7df956afd617e45530903b3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=cm/Q+g==, md5=EXM1ntfflWr9YX5FUwkDsw==
content-type
application/javascript
x-goog-generation
1584734852947887
cache-control
public, max-age=1800
x-goog-stored-content-length
450440
cf-ray
5791e337ec7adfb7-FRA
expires
Tue, 24 Mar 2020 16:50:28 GMT
fab.js
ecdn.analysis.fi/static/js/
4 KB
2 KB
Script
General
Full URL
https://ecdn.analysis.fi/static/js/fab.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.71.236.117 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
nb-212-71-236-117.london.nodebalancer.linode.com
Software
nginx/1.12.2 /
Resource Hash
affd87461f2babd57a2f7aec75e9193e8e71a377e8249a02c95a5f43326e289e

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Tue, 24 Mar 2020 16:49:12 GMT
Content-Encoding
gzip
Last-Modified
Wed, 15 Jul 2015 00:00:00 GMT
Server
nginx/1.12.2
ETag
"55a5a280-560"
Content-Type
application/javascript
Cache-Control
max-age=3600
Connection
close
Content-Length
1376
Expires
Tue, 24 Mar 2020 17:49:12 GMT
ipb_print.css
www.bleepingcomputer.com/forums/public/style_css/css_7/
3 KB
1 KB
Stylesheet
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_css/css_7/ipb_print.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cbd8236978dd3f165bc49566f78c460e3937e552df38787439c1ef2797c4c709
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
content-encoding
br
cf-cache-status
HIT
age
1131
cf-polished
origSize=2715
status
200
last-modified
Thu, 02 Jan 2020 17:02:25 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"a9b-59b2b285311b3-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
max-age=18000
content-security-policy
upgrade-insecure-requests;
cf-ray
5791e337ea68d8bd-AMS
cf-bgj
minify
user_navigation.png
www.bleepingcomputer.com/forums/public/style_images/master/
191 B
343 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_images/master/user_navigation.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ab1a12c0da652f8e525d21b28ca7c45b5ea34e787b561120cd8564089faf2a96
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
1756774
cf-polished
pngoptimizer, origSize=282, status=vary_header_present
status
200
content-length
191
last-modified
Tue, 01 Mar 2011 13:54:08 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"11a-49d6c2153a000"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Fri, 03 Apr 2020 08:50:14 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337ea69d8bd-AMS
cf-bgj
imgq:100
advanced_search.png
www.bleepingcomputer.com/forums/public/style_images/master/
272 B
606 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_images/master/advanced_search.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a55c6652514d6e2ebc88198444ac6b199e6ad119d0d009eea0a52e87cd7b39df
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
638737
cf-polished
pngoptimizer, origSize=293, status=vary_header_present
status
200
content-length
272
last-modified
Mon, 03 May 2010 23:34:02 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"125-485b90722ae80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Thu, 16 Apr 2020 07:24:11 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337ea6ad8bd-AMS
cf-bgj
imgq:100
search_icon.png
www.bleepingcomputer.com/forums/public/style_images/master/
202 B
376 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_images/master/search_icon.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
51f20d95dad9ea1473e4f877b5f7a7d8bcd589f1f989b8875ffddd83ae716a21
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
335849
cf-polished
pngoptimizer, origSize=223, status=vary_header_present
status
200
content-length
202
last-modified
Mon, 03 May 2010 23:34:02 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"df-485b90722ae80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Sun, 19 Apr 2020 19:32:19 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337ea6bd8bd-AMS
cf-bgj
imgq:100
icon_quicknav.png
www.bleepingcomputer.com/forums/public/style_images/master/
374 B
549 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_images/master/icon_quicknav.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef879b83b39fe97ac9e83cc9329bf03ec9199fe7433b1ae62d311ef1dac86cbc
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
36382
cf-polished
pngoptimizer, origSize=489, status=vary_header_present
status
200
content-length
374
last-modified
Fri, 01 Jul 2011 10:17:42 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"1e9-4a6ff53f0bd80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Thu, 23 Apr 2020 06:43:26 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337ea6cd8bd-AMS
cf-bgj
imgq:100
analytics.js
www.google-analytics.com/
44 KB
18 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-91740-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 06 Feb 2020 00:21:02 GMT
server
Golfe2
age
673
date
Tue, 24 Mar 2020 16:38:35 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
18174
expires
Tue, 24 Mar 2020 18:38:35 GMT
maintitle.png
www.bleepingcomputer.com/forums/public/style_images/master/
193 B
348 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_images/master/maintitle.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8347a92981a0fdc73af9e2536f688b1a14e6ebea3b4ee5df22e6654bb5e8ca6c
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
36334
cf-polished
pngoptimizer, origSize=295, status=vary_header_present
status
200
content-length
193
last-modified
Tue, 01 Mar 2011 13:54:08 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"127-49d6c2153a000"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Thu, 23 Apr 2020 06:44:14 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337fa8ed8bd-AMS
cf-bgj
imgq:100
icon_warning.png
www.bleepingcomputer.com/forums/public/style_images/master/
270 B
435 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_images/master/icon_warning.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ea99b0d7d706f0144a121af332e2efaae3a1fa76a4a3dbdbec7faa2b0177a2b0
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
cf-cache-status
HIT
age
814978
cf-polished
origSize=408, status=vary_header_present
status
200
content-length
270
last-modified
Wed, 20 Apr 2011 21:00:34 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"198-4a15fea6fc080"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Tue, 14 Apr 2020 06:26:50 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e337fa8fd8bd-AMS
cf-bgj
imgq:100
collect
www.google-analytics.com/r/
35 B
101 B
Image
General
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j81&a=98792429&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&ul=en-us&de=windows-1252&dt=Coronavirus%20DNS%20Router%20Hijack%20-%20General%20Security&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAUAB~&jid=289459982&gjid=363609346&cid=1846113363.1585068589&tid=UA-91740-1&_gid=498617082.1585068589&_r=1&gtm=2ou3b2&z=2052798307
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:48 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
cmp.js
quantcast.mgr.consensu.org/
225 KB
61 KB
Script
General
Full URL
https://quantcast.mgr.consensu.org/cmp.js
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2057:b200:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
826acef37820db4f3e9b999fa220c33e40cdd0b862f9717190a775dddd38d846

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:41:05 GMT
content-encoding
gzip
last-modified
Tue, 17 Mar 2020 20:57:22 GMT
server
AmazonS3
age
1729
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript;charset=UTF-8
status
200
x-amz-meta-qc-ineu
True
x-amz-cf-pop
FRA6-C1
x-amz-cf-id
5Wew3Q8mh0b1jV1XZpFRqT-1IqxTp2azti7Bmh0uI9qq9raCZdZgTw==
via
1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
favicon.ico
ad.doubleclick.net/
1 KB
476 B
Image
General
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.166 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s29-in-f6.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 15:32:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4667
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
104
x-xss-protection
0
last-modified
Tue, 08 May 2012 13:08:06 GMT
server
sffe
vary
Accept-Encoding
content-type
image/x-icon
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
expires
Wed, 25 Mar 2020 15:32:01 GMT
all.js
connect.facebook.net/en_US/
3 KB
2 KB
Script
General
Full URL
https://connect.facebook.net/en_US/all.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
0791793cd6397fb3ac6578bdca31e043b4951d4e4eacc45894ce2d76ec62159d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
X17zk0LK+UNfB83ocFSlPA==
status
200
date
Tue, 24 Mar 2020 16:49:48 GMT, Tue, 24 Mar 2020 16:49:48 GMT
expires
Tue, 24 Mar 2020 17:07:16 GMT
alt-svc
h3-27=":443"; ma=3600
content-length
1780
x-fb-debug
MXCMvBO6MIIqzonxm8cgofeQVxwuqTWlbPUCWKvFiHaU4CLNGQuFHJ1BZAihUPggZtJSCnF7MFuamX20F5OAyw==
x-fb-trip-id
420120009
x-fb-content-md5
fd85f89801d6b10781b98080ab374ed3
etag
"10fd33b4b2c712c100dcaaeaa7da8dce"
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cb=gapi.loaded_0
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.JKCQ2Hvuo0E.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCOl3FsgYnTqVeIFUJJD2j4-pO09lQ/
140 KB
49 KB
Script
General
Full URL
https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.JKCQ2Hvuo0E.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCOl3FsgYnTqVeIFUJJD2j4-pO09lQ/cb=gapi.loaded_0
Requested by
Host: apis.google.com
URL: https://apis.google.com/js/plusone.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
24b45790f58b5d8c376ea8320617b5defa1c88576b7b8df5abf1337a758adba3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 13 Mar 2020 16:37:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 15 Jan 2020 20:40:07 GMT
server
sffe
age
951153
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
status
200
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
50234
x-xss-protection
0
expires
Sat, 13 Mar 2021 16:37:15 GMT
cookie
d.pub.network/
36 B
472 B
XHR
General
Full URL
https://d.pub.network/cookie
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.71.214 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
214.71.188.35.bc.googleusercontent.com
Software
/
Resource Hash
c57c86686c599401b7308e9bd9dd46be8790500a8423bf8b087a1603e735b9d0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Tue, 24 Mar 2020 16:49:49 GMT
Access-Control-Allow-Credentials
true
Content-Length
36
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type
text/plain;charset=utf-8
gpt.js
www.googletagservices.com/tag/js/
43 KB
14 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1a4f0e8c39215f22253ccbba8d94aaf7d5cce967a7f746234af6750de3df5af3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"465 / 766 of 1000 / last-modified: 1585062257"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
14409
x-xss-protection
0
expires
Tue, 24 Mar 2020 16:49:48 GMT
gallery.js
freestar-io.videoplayerhub.com/
101 KB
26 KB
Script
General
Full URL
https://freestar-io.videoplayerhub.com/gallery.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.178.2 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-178-2.lhr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ad4d57b8c2ac583a0b890f4bd88990ecbe76a7e1463f2508dd7cde85fa55aad9

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

x-amz-version-id
HyfDQPRwTVUvKVqE3e.nnmfw7fIrXN8d
Content-Encoding
gzip
Last-Modified
Tue, 24 Mar 2020 16:08:09 GMT
Server
AmazonS3
Age
20
Date
Tue, 24 Mar 2020 16:49:43 GMT
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Via
1.1 4278118a12a0d89e17a517194fb2e732.cloudfront.net (CloudFront)
Transfer-Encoding
chunked
X-Amz-Cf-Pop
LHR50-C1
Connection
keep-alive
X-Amz-Cf-Id
Y1enq39pdDgE9CHP_kxN1GpN9mnyWSnxuN0ool0joNzM9uLbdubeww==
prebid-analytics-3.6.2.js
a.pub.network/core/
350 KB
106 KB
Script
General
Full URL
https://a.pub.network/core/prebid-analytics-3.6.2.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:18b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
00a30ea925e1a7fdcb597a0c8fe4320e4a897495f6c24ad89bacfb9772d2d7e8

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:49 GMT
content-encoding
br
cf-cache-status
BYPASS
status
200
x-guploader-uploadid
AEnB2Uo01CYQh0BpGCJGYstANBAfWLZUivRmix_-y2C1lnoBbIkaNrt3Fsb7mUOxaGK4ojFKkB4yjOxKlV8V0KjtJPRjHtnuAQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
last-modified
Fri, 28 Feb 2020 20:11:08 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=zs10DQ==, md5=a/aOr3cetk5W0I0PmuPrIQ==
content-type
text/html
x-goog-generation
1582920668771105
cache-control
private
x-goog-stored-content-length
358240
cf-ray
5791e3392ff3dfb7-FRA
expires
Wed, 24 Mar 2021 16:49:49 GMT
location
d.pub.network/
51 B
498 B
XHR
General
Full URL
https://d.pub.network/location
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.71.214 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
214.71.188.35.bc.googleusercontent.com
Software
/
Resource Hash
6358c6ea8da1fcf2fc88c991a803c1a5f63b13247d7c546f1e3365ce17ec484d

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Tue, 24 Mar 2020 16:49:49 GMT
Access-Control-Allow-Credentials
true
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Transfer-Encoding
chunked
Content-Type
application/json
all.js
connect.facebook.net/en_US/
385 KB
111 KB
Script
General
Full URL
https://connect.facebook.net/en_US/all.js?hash=06a960e661ec99b397d60510c74a4eb1&ua=modern_es6
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
17bdae407969fa91483ae19f11829e22b6fe7bb58860feb97f813d0907501729
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
script
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
1cFDvseXJdS60QXl28xvsw==
status
200
date
Tue, 24 Mar 2020 16:49:48 GMT, Tue, 24 Mar 2020 16:49:48 GMT
expires
Wed, 24 Mar 2021 16:47:17 GMT
alt-svc
h3-27=":443"; ma=3600
content-length
113333
x-fb-debug
sedpwJbWRYJ0WcpPridVSzXw9po769SAqmnnZLwlkCChz3Fny7hIfr7PGdAV9/Tgt0UqwQZnFGEZGY0QeCdFQA==
x-fb-trip-id
420120009
x-fb-content-md5
a9d255ea83c2340af4be6bd072960baf
etag
"72d91a381a647bd8e3f39a6bb55b57e0"
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
/
r.skimresources.com/api/
Redirect Chain
  • https://r.skimresources.com/api/
  • https://r.skimresources.com/api/?xguid=01E46Q6FZWH548J2TC1A6QW2WA&persistence=1&checksum=027e9c786929d3d77f86ea60cae0a332780755a2948909637cadd2ec1771ea8d
0
-1 B
XHR
General
Full URL
https://r.skimresources.com/api/?xguid=01E46Q6FZWH548J2TC1A6QW2WA&persistence=1&checksum=027e9c786929d3d77f86ea60cae0a332780755a2948909637cadd2ec1771ea8d
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.59.101 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
101.59.190.35.bc.googleusercontent.com
Software
openresty/1.11.2.5 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 24 Mar 2020 16:49:49 GMT
via
1.1 google
server
openresty/1.11.2.5
access-control-allow-origin
https://www.bleepingcomputer.com
location
https://r.skimresources.com/api/?xguid=01E46Q6FZWH548J2TC1A6QW2WA&persistence=1&checksum=027e9c786929d3d77f86ea60cae0a332780755a2948909637cadd2ec1771ea8d
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status
307
access-control-allow-credentials
true
strict-transport-security
max-age=31536000
content-type
text/html
alt-svc
clear
content-length
193

Redirect headers

date
Tue, 24 Mar 2020 16:49:49 GMT
via
1.1 google
server
openresty/1.11.2.5
status
307
location
https://r.skimresources.com/api/?xguid=01E46Q6FZWH548J2TC1A6QW2WA&persistence=1&checksum=027e9c786929d3d77f86ea60cae0a332780755a2948909637cadd2ec1771ea8d
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
strict-transport-security
max-age=31536000
content-type
text/html
alt-svc
clear
content-length
193
robots.txt
t.skimresources.com/api/v2/ Frame A18A
0
105 B
Image
General
Full URL
https://t.skimresources.com/api/v2/robots.txt?__skimjs_preflight__please_ignore__=true&rnd=0.11936128862369255
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.201.67.47 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS
47.67.201.35.bc.googleusercontent.com
Software
Python/3.7 aiohttp/3.5.4 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

status
206
date
Tue, 24 Mar 2020 16:49:49 GMT
via
1.1 google
server
Python/3.7 aiohttp/3.5.4
alt-svc
clear
content-length
0
content-type
text/plain charset=UTF-8
px.gif
p.skimresources.com/
43 B
107 B
Image
General
Full URL
https://p.skimresources.com/px.gif?ch=1&rn=9.876948506041316
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
UploadServer /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:49 GMT
status
200
x-guploader-uploadid
AEnB2Ur5w4UvV1p8-8G03vDdxXu2LED5qToCm-6ebZ4HYLzjbOSuud-7P5pqFYsYoeOLnjyosBpC9dgXOwUqjFmux-tVh2D53Q
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
4
x-goog-stored-content-encoding
identity
content-length
43
x-hw
1585068589.cds020.pa1.hn,1585068589.cds041.pa1.c
last-modified
Tue, 23 Oct 2018 13:19:28 GMT
server
UploadServer
etag
"f837aa60b6fe83458f790db60d529fc9"
x-goog-hash
crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
x-goog-generation
1540300768038458
cache-control
public, max-age=7200
x-goog-stored-content-length
43
accept-ranges
bytes
content-type
image/gif
px.gif
p.skimresources.com/
43 B
494 B
Image
General
Full URL
https://p.skimresources.com/px.gif?ch=2&rn=9.876948506041316
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
UploadServer /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:49 GMT
status
200
x-guploader-uploadid
AEnB2Ur5w4UvV1p8-8G03vDdxXu2LED5qToCm-6ebZ4HYLzjbOSuud-7P5pqFYsYoeOLnjyosBpC9dgXOwUqjFmux-tVh2D53Q
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
4
x-goog-stored-content-encoding
identity
content-length
43
x-hw
1585068589.cds020.pa1.hn,1585068589.cds041.pa1.c
last-modified
Tue, 23 Oct 2018 13:19:28 GMT
server
UploadServer
etag
"f837aa60b6fe83458f790db60d529fc9"
x-goog-hash
crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
x-goog-generation
1540300768038458
cache-control
public, max-age=7200
x-goog-stored-content-length
43
accept-ranges
bytes
content-type
image/gif
cmp-3pc-check.html
static.quantcast.mgr.consensu.org/v31/ Frame 3DAD
0
0
Document
General
Full URL
https://static.quantcast.mgr.consensu.org/v31/cmp-3pc-check.html
Requested by
Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/cmp.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:ca00:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

:method
GET
:authority
static.quantcast.mgr.consensu.org
:scheme
https
:path
/v31/cmp-3pc-check.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

status
200
content-type
text/html
content-length
645
last-modified
Tue, 17 Mar 2020 20:57:17 GMT
x-amz-server-side-encryption
AES256
accept-ranges
bytes
server
AmazonS3
date
Tue, 24 Mar 2020 16:40:33 GMT
etag
"55b98270d639ef0c34781d9f03cce91f"
x-cache
Hit from cloudfront
via
1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
x-amz-cf-id
v-NXF1x10mcJATMB6qlmFkN1gxO2Mc8PlWOx1xbU-yWwy4WJzo6xsg==
age
566
snapback.png
www.bleepingcomputer.com/forums/public/style_images/master/
225 B
385 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_images/master/snapback.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e6f53994bd0a6283fdf4da164ad798f20405f97f93d533091fc34bbe69a3c57f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:49 GMT
cf-cache-status
HIT
age
1491148
cf-polished
pngoptimizer, origSize=320, status=vary_header_present
status
200
content-length
225
last-modified
Mon, 03 May 2010 23:34:02 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"140-485b90722ae80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/png
expires
Mon, 06 Apr 2020 10:37:21 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e3398fc9d8bd-AMS
cf-bgj
imgq:100
loading.gif
www.bleepingcomputer.com/forums/public/style_images/master/lightbox/
2 KB
2 KB
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_images/master/lightbox/loading.gif
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
61da0a4638505960ec52709b7df80d92683c56e13042079daf5f082fc9548d5e
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:49 GMT
cf-cache-status
HIT
age
729451
cf-polished
origSize=2767, status=vary_header_present
status
200
content-length
1588
last-modified
Thu, 18 Dec 2008 14:27:04 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"acf-45e52fc88de00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/gif
expires
Wed, 15 Apr 2020 06:12:18 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e3398fcbd8bd-AMS
cf-bgj
imgq:100
closelabel.gif
www.bleepingcomputer.com/forums/public/style_images/master/lightbox/
471 B
857 B
Image
General
Full URL
https://www.bleepingcomputer.com/forums/public/style_images/master/lightbox/closelabel.gif
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3e89beb7d66ef7d5e58dfcefd22a51e1a8ae452a49bc20d020418cf2b6c666d0
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 16:49:49 GMT
cf-cache-status
HIT
age
122751
cf-polished
origSize=483, status=vary_header_present
status
200
content-length
471
last-modified
Mon, 03 May 2010 23:34:02 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"1e3-485b90722ae80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
content-type
image/gif
expires
Wed, 22 Apr 2020 06:43:58 GMT
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
cf-ray
5791e3398fcfd8bd-AMS
cf-bgj
imgq:100
cb=gapi.loaded_1
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.JKCQ2Hvuo0E.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCOl3FsgYnTqVeIFUJJD2j4-pO09lQ/
95 KB
33 KB
Script
General
Full URL
https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.JKCQ2Hvuo0E.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCOl3FsgYnTqVeIFUJJD2j4-pO09lQ/cb=gapi.loaded_1
Requested by
Host: apis.google.com
URL: https://apis.google.com/js/plusone.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f911bdd7b17d93b0528cbd2ece126cc99e61bc25addfb75e3d2ff4a69e115c9d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 10 Mar 2020 20:49:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 15 Jan 2020 20:40:07 GMT
server
sffe
age
1195200
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
status
200
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
33741
x-xss-protection
0
expires
Wed, 10 Mar 2021 20:49:49 GMT
fastbutton
apis.google.com/se/0/_/+1/ Frame EAD8
0
0
Document
General
Full URL
https://apis.google.com/se/0/_/+1/fastbutton?usegapi=1&count=false&size=small&hl=en-GB&origin=https%3A%2F%2Fwww.bleepingcomputer.com&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.JKCQ2Hvuo0E.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCOl3FsgYnTqVeIFUJJD2j4-pO09lQ%2Fm%3D__features__
Requested by
Host: apis.google.com
URL: https://apis.google.com/js/plusone.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
apis.google.com
:scheme
https
:path
/se/0/_/+1/fastbutton?usegapi=1&count=false&size=small&hl=en-GB&origin=https%3A%2F%2Fwww.bleepingcomputer.com&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.JKCQ2Hvuo0E.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCOl3FsgYnTqVeIFUJJD2j4-pO09lQ%2Fm%3D__features__
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
NID=200=gpQkFulIHAQpT1WCi6MciQ4jt9yOFCZ1sqtmAv0JURa5EH0C0bAEFscqPexQGhRrCXRNThwBVsXFtJ-HnM06w8YK2X07Rd9h8gZewe7su4Gr-80ugiVFmbA2iCvmC1PdkF-1MPZlQKo2Ukwa2Wigx4fIh-GAU-Xkx3m2lZX2orQ
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

status
404
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Tue, 24 Mar 2020 16:49:49 GMT
content-security-policy-report-only
script-src 'report-sample' 'nonce-En+hKOxrEzlx6NCq4bBppA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
content-encoding
gzip
server
ESF
x-xss-protection
0
x-content-type-options
nosniff
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
integrator.js
adservice.google.de/adsid/
109 B
839 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.bleepingcomputer.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.bleepingcomputer.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
104
x-xss-protection
0
pubads_impl_2020030501.js
securepubads.g.doubleclick.net/gpt/
165 KB
60 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
sffe /
Resource Hash
8ee04e0441c9e51785d17ac835a93cf4d30d90826f87350b42ba233496a26f55
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 05 Mar 2020 14:08:10 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
61481
x-xss-protection
0
expires
Tue, 24 Mar 2020 16:49:49 GMT
cmpui-popup.js
static.quantcast.mgr.consensu.org/v31/
230 KB
61 KB
Script
General
Full URL
https://static.quantcast.mgr.consensu.org/v31/cmpui-popup.js
Requested by
Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/cmp.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:ca00:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
fb182fea82c5fe2b1b8e719010edd3a5bf03d79ff97f6c4e7865a9ead22b4be0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:40:27 GMT
content-encoding
gzip
last-modified
Tue, 17 Mar 2020 20:57:16 GMT
server
AmazonS3
age
1017
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript;charset=UTF-8
status
200
x-amz-cf-pop
FRA53-C1
x-amz-cf-id
UcjuiND-phglF5Keq_eSf0BmTsZEW1GoDQblXLFRkp3r68Fq2c30ZQ==
via
1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront)
/
r.skimresources.com/api/
152 B
495 B
XHR
General
Full URL
https://r.skimresources.com/api/?xguid=01E46Q6FZWH548J2TC1A6QW2WA&persistence=1&checksum=027e9c786929d3d77f86ea60cae0a332780755a2948909637cadd2ec1771ea8d
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.59.101 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
101.59.190.35.bc.googleusercontent.com
Software
openresty/1.11.2.5 /
Resource Hash
970765cc868595b606cdb103e1b779deb9f1f01091d19435f67a504f205b68ff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

date
Tue, 24 Mar 2020 16:49:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
openresty/1.11.2.5
status
200
vary
Accept-Encoding
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
strict-transport-security
max-age=31536000
content-type
application/json
alt-svc
clear
via
1.1 google
status
www.facebook.com/x/oauth/
0
0
Fetch
General
Full URL
https://www.facebook.com/x/oauth/status?client_id=942111685863795&input_token&origin=1&redirect_uri=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&sdk=joey&wants_cookie_data=false
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=06a960e661ec99b397d60510c74a4eb1&ua=modern_es6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.bleepingcomputer.com/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
x-fb-debug
iUd5uHxqfOIPoShe0rbVPndzoPJN4UhgIw9IMbGK7dnt0W17EMdr28nwLH0LNePa1jve3inUezo81qRpKD44RA==
fb-s
unknown
status
200
date
Tue, 24 Mar 2020 16:49:49 GMT, Tue, 24 Mar 2020 16:49:49 GMT
strict-transport-security
max-age=15552000; preload
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-expose-headers
fb-s
cache-control
private, no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
h3-27=":443"; ma=3600
content-length
0
x-content-type-options
nosniff
expires
Sat, 01 Jan 2000 00:00:00 GMT
postmessageRelay
accounts.google.com/o/oauth2/ Frame FC0D
0
0
Document
General
Full URL
https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.bleepingcomputer.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.JKCQ2Hvuo0E.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCOl3FsgYnTqVeIFUJJD2j4-pO09lQ%2Fm%3D__features__
Requested by
Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.JKCQ2Hvuo0E.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCOl3FsgYnTqVeIFUJJD2j4-pO09lQ/cb=gapi.loaded_1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-VURfj7xZxlT+I6OcxBl6dQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Xss-Protection 0

Request headers

:method
GET
:authority
accounts.google.com
:scheme
https
:path
/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.bleepingcomputer.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.JKCQ2Hvuo0E.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCOl3FsgYnTqVeIFUJJD2j4-pO09lQ%2Fm%3D__features__
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
NID=200=gpQkFulIHAQpT1WCi6MciQ4jt9yOFCZ1sqtmAv0JURa5EH0C0bAEFscqPexQGhRrCXRNThwBVsXFtJ-HnM06w8YK2X07Rd9h8gZewe7su4Gr-80ugiVFmbA2iCvmC1PdkF-1MPZlQKo2Ukwa2Wigx4fIh-GAU-Xkx3m2lZX2orQ
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

status
200
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Tue, 24 Mar 2020 16:49:49 GMT
content-security-policy
script-src 'report-sample' 'nonce-VURfj7xZxlT+I6OcxBl6dQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
content-encoding
gzip
server
ESF
x-xss-protection
0
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
vendorlist.json
vendorlist.consensu.org/
95 KB
18 KB
XHR
General
Full URL
https://vendorlist.consensu.org/vendorlist.json
Requested by
Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/cmp.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:9200:1:af78:4c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
da24f37a3ad56fc3b77e90a32126666618054524db6f13f7be6ad68bfa84340f

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Mar 2020 16:12:33 GMT
content-encoding
gzip
vary
Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age
434237
x-cache
Hit from cloudfront
status
200
access-control-allow-origin
*
last-modified
Thu, 19 Mar 2020 16:00:33 GMT
server
AmazonS3
access-control-max-age
604800
access-control-allow-methods
GET
x-amz-version-id
n4_Yc2xvVXv5oSengNl9TRy7S7VJGMOn
via
1.1 89cb19c6f2c9ed0983294d3b12e80e43.cloudfront.net (CloudFront)
cache-control
max-age=604800
x-amz-cf-pop
FRA53-C1
content-type
application/json; charset=utf-8
x-amz-cf-id
V5U_oOpC4D0jfmhYfDw221TnRQBQvpix2NPK_tafxK6DMCJiva0mkg==
apstag.js
c.amazon-adsystem.com/aax2/
87 KB
25 KB
Script
General
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.86.0.120 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-0-120.fra6.r.cloudfront.net
Software
Server /
Resource Hash
ac2a58f9d55c4642121cfb6f7e213cbc882bbdd75ef171ca8a07ed982ef693ce

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 23 Mar 2020 22:00:54 GMT
content-encoding
gzip
server
Server
age
67734
etag
1dcfbf3986ee8b9c3abbc67eb808ab43
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
public, max-age=86400
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
x-amz-cf-id
_mccjNZ640mZ_QojEHKtjRqJ3mN4qRV0LUqtaeGT3unGXVZg1xWD4w==
via
1.1 a7dcca466407f1871feceef50bc84272.cloudfront.net (CloudFront)
config.js
confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/
90 KB
19 KB
Script
General
Full URL
https://confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/config.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
11f8afeee2efd88c6fd1beb2de291f18e93bc6bad5e0f6049ac01329a4900c7d

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Tue, 24 Mar 2020 16:49:49 GMT
Content-Encoding
gzip
Age
705
X-Cache
HIT
Connection
keep-alive
Content-Length
19255
x-amz-id-2
NFNA2dRyi5gehRM8QwgphKXzWnoVHc5proTpAUR36NDoRyxQTJOY41K1dxyDOBL3FzKoH1AnOL4=
X-Served-By
cache-fra19135-FRA
Last-Modified
Tue, 24 Mar 2020 16:36:02 GMT
Server
AmazonS3
X-Timer
S1585068589.219106,VS0,VE0
ETag
"cafc0a61cde4dbe49100dbd764c7eb9b"
x-amz-request-id
B3C313DC81EC2CA3
Via
1.1 varnish
Cache-Control
public, max-age=900, stale-while-revalidate=3600
Accept-Ranges
bytes
Content-Type
text/javascript
X-Cache-Hits
21
v2
d.pub.network/floors/
2 KB
3 KB
XHR
General
Full URL
https://d.pub.network/floors/v2?key=535desktop
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.71.214 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
214.71.188.35.bc.googleusercontent.com
Software
/
Resource Hash
b5c49508cb6634bd049bc6086fb77f3ba315da719c4d541313e639c02138dae6

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Tue, 24 Mar 2020 16:49:49 GMT
Access-Control-Allow-Credentials
true
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Transfer-Encoding
chunked
Content-Type
application/json
page
t.skimresources.com/api/v2/
22 B
349 B
XHR
General
Full URL
https://t.skimresources.com/api/v2/page
Requested by
Host: s.skimresources.com
URL: https://s.skimresources.com/js/3687X620620.skimlinks.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.201.67.47 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS
47.67.201.35.bc.googleusercontent.com
Software
Python/3.7 aiohttp/3.5.4 /
Resource Hash
fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:49 GMT
via
1.1 google
x-content-type-options
nosniff
server
Python/3.7 aiohttp/3.5.4
access-control-allow-headers
Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
status
200
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/plain; charset=utf-8, application/javascript
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache, must-revalidate
access-control-allow-credentials
true
alt-svc
clear
content-length
22
iab
api.skimlinks.mgr.consensu.org/
772 B
643 B
XHR
General
Full URL
https://api.skimlinks.mgr.consensu.org/iab?nocache=1585068589160
Requested by
Host: s.skimresources.com
URL: https://s.skimresources.com/js/3687X620620.skimlinks.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.40.172 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
172.40.190.35.bc.googleusercontent.com
Software
nginx/1.14.0 /
Resource Hash
4898c2b9f8c2f931ef6a819d36e0019867931d9519af933ab4bd5edce724b2a8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 24 Mar 2020 16:49:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
nginx/1.14.0
access-control-allow-headers
*
status
200
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
via
1.1 google
beacon.js
ad-delivery.net/
1 KB
987 B
Script
General
Full URL
https://ad-delivery.net/beacon.js
Requested by
Host: freestar-io.videoplayerhub.com
URL: https://freestar-io.videoplayerhub.com/gallery.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.86.3.44 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-3-44.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
7e94fbebf526effec4239c82e5435a412d81ffc4bc9bddf13f9aa1170f6d803e

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

x-amz-version-id
null
content-encoding
gzip
last-modified
Tue, 31 Jan 2017 15:06:54 GMT
server
AmazonS3
age
3445
date
Tue, 24 Mar 2020 15:52:24 GMT
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/x-javascript
status
200
cache-control
max-age=3600
x-amz-cf-pop
FRA6-C1
x-amz-cf-id
KkiRSvFBLs0AUx2is96mo6FDKAyWYrIxPW8JrdIKWK1Kq8Pd3iSCBQ==
via
1.1 35c75b7f0ca8c787d67c8ebd22bc7fc3.cloudfront.net (CloudFront)
CookieAccess
api.quantcast.mgr.consensu.org/
30 B
597 B
XHR
General
Full URL
https://api.quantcast.mgr.consensu.org/CookieAccess
Requested by
Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/cmp.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.21 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-21.fra53.r.cloudfront.net
Software
/
Resource Hash
5a4061ff8312e2ad494bd984b7df966438232be64a3b284ab69f66c6705009a6

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 24 Mar 2020 16:49:49 GMT
content-encoding
gzip
x-amz-cf-pop
FRA53-C1
x-amzn-requestid
e7d4ff6f-62e1-4f42-9dab-9b1ccd355978
x-cache
Error from cloudfront
status
404
x-amz-apigw-id
J54HFHYoIAMF8Hg=
content-length
50
access-control-allow-origin
https://www.bleepingcomputer.com
x-amzn-trace-id
Root=1-5e7a3a2d-76a22b1639319ac8d097e4d6;Sampled=0
vary
Origin
access-control-allow-methods
GET, POST
content-type
application/json
via
1.1 d7524ff4a82155dd51a24800cf39deec.cloudfront.net (CloudFront)
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-headers
Content-Type
x-amz-cf-id
LxQvzOeVomMFK-y1zk_t5fhhQoWvk-7ZidWyTM0IuPZCBIHXfYFQYA==
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/
6 KB
3 KB
XHR
General
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.86.0.120 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-0-120.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 24 Mar 2020 01:36:35 GMT
content-encoding
gzip
vary
Origin
age
54795
x-cache
Hit from cloudfront
status
200
access-control-allow-origin
*
last-modified
Thu, 05 Mar 2020 08:28:46 GMT
server
AmazonS3
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
via
1.1 c05282a87474a55ae2a8dd2aa77d1233.cloudfront.net (CloudFront)
cache-control
public, max-age=86400
x-amz-cf-pop
FRA6-C1
x-amz-cf-id
ulvU34Bfqzr3ffZR9FNTI-V2U8p0qybMplDOVS7pILftyCqSMx-Uaw==
wrap.js
confiant-integrations.global.ssl.fastly.net/gpt/202003181643/
108 KB
37 KB
Script
General
Full URL
https://confiant-integrations.global.ssl.fastly.net/gpt/202003181643/wrap.js
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/config.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1457b36acce37419d32c4404c4ae21c4b788d076069351cad4d4c3e4600a37c8

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Tue, 24 Mar 2020 16:49:49 GMT
Content-Encoding
gzip
Age
793
X-Cache
HIT
Connection
keep-alive
Content-Length
36808
x-amz-id-2
Az5ZnVBUhbLvN3H9szHsoCq8pZKQnUtfagLVnaXPkEuj0u98qABLVMqiZVS5kta1CBbgA6alHhQ=
X-Served-By
cache-fra19135-FRA
Last-Modified
Thu, 19 Mar 2020 13:45:38 GMT
Server
AmazonS3
X-Timer
S1585068589.260280,VS0,VE0
ETag
"404a602404fd0f43d9a174f63e9d294f"
x-amz-request-id
A07FF8D5A6BE18CD
Via
1.1 varnish
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Content-Type
application/javascript; charset=utf-8
X-Cache-Hits
536
wrap.js
confiant-integrations.global.ssl.fastly.net/prebid/202003181643/
32 KB
13 KB
Script
General
Full URL
https://confiant-integrations.global.ssl.fastly.net/prebid/202003181643/wrap.js
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/config.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7b795ad72976ab8e30274524f9ae792a16ee8d13598a39b6674bb950439e0557

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Tue, 24 Mar 2020 16:49:49 GMT
Content-Encoding
gzip
Age
160
X-Cache
HIT
Connection
keep-alive
Content-Length
12241
x-amz-id-2
wfRyvwe6x7RtJNDRm0OE+c4Dyf41sp6nfVXIY4i1Jf11Bgyxa1qkhX+uK61tyMEDQtf3Kkn3Kqg=
X-Served-By
cache-fra19135-FRA
Last-Modified
Thu, 19 Mar 2020 13:45:40 GMT
Server
AmazonS3
X-Timer
S1585068589.290887,VS0,VE0
ETag
"374ac4239c490d2b558be4671b00ec24"
x-amz-request-id
DF728634B2CFBA3E
Via
1.1 varnish
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Content-Type
application/javascript; charset=utf-8
X-Cache-Hits
91
/
p.skimresources.com/ Frame A18A
Redirect Chain
  • https://sync.crwdcntrl.net/map/c=7505/tp=SKIM/?https%3A%2F%2Fx.skimresources.com%2F%3Fprovider%3Dlotame%26skim_mapping%3Dtrue%26provider_id%3D%24%7Bprofile_id%7D
  • https://sync.crwdcntrl.net/map/ct=y/c=7505/tp=SKIM/?https%3A%2F%2Fx.skimresources.com%2F%3Fprovider%3Dlotame%26skim_mapping%3Dtrue%26provider_id%3D%24%7Bprofile_id%7D
  • https://x.skimresources.com/?provider=lotame&skim_mapping=true&provider_id=ee70cc2d1a429c56bcf768ad2c12ffd7
  • https://p.skimresources.com/?provider_id=ee70cc2d1a429c56bcf768ad2c12ffd7&skim_mapping=true
43 B
244 B
Image
General
Full URL
https://p.skimresources.com/?provider_id=ee70cc2d1a429c56bcf768ad2c12ffd7&skim_mapping=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
UploadServer /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 24 Mar 2020 16:49:49 GMT
status
200
x-guploader-uploadid
AEnB2Uqwalzmzn9knfJH0GUkIZgG1j4Qy9HHT07VqrkwmLVsGpbOv6UAKlBU997Tr4DLW8gP6jznYgUkzNE-sAAqB4wIh8Wf5A
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
4
x-goog-stored-content-encoding
identity
content-length
43
x-hw
1585068589.cds020.pa1.hn,1585068589.cds044.pa1.sc,1585068589.cds044.pa1.pr
last-modified
Tue, 23 Oct 2018 13:19:28 GMT
server
UploadServer
etag
"f837aa60b6fe83458f790db60d529fc9"
x-goog-hash
crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
x-goog-generation
1540300768038458
cache-control
public, max-age=7200
x-goog-stored-content-length
43
accept-ranges
bytes
content-type
image/gif

Redirect headers

Location
https://p.skimresources.com?provider_id=ee70cc2d1a429c56bcf768ad2c12ffd7&skim_mapping=true
Date
Tue, 24 Mar 2020 16:49:49 GMT
Server
TornadoServer/2.4.1
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
0
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
bid
c.amazon-adsystem.com/e/dtb/
23 B
374 B
XHR
General
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&pid=5i0BX4HpqpTUz&cb=0&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_320x50_InContent_2%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.86.0.120 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-0-120.fra6.r.cloudfront.net
Software
Server /
Resource Hash
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 24 Mar 2020 16:49:49 GMT
via
1.1 a7dcca466407f1871feceef50bc84272.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA6-C1
status
200
vary
User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
timing-allow-origin
*
content-length
23
x-amz-cf-id
Nhb9veuZhrOwn5azOVdBmLPZU9rKc3cs3JhSsYfLAF7G5GaPi-p0GA==
like.php
www.facebook.com/plugins/ Frame 51EF
0
0
Document
General
Full URL
https://www.facebook.com/plugins/like.php?action=like&app_id=942111685863795&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D46%23cb%3Df3e04f63c509834%26domain%3Dwww.bleepingcomputer.com%26origin%3Dhttps%253A%252F%252Fwww.bleepingcomputer.com%252Ff202a9bfc0b44ec%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&layout=button_count&locale=en_US&sdk=joey&send=false&show_faces=false&width=150
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=06a960e661ec99b397d60510c74a4eb1&ua=modern_es6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.facebook.com
:scheme
https
:path
/plugins/like.php?action=like&app_id=942111685863795&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D46%23cb%3Df3e04f63c509834%26domain%3Dwww.bleepingcomputer.com%26origin%3Dhttps%253A%252F%252Fwww.bleepingcomputer.com%252Ff202a9bfc0b44ec%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&layout=button_count&locale=en_US&sdk=joey&send=false&show_faces=false&width=150
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

status
200
cache-control
private, no-cache, no-store, must-revalidate
pragma
no-cache
strict-transport-security
max-age=15552000; preload
content-encoding
br
timing-allow-origin
*
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
content-type
text/html; charset="utf-8"
x-fb-debug
Y8zA0J7UT2zKZAg+mNpupqFmn5a5gghNsk5wUjK4828Nns1t94Wn6G9JVLt6G6MVL4Z9bkuW5SC3hktQhLCkOg==
date
Tue, 24 Mar 2020 16:49:49 GMT Tue, 24 Mar 2020 16:49:49 GMT
alt-svc
h3-27=":443"; ma=3600
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
87562d3773ffab3d0716a70faa73c38b322fde3b8f265c3d646a3cea976ef67e

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
c
c.pub.network/
36 B
344 B
XHR
General
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.226.36.58 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
58.36.226.35.bc.googleusercontent.com
Software
/
Resource Hash
c57c86686c599401b7308e9bd9dd46be8790500a8423bf8b087a1603e735b9d0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Tue, 24 Mar 2020 16:49:49 GMT
Access-Control-Allow-Credentials
true
Content-Length
36
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type
text/plain;charset=utf-8
/
audit.quantcast.mgr.consensu.org/
80 B
485 B
XHR
General
Full URL
https://audit.quantcast.mgr.consensu.org/?log=;1585068589606;BleepingComputer.com;https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F;;;;;p,off,false,,1,en,31,194,true,false,false;displayConsentUi:mandatory,;GDPR-fpi5wc0o6wqckzu8ghix
Requested by
Host: static.quantcast.mgr.consensu.org
URL: https://static.quantcast.mgr.consensu.org/v31/cmpui-popup.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.86.3.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-3-23.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2d0f6b590917e7d27ddeb026b280d62dde9d03bb92f47f56342fc5f68f0c24eb

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 24 Mar 2020 01:54:23 GMT
via
1.1 7fcb41b117930690c299be9cec4a977a.cloudfront.net (CloudFront)
vary
Origin
age
53727
x-cache
Hit from cloudfront
status
200
content-length
80
last-modified
Mon, 11 Jun 2018 22:07:34 GMT
server
AmazonS3
etag
"0614149d8033903db5de46d6c184bbfd"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/html
access-control-allow-origin
*
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
x-amz-cf-id
tHXwhM4-0XQhlih--RlXz_j0u2wnqX82bqQnO3crsRbEqhTmPucpeA==
jquery.color-2.1.2.min.js
cluster-na.cdnjquery.com/color/
92 B
356 B
Script
General
Full URL
https://cluster-na.cdnjquery.com/color/jquery.color-2.1.2.min.js?integrity=btjsonpcallback1585068589637&checksum=%7B%22cbc%22%3A0%2C%22st%22%3A2%2C%22au%22%3A%5B%5D%2C%22hau%22%3A%5B%5D%2C%22ref%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F%22%2C%22aa%22%3A3%2C%22pgid%22%3A%2279863594-6def-11ea-99bd-15e34bf7f283%22%2C%22v%22%3A1%2C%22format%22%3A%22jsonp%22%7D&o=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&csVersion=1.21.48&clearThroughOptions=undefined
Requested by
Host: freestar-io.videoplayerhub.com
URL: https://freestar-io.videoplayerhub.com/gallery.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.2.175.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-2-175-122.compute-1.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash
272eee41293bc12ce331c1bfaba020f71b0ec3436d56cc35a31d7618ff332f93
Security Headers
Name Value
X-Frame-Options DENY

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Tue, 24 Mar 2020 16:49:50 GMT
Content-Encoding
gzip
Server
nginx/1.12.1
ETag
W/"5c-KjzKEj+juShyH2bV4wqGz/G2sH4"
X-Frame-Options
DENY
Content-Type
text/javascript; charset=utf-8
Charset
utf8
Connection
keep-alive
Content-Length
84
px.gif
ad-delivery.net/
43 B
385 B
Image
General
Full URL
https://ad-delivery.net/px.gif?ch=1&e=0.6571753592435612
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.86.3.44 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-3-44.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-amz-version-id
null
via
1.1 35c75b7f0ca8c787d67c8ebd22bc7fc3.cloudfront.net (CloudFront)
last-modified
Thu, 27 Jul 2017 18:59:05 GMT
server
AmazonS3
age
44548
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
x-cache
Hit from cloudfront
content-type
image/gif
status
200
date
Tue, 24 Mar 2020 06:22:07 GMT
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
content-length
43
x-amz-cf-id
cSV1FToKg_m_gLDv3PxcGjOrqd_7yD1tY2EsMtGCVjnjPuQh4W1KwQ==
pixel.gif
load77.exelator.com/ Frame A18A
Redirect Chain
  • https://x.skimresources.com/?provider=exelate
  • https://loadeu.exelator.com/load/?p=787&g=001&j=0&
  • https://loadeu.exelator.com/load/?p=787&g=001&j=0&&xl8blockcheck=1
  • https://load77.exelator.com/pixel.gif
43 B
273 B
Image
General
Full URL
https://load77.exelator.com/pixel.gif
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
195.181.175.55 Frankfurt am Main, Germany, ASN60068 (CDN77, GB),
Reverse DNS
unn-195-181-175-55.datapacket.com
Software
CDN77-Turbo /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 24 Mar 2020 16:49:50 GMT
last-modified
Wed, 25 Oct 2017 17:03:56 GMT
server
CDN77-Turbo
access-control-allow-origin
*
x-edge-location
frankfurtDE
etag
"59f0c3fc-2b"
x-cache
HIT
content-type
image/gif
status
200
x-edge-ip
195.181.175.53
x-age
441999
accept-ranges
bytes
content-length
43

Redirect headers

date
Tue, 24 Mar 2020 16:49:49 GMT
server
nginx/1.14.0
x-powered-by
Undertow/1
location
https://load77.exelator.com/pixel.gif
p3p
policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
status
302
cache-control
no-cache
access-control-allow-credentials
true
content-type
image/gif
content-length
0
24
web.hb.ad.cpe.dotomi.com/s2s/header/
318 B
509 B
XHR
General
Full URL
https://web.hb.ad.cpe.dotomi.com/s2s/header/24
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:fa8:8806:16::1460 , Sweden, ASN41041 (VCLK-EU-, SE),
Reverse DNS
Software
nginx /
Resource Hash
98a2c6fe0f10d0fa202cdd6df45a7260c82e24222f299feef2fb4c9b5c495948

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
status
200
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache
access-control-allow-credentials
true
content-length
318
expires
0
v1
btlr.sharethrough.com/WYu2BXv1/
0
119 B
XHR
General
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=1047d3e99af8bb4&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.93.119.217 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-93-119-217.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Tue, 24 Mar 2020 16:49:50 GMT
access-control-allow-credentials
true
access-control-allow-origin
https://www.bleepingcomputer.com
vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/
0
119 B
XHR
General
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=bDraMWgeoLM4KHJBzFQ8heMv&bidId=1110fd59b290d2d&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.93.119.217 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-93-119-217.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Tue, 24 Mar 2020 16:49:50 GMT
access-control-allow-credentials
true
access-control-allow-origin
https://www.bleepingcomputer.com
vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/
0
119 B
XHR
General
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=12157e6a84a1e27&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.93.119.217 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-93-119-217.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Tue, 24 Mar 2020 16:49:50 GMT
access-control-allow-credentials
true
access-control-allow-origin
https://www.bleepingcomputer.com
vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/
0
119 B
XHR
General
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=bDraMWgeoLM4KHJBzFQ8heMv&bidId=132295584e2cd37&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.93.119.217 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-93-119-217.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Tue, 24 Mar 2020 16:49:50 GMT
access-control-allow-credentials
true
access-control-allow-origin
https://www.bleepingcomputer.com
vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/
0
119 B
XHR
General
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=149ef8d75227fcc&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.93.119.217 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-93-119-217.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Tue, 24 Mar 2020 16:49:50 GMT
access-control-allow-credentials
true
access-control-allow-origin
https://www.bleepingcomputer.com
vary
Origin
prebid
ib.adnxs.com/ut/v3/
378 B
1 KB
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.200 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
308.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
c999311887e70c7bc06144c364bc5c54f7fe11c740cf0eba8e5754c0afe30d7d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 24 Mar 2020 16:49:52 GMT
X-Proxy-Origin
194.187.251.57; 194.187.251.57; 308.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.41:80
AN-X-Request-Uuid
c87ef435-4bae-4f7d-9a28-5acc27dee168
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
378
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/
263 B
2 KB
XHR
General
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=05864f03-2ff6-4a77-a34d-0d73cd41a8c2&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.447001085173399
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
781a78ca3fab782126c9e219fc35eeefb84f44316bf1b220a849847b42c1b688

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 24 Mar 2020 16:49:50 GMT
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/json
Keep-Alive
timeout=5, max=168
Content-Length
263
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/
263 B
2 KB
XHR
General
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=78bb5d96-e893-475e-8f68-c25208380c5f&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.5498631967775385
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
48d6e3c1f8af64f286c4f199c5de33cb1be76d36fd2042bd9c1bb2481ee495ee

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 24 Mar 2020 16:49:50 GMT
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/json
Keep-Alive
timeout=5, max=362
Content-Length
263
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/
240 B
2 KB
XHR
General
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=987a6bf6-1bf4-43e4-aa91-335bb777324a&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.091638554747284
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
76d7f8e240594fecc1ef4d08777d6fde32d40d4e2761aa21c2b2357a05a66095

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 24 Mar 2020 16:49:50 GMT
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/json
Keep-Alive
timeout=5, max=354
Content-Length
240
Expires
Wed, 17 Sep 1975 21:32:10 GMT
auction
tlx.3lift.com/header/
19 B
483 B
XHR
General
Full URL
https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&tmax=1200
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.157.40.44 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-40-44.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
status
200
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-type
application/json; charset=utf-8
content-length
19
x-xss-protection
0
expires
Thu, 15 Oct 1992 20:10:00 GMT
prebid
ib.adnxs.com/ut/v3/
379 B
1 KB
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.200 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
308.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
0d65062d11c6c427b3efe1049e8df05b398260fbc78a2c5ac7a5e05a1c9e52ee
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 24 Mar 2020 16:49:52 GMT
X-Proxy-Origin
194.187.251.57; 194.187.251.57; 308.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.80:80
AN-X-Request-Uuid
dc600170-a390-498f-b15e-2759f77c40c4
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
379
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=61b14b3255fa6b8;misc=1585068590542
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=61b14b3255fa6b8;misc=1585068590542;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=61b14b3255fa6b8;misc=1585068590542
0
-1 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=61b14b3255fa6b8;misc=1585068590542
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
access-control-allow-origin
https://www.bleepingcomputer.com
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=61b14b3255fa6b8;misc=1585068590542
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status
302
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=61b14b3255fa6b8;misc=1585068590542
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=62eb4c1c9ae5c45;misc=1585068590543
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=62eb4c1c9ae5c45;misc=1585068590543;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=62eb4c1c9ae5c45;misc=1585068590543
0
-1 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=62eb4c1c9ae5c45;misc=1585068590543
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
access-control-allow-origin
https://www.bleepingcomputer.com
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=62eb4c1c9ae5c45;misc=1585068590543
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status
302
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=62eb4c1c9ae5c45;misc=1585068590543
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=635519aa1e3d53d;misc=1585068590543
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=635519aa1e3d53d;misc=1585068590543;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=635519aa1e3d53d;misc=1585068590543
0
-1 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=635519aa1e3d53d;misc=1585068590543
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
access-control-allow-origin
https://www.bleepingcomputer.com
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=635519aa1e3d53d;misc=1585068590543
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status
302
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=635519aa1e3d53d;misc=1585068590543
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=644cbeb9e5d6a0b;misc=1585068590543
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=644cbeb9e5d6a0b;misc=1585068590543;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=644cbeb9e5d6a0b;misc=1585068590543
0
-1 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=644cbeb9e5d6a0b;misc=1585068590543
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
access-control-allow-origin
https://www.bleepingcomputer.com
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=644cbeb9e5d6a0b;misc=1585068590543
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status
302
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=644cbeb9e5d6a0b;misc=1585068590543
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=65a841ff63cdc0b;misc=1585068590543
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=65a841ff63cdc0b;misc=1585068590543;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=65a841ff63cdc0b;misc=1585068590543
0
-1 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=65a841ff63cdc0b;misc=1585068590543
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
access-control-allow-origin
https://www.bleepingcomputer.com
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=65a841ff63cdc0b;misc=1585068590543
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status
302
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=65a841ff63cdc0b;misc=1585068590543
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=660a38cfdd8ff61;misc=1585068590543
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=660a38cfdd8ff61;misc=1585068590543;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=660a38cfdd8ff61;misc=1585068590543
0
-1 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=660a38cfdd8ff61;misc=1585068590543
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
access-control-allow-origin
https://www.bleepingcomputer.com
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=660a38cfdd8ff61;misc=1585068590543
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status
302
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=660a38cfdd8ff61;misc=1585068590543
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=673b4b033264c56;misc=1585068590543
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=673b4b033264c56;misc=1585068590543;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=673b4b033264c56;misc=1585068590543
0
-1 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=673b4b033264c56;misc=1585068590543
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
access-control-allow-origin
https://www.bleepingcomputer.com
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=673b4b033264c56;misc=1585068590543
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status
302
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=673b4b033264c56;misc=1585068590543
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
arj
freestar-d.openx.net/w/1.0/
175 B
577 B
XHR
General
Full URL
https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&ch=windows-1252&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=05864f03-2ff6-4a77-a34d-0d73cd41a8c2%2C78bb5d96-e893-475e-8f68-c25208380c5f%2C987a6bf6-1bf4-43e4-aa91-335bb777324a&nocache=1585068590545&pubcid=cc6823de-742e-4b3d-9dbb-2c8d3b7ad675&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=728x90%2C970x90%2C970x250%7C728x90%2C970x90%2C970x250%7C728x90&divIds=bleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Cbleepingcomputer_728x90_320x50_InContent_2&auid=540959250%2C540959250%2C540959250&
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.179.0 /
Resource Hash
eb9249fb81640ba4dfc1c8294035105d330ef0c04ddc7e539a3acdbcec34305d

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
content-encoding
gzip
server
OXGW/16.179.0
status
200
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
164
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
cygnus
as-sec.casalemedia.com/
25 B
997 B
XHR
General
Full URL
https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%224928732926f63de%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2250b0f981bd39671%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22511759c51fa643d%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%225296c1e062c3ee2%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2253ad762a59dc9f9%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2254628018b26f9ef%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22559d8294a4e9835%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2256146483d6cce0c%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-101-185-51.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
70143c43ddb939c012fc180c08f3a1373d4f40297510c4a3207b479cec263686

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 24 Mar 2020 16:49:50 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
45
Expires
Tue, 24 Mar 2020 16:49:50 GMT
v1
dmx.districtm.io/b/
0
263 B
XHR
General
Full URL
https://dmx.districtm.io/b/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Tue, 24 Mar 2020 16:49:50 GMT
server
cloudflare
cf-ray
5791e3433de7c785-AMS
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
ADTECH;apid=1A7a77982c-6def-11ea-ba5b-1274c1fe5bf6;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=644cbeb9e5d6a0b;misc=1585068590543
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=644cbeb9e5d6a0b;misc=1585068590543
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A7a77982c-6def-11ea-ba5b-1274c1fe5bf6;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=644cbeb9e5d6a0b;misc=15...
0
-1 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A7a77982c-6def-11ea-ba5b-1274c1fe5bf6;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=644cbeb9e5d6a0b;misc=1585068590543
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
access-control-allow-origin
https://www.bleepingcomputer.com
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A7a77982c-6def-11ea-ba5b-1274c1fe5bf6;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=644cbeb9e5d6a0b;misc=1585068590543
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status
302
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A7a77982c-6def-11ea-ba5b-1274c1fe5bf6;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=644cbeb9e5d6a0b;misc=1585068590543
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;apid=1A7a77a060-6def-11ea-bacd-12052abf3156;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=65a841ff63cdc0b;misc=1585068590543
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=65a841ff63cdc0b;misc=1585068590543
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A7a77a060-6def-11ea-bacd-12052abf3156;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=65a841ff63cdc0b;misc=15...
0
-1 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A7a77a060-6def-11ea-bacd-12052abf3156;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=65a841ff63cdc0b;misc=1585068590543
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
access-control-allow-origin
https://www.bleepingcomputer.com
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A7a77a060-6def-11ea-bacd-12052abf3156;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=65a841ff63cdc0b;misc=1585068590543
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status
302
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A7a77a060-6def-11ea-bacd-12052abf3156;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=65a841ff63cdc0b;misc=1585068590543
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;apid=1A7a7808f2-6def-11ea-ad61-129e10192f46;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=62eb4c1c9ae5c45;misc=1585068590543
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=62eb4c1c9ae5c45;misc=1585068590543
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A7a7808f2-6def-11ea-ad61-129e10192f46;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=62eb4c1c9ae5c45;misc=15...
0
-1 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A7a7808f2-6def-11ea-ad61-129e10192f46;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=62eb4c1c9ae5c45;misc=1585068590543
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
access-control-allow-origin
https://www.bleepingcomputer.com
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A7a7808f2-6def-11ea-ad61-129e10192f46;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=62eb4c1c9ae5c45;misc=1585068590543
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status
302
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A7a7808f2-6def-11ea-ad61-129e10192f46;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=62eb4c1c9ae5c45;misc=1585068590543
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;apid=1A7a78445c-6def-11ea-8043-121b89dbed5a;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=673b4b033264c56;misc=1585068590543
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=673b4b033264c56;misc=1585068590543
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A7a78445c-6def-11ea-8043-121b89dbed5a;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=673b4b033264c56;misc=15...
0
-1 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A7a78445c-6def-11ea-8043-121b89dbed5a;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=673b4b033264c56;misc=1585068590543
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
access-control-allow-origin
https://www.bleepingcomputer.com
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A7a78445c-6def-11ea-8043-121b89dbed5a;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=673b4b033264c56;misc=1585068590543
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status
302
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A7a78445c-6def-11ea-8043-121b89dbed5a;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=673b4b033264c56;misc=1585068590543
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;apid=1A7a77982c-6def-11ea-ba5b-1274c1fe5bf6;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=644cbeb9e5d6a0b;misc=1585068590543
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/
0
0

ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=61b14b3255fa6b8;misc=1585068590542
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/
604 B
735 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=61b14b3255fa6b8;misc=1585068590542
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
e979a79dc02c25b72c9d268c5d6248c27c8a3f57e2bcc3e8cafa97a2d4a817f6

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-type
application/json
content-length
604
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=635519aa1e3d53d;misc=1585068590543
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/
605 B
760 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=635519aa1e3d53d;misc=1585068590543
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
23b4fe351d658defec49b990d1d9efd9879459ef18e460213f2145b5e87ab56b

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-type
application/json
content-length
605
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=660a38cfdd8ff61;misc=1585068590543
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/
606 B
737 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=660a38cfdd8ff61;misc=1585068590543
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
2a7d4a2616cf9618b236c398bb0bb8fef4df2e0b461248a15d40ded342dc555a

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:50 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-type
application/json
content-length
606
expires
Mon, 15 Jun 1998 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
5 KB
2 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2628311192819134&correlator=2267247213136126&output=ldjh&impl=fifs&adsid=NT&eid=21062452&vrg=2020030501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200324&iu_parts=15184186%2Cbleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Cbleepingcomputer_728x90_320x50_InContent_2%2Cbleepingcomputer_1x1_pushdown&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x90%7C970x90%7C970x250%2C728x90%7C970x90%7C970x250%2C728x90%2C1x1&prev_scp=amznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7C&eri=1&cust_params=user-agent%3DChrome&cookie_enabled=1&bc=31&abxe=1&lmt=1585068590&dt=1585068590919&dlt=1585068588613&idt=529&frm=20&biw=1600&bih=1200&oid=3&adxs=436%2C436%2C524%2C800&adys=231%2C7699%2C1551%2C0&adks=960084856%2C976516616%2C1808008496%2C2697902146&ucis=1%7C2%7C3%7C4&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&dssz=84&icsg=2252899321161980&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x105%7C1392x105%7C1177x152%7C1600x7969&msz=970x90%7C1392x90%7C1177x90%7C1600x1&ga_vid=1846113363.1585068589&ga_sid=1585068591&ga_hid=98792429&fws=4%2C4%2C4%2C4&ohw=1600%2C1600%2C1600%2C1600
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
f38f1f7d199b34e6221e05a075e0736c41d6d7353fdb3406ad50db9167f0af0c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 24 Mar 2020 16:49:51 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
2137
x-xss-protection
0
google-lineitem-id
-2,-2,-2,4893662829
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2,-2,-2,138254592126
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2020030501.js
securepubads.g.doubleclick.net/gpt/
69 KB
25 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
sffe /
Resource Hash
ffdc18ac8f47bcd50dd9c33532c334e7073717a62b367d95b9cb1561048547dc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 05 Mar 2020 14:08:10 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
25689
x-xss-protection
0
expires
Tue, 24 Mar 2020 16:49:50 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers

ADTECH;apid=1A7a77a060-6def-11ea-bacd-12052abf3156;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=65a841ff63cdc0b;misc=1585068590543
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/
605 B
759 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A7a77a060-6def-11ea-bacd-12052abf3156;cfp=1;rndc=1585068589;v=2;cmd=bid;cors=yes;alias=65a841ff63cdc0b;misc=1585068590543
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
3e3f47fbbf144c3d1a61ff6a7f75f735b987821ba23cad6876dd06cf1ebb7510

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-type
application/json
content-length
605
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;apid=1A7a78445c-6def-11ea-8043-121b89dbed5a;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=673b4b033264c56;misc=1585068590543
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/
606 B
737 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A7a78445c-6def-11ea-8043-121b89dbed5a;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=673b4b033264c56;misc=1585068590543
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
2b1973900c2619efe19a4ab5f0621e5aa82713628d1b4da9116db7c1fd700551

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-type
application/json
content-length
606
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;apid=1A7a7808f2-6def-11ea-ad61-129e10192f46;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=62eb4c1c9ae5c45;misc=1585068590543
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/
606 B
737 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A7a7808f2-6def-11ea-ad61-129e10192f46;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=62eb4c1c9ae5c45;misc=1585068590543
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
9bb1240bcc5820503f4b7bffe45b39a39f39950904618d2a0fee960f3b71f920

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-type
application/json
content-length
606
expires
Mon, 15 Jun 1998 00:00:00 GMT
bid
c.amazon-adsystem.com/e/dtb/
23 B
375 B
XHR
General
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&pid=Iy6WxXrUF6nWV&cb=1&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.86.0.120 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-0-120.fra6.r.cloudfront.net
Software
Server /
Resource Hash
89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 24 Mar 2020 16:49:51 GMT
via
1.1 a7dcca466407f1871feceef50bc84272.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA6-C1
status
200
vary
User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
timing-allow-origin
*
content-length
23
x-amz-cf-id
l48XtErH-ZYciSObYIKd1wvQ0My0b_hdkUKlEnH_CHg9_FuRsImJcg==
bid
c.amazon-adsystem.com/e/dtb/
23 B
374 B
XHR
General
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&pid=kKSYHB9NiwX5H&cb=2&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.86.0.120 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-0-120.fra6.r.cloudfront.net
Software
Server /
Resource Hash
5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 24 Mar 2020 16:49:51 GMT
via
1.1 a7dcca466407f1871feceef50bc84272.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA6-C1
status
200
vary
User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
timing-allow-origin
*
content-length
23
x-amz-cf-id
6RUUut9GZ-lnWgdJmO0olIHBJso-NblfulqOBa7xB0quMhKfwMc8sg==
bid
c.amazon-adsystem.com/e/dtb/
23 B
375 B
XHR
General
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&pid=ZSxUOXQTkXYnC&cb=3&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_320x50_InContent_2%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.86.0.120 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-0-120.fra6.r.cloudfront.net
Software
Server /
Resource Hash
1c4777fe3a673a05492e27d08032cc91c23ac5389897c9235b09b8b0f5a74db3

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 24 Mar 2020 16:49:51 GMT
via
1.1 a7dcca466407f1871feceef50bc84272.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA6-C1
status
200
vary
User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
timing-allow-origin
*
content-length
23
x-amz-cf-id
IeE9YKkPQm_8YL4vnOuYoG-FDedQJTEVyrgS2cD2D-5_5XhY8li-Hw==
view
securepubads.g.doubleclick.net/pcs/ Frame 7E47
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv-2C56Umcfc9NMysR5DTKUlnEQAY_RdqykDuEsyiwmpxbpn7xb_c97Q0Jml6HYxHn5GxB3gcCaMvYOANeJoozyGcG8_shObXB1dFH52_9mrHpVCft7qFKBsucHsNyTdUITDvUxpyi4aLsOJ6ta-punHuuAuHc8qsdu_Imsi3M8TzK9N2IQfRt_NaZdMEE7sxz_v8zRqkw61e9NEw3YJ38PbK6espQPFxI-_sUmjMy-5SChdT5Zz1y4xpuKOB2MEp5e4cJG3XLZcFE5rl80_oUJRvLH_8o2ef9PpUYR4e9xKM9s&sai=AMfl-YTOlr9m8-06bbIqdOgID1uA1sigaoQwiqYGirJrCfqElLCJ59yRUssIfIcqiElI5N09gfcD28HReUmbl7GhGAVH6S8e-RgB_iEd0zfdrA&sig=Cg0ArKJSzILDBXnu1mh4EAE&urlfix=1&adurl=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers

timing-allow-origin
*
date
Tue, 24 Mar 2020 16:49:51 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 24 Mar 2020 16:49:51 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 7E47
74 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5a1b118736ba9dc41f144f350574bec748a1ba0e8b355a99cbfe570ad236b50e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1584962844677376"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28201
x-xss-protection
0
expires
Tue, 24 Mar 2020 16:49:51 GMT
osd.js
www.googletagservices.com/activeview/js/current/
74 KB
27 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
351e508c1da4f9d1535747086accb41121466a52044aa868eba4a36009fdb101
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1584962844677376"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
27941
x-xss-protection
0
expires
Tue, 24 Mar 2020 16:49:51 GMT
sodar
pagead2.googlesyndication.com/getconfig/
7 KB
5 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020030501&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
63f573d22389d46e98f454e27c0a7489d1321767e6e5fdf0147218ea2ba7349a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 24 Mar 2020 16:49:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
5225
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/
14 KB
5 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 24 Mar 2020 16:49:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1582746470043195"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
5456
x-xss-protection
0
expires
Tue, 24 Mar 2020 16:49:51 GMT
c
c.pub.network/
36 B
344 B
XHR
General
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.226.36.58 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
58.36.226.35.bc.googleusercontent.com
Software
/
Resource Hash
e12fd28b1ae95db1f1a9ccf9c6a10126620766a7fca7447bd5d59c7fdb5f9478

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Tue, 24 Mar 2020 16:49:51 GMT
Access-Control-Allow-Credentials
true
Content-Length
36
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type
text/plain;charset=utf-8
prebid
ib.adnxs.com/ut/v3/
145 B
1 KB
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.200 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
308.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
1fee2ab8ca44cafc492ea3994cbbee5b066966ca34919768992ad8d0b74c9165
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 24 Mar 2020 16:49:53 GMT
X-Proxy-Origin
194.187.251.57; 194.187.251.57; 308.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.52:80
AN-X-Request-Uuid
44b82aa4-34c2-4134-baf9-80657c28dd89
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
145
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
v1
dmx.districtm.io/b/
0
162 B
XHR
General
Full URL
https://dmx.districtm.io/b/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Tue, 24 Mar 2020 16:49:51 GMT
server
cloudflare
cf-ray
5791e348bfb3c785-AMS
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
24
web.hb.ad.cpe.dotomi.com/s2s/header/
192 B
382 B
XHR
General
Full URL
https://web.hb.ad.cpe.dotomi.com/s2s/header/24
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:fa8:8806:16::1460 , Sweden, ASN41041 (VCLK-EU-, SE),
Reverse DNS
Software
nginx /
Resource Hash
3293c5f2531772cf8d1c6518dd1be400301d77916920b8c1892a1915274a9ff1

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
server
nginx
status
200
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache
access-control-allow-credentials
true
content-length
192
expires
0
ADTECH;v=2;cmd=bid;cors=yes;alias=1009e40f4e241a58;misc=1585068591464;
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/
605 B
736 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1009e40f4e241a58;misc=1585068591464;
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
3279cb3a3f494df929b499b840c3bc4082c3700103f003859d830e3d8b115063

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-type
application/json
content-length
605
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;v=2;cmd=bid;cors=yes;alias=10189977f9411924;misc=1585068591464;
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/
605 B
736 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=10189977f9411924;misc=1585068591464;
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
d903935e1b2e1522b350ae6c220977d84b27286b246d66f0123b2ca98df71d10

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-type
application/json
content-length
605
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;v=2;cmd=bid;cors=yes;alias=102bfa5db50e4b7d;misc=1585068591464;
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/
605 B
736 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=102bfa5db50e4b7d;misc=1585068591464;
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
2ec8793fb4ee5ddbd6a7aed8c3fbb460e4a45f94db9bca60e321da42a2188106

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-type
application/json
content-length
605
expires
Mon, 15 Jun 1998 00:00:00 GMT
prebid
ib.adnxs.com/ut/v3/
145 B
1 KB
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.200 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
308.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
509c7947a6d75ef3578657f940c2da777ba48c3ba78ea9293fe59c248118aa66
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 24 Mar 2020 16:49:53 GMT
X-Proxy-Origin
194.187.251.57; 194.187.251.57; 308.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.141:80
AN-X-Request-Uuid
67015a39-1c2e-4036-ac3a-36df82dd910e
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
145
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
auction
tlx.3lift.com/header/
19 B
483 B
XHR
General
Full URL
https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&tmax=1200
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.157.40.44 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-40-44.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
status
200
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-type
application/json; charset=utf-8
content-length
19
x-xss-protection
0
expires
Thu, 15 Oct 1992 20:10:00 GMT
v1
btlr.sharethrough.com/WYu2BXv1/
0
119 B
XHR
General
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=902e3811de992b&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.93.119.217 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-93-119-217.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Tue, 24 Mar 2020 16:49:51 GMT
access-control-allow-credentials
true
access-control-allow-origin
https://www.bleepingcomputer.com
vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/
0
119 B
XHR
General
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=bDraMWgeoLM4KHJBzFQ8heMv&bidId=9172e93f4933338&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.93.119.217 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-93-119-217.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Tue, 24 Mar 2020 16:49:51 GMT
access-control-allow-credentials
true
access-control-allow-origin
https://www.bleepingcomputer.com
vary
Origin
arj
freestar-d.openx.net/w/1.0/
175 B
373 B
XHR
General
Full URL
https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&ch=windows-1252&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=26890701-aeaa-494c-85ad-e240f9643224&nocache=1585068591466&pubcid=cc6823de-742e-4b3d-9dbb-2c8d3b7ad675&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=728x90%2C970x90%2C970x250&divIds=bleepingcomputer_728x90_970x90_970x250_320x50_ATF&auid=540959250&
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.179.0 /
Resource Hash
d9c1e24df0b147b55f3c37ab1ed4082720620ba4fb66dcf5132b57267ec59ceb

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
content-encoding
gzip
server
OXGW/16.179.0
status
200
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
166
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
cygnus
as-sec.casalemedia.com/
25 B
1 KB
XHR
General
Full URL
https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%2294dc481e95af637%22%2C%22imp%22%3A%5B%7B%22id%22%3A%229563652f44564d1%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22960f690b6088ca7%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2297303678b874d53%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-101-185-51.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
d79c06d7a6cedcb36e87c4fc81ab9bc490f526139eb30ecfaf35e771c8c4f35f

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 24 Mar 2020 16:49:51 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
45
Expires
Tue, 24 Mar 2020 16:49:51 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/
263 B
1 KB
XHR
General
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=26890701-aeaa-494c-85ad-e240f9643224&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.33489100799821747
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
7b7ebe6979063a4bc7e94fad82f8e9c192b480bae435101a285dc9879c35a59a

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 24 Mar 2020 16:49:51 GMT
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/json
Keep-Alive
timeout=5, max=447
Content-Length
263
Expires
Wed, 17 Sep 1975 21:32:10 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame F65A
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/209/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
5727
date
Tue, 24 Mar 2020 15:59:46 GMT
expires
Wed, 24 Mar 2021 15:59:46 GMT
last-modified
Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
3005
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
gen_204
pagead2.googlesyndication.com/pagead/
0
58 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020030501&jk=2628311192819134&bg=!Xl2lXUVYFkX4JbZqRBUCAAAAOlIAAAAKmQFkQ8DQltdXnu-XnbfDsp1n-bpaY-wjc3tBgqUDlLDotL6Gc1DYLzn803fZgmBcF41-esp7yTHFoz2BSghvRq9SnAgtuBYt94LjQWEWKwHVdSwClslqQfejbxhgMOJYNzL8J6Vap_LQRuH6t7I_BoD8mPii1hnLFsPTKDigS6Z-Z-ElLNrs9zOsVWTo6Y33pKIXs6ULsrdhA3hJ8Lr8EakzHN-CAWotLInMI18MFoU0YwpoL1Nhy462JtY02gMIhWxPoii6zBSA2VHApF2LS3y7jFzWF077n9kbaTjRCepcuw7Qf8evGnNXDRTZ3IMWi5MXgcgPzQISpTWFHFRoEIrI3QdiLnb1LdZxvGGnYXSd54Bp9M2ziqCJ10jBqoAyan6lZwT_JvjPcgYhCzen6FDS1YMRLNpacRWDAzsTeozIgkpOCH9-s_EEuP-SsuPBeUwuZFhwbtXlo1rAHzf1i4XHlxksN8M
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
204
cache-control
no-cache, must-revalidate
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=15936571e64c8e16;misc=1585068591744
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=15936571e64c8e16;misc=1585068591744;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=15936571e64c8e16;misc=1585068591744
0
-1 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=15936571e64c8e16;misc=1585068591744
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
server
nginx
access-control-allow-origin
https://www.bleepingcomputer.com
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=15936571e64c8e16;misc=1585068591744
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status
302
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=15936571e64c8e16;misc=1585068591744
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=160c5ff9281107a3;misc=1585068591744
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=160c5ff9281107a3;misc=1585068591744;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=160c5ff9281107a3;misc=1585068591744
0
-1 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=160c5ff9281107a3;misc=1585068591744
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
server
nginx
access-control-allow-origin
https://www.bleepingcomputer.com
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=160c5ff9281107a3;misc=1585068591744
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status
302
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=160c5ff9281107a3;misc=1585068591744
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=161969f8aca6eff9;misc=1585068591744
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=161969f8aca6eff9;misc=1585068591744;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=161969f8aca6eff9;misc=1585068591744
0
-1 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=161969f8aca6eff9;misc=1585068591744
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
server
nginx
access-control-allow-origin
https://www.bleepingcomputer.com
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=161969f8aca6eff9;misc=1585068591744
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status
302
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=161969f8aca6eff9;misc=1585068591744
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
arj
freestar-d.openx.net/w/1.0/
173 B
370 B
XHR
General
Full URL
https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&ch=windows-1252&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=da31999f-8ad1-404f-ad83-cdc09b179347&nocache=1585068591745&pubcid=cc6823de-742e-4b3d-9dbb-2c8d3b7ad675&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=728x90%2C970x90%2C970x250&divIds=bleepingcomputer_728x90_970x90_970x250_320x50_BTF&auid=540959250&
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.179.0 /
Resource Hash
7bcd14157e953f4628d18d238be8e9495c490942e33f161f61fee896cf352d4d

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
content-encoding
gzip
server
OXGW/16.179.0
status
200
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
163
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
auction
tlx.3lift.com/header/
19 B
483 B
XHR
General
Full URL
https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&tmax=1200
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.157.40.44 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-40-44.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
status
200
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-type
application/json; charset=utf-8
content-length
19
x-xss-protection
0
expires
Thu, 15 Oct 1992 20:10:00 GMT
v1
dmx.districtm.io/b/
0
33 B
XHR
General
Full URL
https://dmx.districtm.io/b/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Tue, 24 Mar 2020 16:49:51 GMT
server
cloudflare
cf-ray
5791e34a7d20c785-AMS
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
cygnus
as-sec.casalemedia.com/
26 B
874 B
XHR
General
Full URL
https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%22120ac45eb432fdd1%22%2C%22imp%22%3A%5B%7B%22id%22%3A%221219302e8b394a7e%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22122ce17a1e2a17b2%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22123842d87b271c0b%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-101-185-51.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
822b61d13ed7025a31c6c1228934c4fb3c4d9ba2ddb4ac78249c698e3cc47925

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 24 Mar 2020 16:49:51 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
46
Expires
Tue, 24 Mar 2020 16:49:51 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/
263 B
2 KB
XHR
General
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=da31999f-8ad1-404f-ad83-cdc09b179347&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.6387323070735265
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
5e1d336d7db2f9e3cc231074bc85263276b9d8e6274b694d3dbcd6da15533b7b

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 24 Mar 2020 16:49:51 GMT
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/json
Keep-Alive
timeout=5, max=417
Content-Length
263
Expires
Wed, 17 Sep 1975 21:32:10 GMT
v1
btlr.sharethrough.com/WYu2BXv1/
0
119 B
XHR
General
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=127c622daeabcb75&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.93.119.217 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-93-119-217.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Tue, 24 Mar 2020 16:49:51 GMT
access-control-allow-credentials
true
access-control-allow-origin
https://www.bleepingcomputer.com
vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/
0
119 B
XHR
General
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=bDraMWgeoLM4KHJBzFQ8heMv&bidId=1281e09c47b1933e&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.93.119.217 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-93-119-217.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Tue, 24 Mar 2020 16:49:51 GMT
access-control-allow-credentials
true
access-control-allow-origin
https://www.bleepingcomputer.com
vary
Origin
prebid
ib.adnxs.com/ut/v3/
146 B
1 KB
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.200 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
308.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
e4daf78a5bee354c332666a7b2ad914a7434128e8b9a5a0c7db8741eda45f3f2
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 24 Mar 2020 16:49:53 GMT
X-Proxy-Origin
194.187.251.57; 194.187.251.57; 308.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.54:80
AN-X-Request-Uuid
2cbebbed-6e7a-46ff-8a8d-b29732c05438
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
146
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
24
web.hb.ad.cpe.dotomi.com/s2s/header/
194 B
384 B
XHR
General
Full URL
https://web.hb.ad.cpe.dotomi.com/s2s/header/24
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:fa8:8806:16::1460 , Sweden, ASN41041 (VCLK-EU-, SE),
Reverse DNS
Software
nginx /
Resource Hash
7a0c5b3310cbb9aa39d50ac3cf0b7303fa80da5c754e4adb044049adf0104cd9

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
server
nginx
status
200
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache
access-control-allow-credentials
true
content-length
194
expires
0
prebid
ib.adnxs.com/ut/v3/
146 B
1 KB
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.200 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
308.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
597abb34ce334261a017d4973527a09b591c26c3f327eacf0953f452a35f774e
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 24 Mar 2020 16:49:53 GMT
X-Proxy-Origin
194.187.251.57; 194.187.251.57; 308.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.185:80
AN-X-Request-Uuid
fd4750b2-879c-4593-bdf4-7a14f85a175b
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
146
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
24
web.hb.ad.cpe.dotomi.com/s2s/header/
194 B
384 B
XHR
General
Full URL
https://web.hb.ad.cpe.dotomi.com/s2s/header/24
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:fa8:8806:16::1460 , Sweden, ASN41041 (VCLK-EU-, SE),
Reverse DNS
Software
nginx /
Resource Hash
bef51e48ff135e7ad05d8c18b2768cc28af0d83d6b5159e17909443c65b2d6e9

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
server
nginx
status
200
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache
access-control-allow-credentials
true
content-length
194
expires
0
arj
freestar-d.openx.net/w/1.0/
174 B
372 B
XHR
General
Full URL
https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&ch=windows-1252&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=7094ed93-c9c7-48ba-9e76-5dd930d14fbd&nocache=1585068591855&pubcid=cc6823de-742e-4b3d-9dbb-2c8d3b7ad675&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=728x90&divIds=bleepingcomputer_728x90_320x50_InContent_2&auid=540959250&
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.179.0 /
Resource Hash
f7756febea07a0adbb8ed030778aaac42302ed662089778427a1238c35f16747

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
content-encoding
gzip
server
OXGW/16.179.0
status
200
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
165
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
cygnus
as-sec.casalemedia.com/
26 B
872 B
XHR
General
Full URL
https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%221433b704f64433e7%22%2C%22imp%22%3A%5B%7B%22id%22%3A%221444080d8bc7f4e5%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-101-185-51.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b4624c4082093db28bdec01dd4292f7c6602bfede3a3a9a7ccbd1202e027286c

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 24 Mar 2020 16:49:52 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
44
Expires
Tue, 24 Mar 2020 16:49:52 GMT
v1
btlr.sharethrough.com/WYu2BXv1/
0
119 B
XHR
General
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=146b8c7ba243ee5d&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.93.119.217 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-93-119-217.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Tue, 24 Mar 2020 16:49:51 GMT
access-control-allow-credentials
true
access-control-allow-origin
https://www.bleepingcomputer.com
vary
Origin
ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=162de21c90b59251;misc=1585068591856
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=162de21c90b59251;misc=1585068591856;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=162de21c90b59251;misc=1585068591856
0
-1 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=162de21c90b59251;misc=1585068591856
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
server
nginx
access-control-allow-origin
https://www.bleepingcomputer.com
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=162de21c90b59251;misc=1585068591856
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status
302
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=162de21c90b59251;misc=1585068591856
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
prebid
ib.adnxs.com/ut/v3/
146 B
1 KB
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.200 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
308.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
4971f445a9afb6ad6cec2060b8fbbf87c6347e2cc08fe7dea629c7048943c8f0
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 24 Mar 2020 16:49:53 GMT
X-Proxy-Origin
194.187.251.57; 194.187.251.57; 308.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.139:80
AN-X-Request-Uuid
1a3ebb99-5e5a-4a5b-a20d-3f351aa890e1
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
146
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
auction
tlx.3lift.com/header/
19 B
483 B
XHR
General
Full URL
https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&tmax=1200
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.157.40.44 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-40-44.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
status
200
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-type
application/json; charset=utf-8
content-length
19
x-xss-protection
0
expires
Thu, 15 Oct 1992 20:10:00 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/
240 B
2 KB
XHR
General
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=7094ed93-c9c7-48ba-9e76-5dd930d14fbd&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.0414347856788162
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
f949e72e543339dded097f4b07904d2162b2f44cfc3f68d9b41ffd6a2f1e8780

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 24 Mar 2020 16:49:51 GMT
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/json
Keep-Alive
timeout=5, max=259
Content-Length
240
Expires
Wed, 17 Sep 1975 21:32:10 GMT
prebid
ib.adnxs.com/ut/v3/
146 B
1 KB
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.200 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
308.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
729cdb86c9ced4c6de9449c1a9b74a9b1e3d22faff4a06c2b6b77b5ee79fb35a
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 24 Mar 2020 16:49:53 GMT
X-Proxy-Origin
194.187.251.57; 194.187.251.57; 308.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.234:80
AN-X-Request-Uuid
d8854387-7951-4254-b0ce-fa8fa54b1daf
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
146
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
v1
dmx.districtm.io/b/
0
33 B
XHR
General
Full URL
https://dmx.districtm.io/b/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Tue, 24 Mar 2020 16:49:51 GMT
server
cloudflare
cf-ray
5791e34b2f09c785-AMS
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
ADTECH;apid=1A7b286e04-6def-11ea-bab4-12107816840e;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=161969f8aca6eff9;misc=1585068591744
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=161969f8aca6eff9;misc=1585068591744
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A7b286e04-6def-11ea-bab4-12107816840e;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=161969f8aca6eff9;misc=1...
0
-1 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A7b286e04-6def-11ea-bab4-12107816840e;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=161969f8aca6eff9;misc=1585068591744
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
server
nginx
access-control-allow-origin
https://www.bleepingcomputer.com
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A7b286e04-6def-11ea-bab4-12107816840e;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=161969f8aca6eff9;misc=1585068591744
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status
302
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A7b286e04-6def-11ea-bab4-12107816840e;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=161969f8aca6eff9;misc=1585068591744
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;apid=1A7b289064-6def-11ea-8c91-12359aeea65a;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=160c5ff9281107a3;misc=1585068591744
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=160c5ff9281107a3;misc=1585068591744
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A7b289064-6def-11ea-8c91-12359aeea65a;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=160c5ff9281107a3;misc=1...
0
-1 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A7b289064-6def-11ea-8c91-12359aeea65a;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=160c5ff9281107a3;misc=1585068591744
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
server
nginx
access-control-allow-origin
https://www.bleepingcomputer.com
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A7b289064-6def-11ea-8c91-12359aeea65a;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=160c5ff9281107a3;misc=1585068591744
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status
302
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:51 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A7b289064-6def-11ea-8c91-12359aeea65a;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=160c5ff9281107a3;misc=1585068591744
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
c
c.pub.network/
0
267 B
XHR
General
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.226.36.58 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
58.36.226.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Tue, 24 Mar 2020 16:49:51 GMT
Access-Control-Allow-Credentials
true
Content-Length
0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
ADTECH;apid=1A7b3bc4ea-6def-11ea-b513-1222202f268e;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=15936571e64c8e16;misc=1585068591744
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=15936571e64c8e16;misc=1585068591744
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A7b3bc4ea-6def-11ea-b513-1222202f268e;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=15936571e64c8e16;misc=1...
0
-1 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A7b3bc4ea-6def-11ea-b513-1222202f268e;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=15936571e64c8e16;misc=1585068591744
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:52 GMT
server
nginx
access-control-allow-origin
https://www.bleepingcomputer.com
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A7b3bc4ea-6def-11ea-b513-1222202f268e;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=15936571e64c8e16;misc=1585068591744
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status
302
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:52 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A7b3bc4ea-6def-11ea-b513-1222202f268e;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=15936571e64c8e16;misc=1585068591744
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;apid=1A7b4aa26c-6def-11ea-bb2f-12d2f833f2cc;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=162de21c90b59251;misc=1585068591856
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=162de21c90b59251;misc=1585068591856
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A7b4aa26c-6def-11ea-bb2f-12d2f833f2cc;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=162de21c90b59251;misc=1...
0
-1 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A7b4aa26c-6def-11ea-bb2f-12d2f833f2cc;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=162de21c90b59251;misc=1585068591856
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:52 GMT
server
nginx
access-control-allow-origin
https://www.bleepingcomputer.com
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A7b4aa26c-6def-11ea-bb2f-12d2f833f2cc;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=162de21c90b59251;misc=1585068591856
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status
302
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:52 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A7b4aa26c-6def-11ea-bb2f-12d2f833f2cc;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=162de21c90b59251;misc=1585068591856
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;apid=1A7b289064-6def-11ea-8c91-12359aeea65a;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=160c5ff9281107a3;misc=1585068591744
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/
606 B
737 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A7b289064-6def-11ea-8c91-12359aeea65a;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=160c5ff9281107a3;misc=1585068591744
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
1fca7c65d0131a229f86bb94386f4529b30a9994151dd3fa61b941ce8e45ba34

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:52 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-type
application/json
content-length
606
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;apid=1A7b286e04-6def-11ea-bab4-12107816840e;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=161969f8aca6eff9;misc=1585068591744
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/
605 B
736 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A7b286e04-6def-11ea-bab4-12107816840e;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=161969f8aca6eff9;misc=1585068591744
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
b3d580b8e7e3a0ad4bf3780732a32ffef63e1d1dd71b39e6e7742837aebc1ee2

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:52 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-type
application/json
content-length
605
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;apid=1A7b3bc4ea-6def-11ea-b513-1222202f268e;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=15936571e64c8e16;misc=1585068591744
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/
606 B
737 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A7b3bc4ea-6def-11ea-b513-1222202f268e;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=15936571e64c8e16;misc=1585068591744
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
fdb90f3de3d92b772d9e13acb2f4a21b35184303075c1e8fb87b4902a494fcdc

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:52 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-type
application/json
content-length
606
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;apid=1A7b4aa26c-6def-11ea-bb2f-12d2f833f2cc;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=162de21c90b59251;misc=1585068591856
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/
606 B
737 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A7b4aa26c-6def-11ea-bb2f-12d2f833f2cc;cfp=1;rndc=1585068591;v=2;cmd=bid;cors=yes;alias=162de21c90b59251;misc=1585068591856
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
0383091aa583cc3b14164c27c9d41f6f7a17dbb0755504b58969d7f34bd33ff0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:52 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-type
application/json
content-length
606
expires
Mon, 15 Jun 1998 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
53 KB
12 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2628311192819134&correlator=2267247213136126&output=ldjh&impl=fifs&adsid=NT&eid=21062452&vrg=2020030501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200324&iu_parts=15184186%2Cbleepingcomputer_728x90_970x90_970x250_320x50_ATF&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C970x90%7C970x250&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie_enabled=1&bc=31&abxe=1&lmt=1585068592&dt=1585068592366&dlt=1585068588613&idt=529&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=230&adks=960084856&ucis=5&ifi=2&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&dssz=85&icsg=2252899321161980&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x105&msz=970x90&psts=ABP-KfQ1F_EDpwqiqFh3txAOEJa3%2CABP-KfQ1F_EDpwqiqFh3txAOEJa3%2CABP-KfSe_VWpAWhzyL1XSWxbXNO3oqi62H0R32mrSRlCGyBsDXzKS2WFkQiB_zL79LH1YhdtCcnidQYoBTaS&ga_vid=1846113363.1585068589&ga_sid=1585068591&ga_hid=98792429&fws=4&ohw=1600
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
6b4d614703fd5f34438877997d129d5f49955a62ba866e8de5ca8b1a6f457afe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 24 Mar 2020 16:49:52 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
12205
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-expose-headers
x-google-amp-ad-validated-version
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/012003101714470/ Frame F31E
200 KB
55 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003181643/wrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
script
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
9854
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
55811
x-xss-protection
0
server
sffe
date
Tue, 24 Mar 2020 14:05:38 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"789295de90cb321e"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 24 Mar 2021 14:05:38 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/012003101714470/ Frame F31E
200 KB
55 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003181643/wrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
9854
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
55811
x-xss-protection
0
server
sffe
date
Tue, 24 Mar 2020 14:05:38 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"789295de90cb321e"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 24 Mar 2021 14:05:38 GMT
amp-ad-exit-0.1.js
cdn.ampproject.org/rtv/012003101714470/v0/ Frame F31E
16 KB
6 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012003101714470/v0/amp-ad-exit-0.1.js
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003181643/wrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3d0c18b56d3b9bd3640250af1ce1e624bda890531f830d64c99d45e6c07bb349
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
17806
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
5728
x-xss-protection
0
server
sffe
date
Tue, 24 Mar 2020 11:53:06 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"36d96c2d19cb35a6"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 24 Mar 2021 11:53:06 GMT
amp-analytics-0.1.js
cdn.ampproject.org/rtv/012003101714470/v0/ Frame F31E
92 KB
28 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012003101714470/v0/amp-analytics-0.1.js
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003181643/wrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e17e03dc3ff1767a8d185975a2bf392068a0b2f2848503c38ceaa3f10fb0ea84
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
9846
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28328
x-xss-protection
0
server
sffe
date
Tue, 24 Mar 2020 14:05:46 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"f4788313c10056ed"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 24 Mar 2021 14:05:46 GMT
amp-fit-text-0.1.js
cdn.ampproject.org/rtv/012003101714470/v0/ Frame F31E
3 KB
1 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012003101714470/v0/amp-fit-text-0.1.js
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003181643/wrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7b8ef4f3c2daa40e68de70096105302da24a586c1d75b620dff0ff579db73ba8
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
17790
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1414
x-xss-protection
0
server
sffe
date
Tue, 24 Mar 2020 11:53:22 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"ea7b1c90fec06498"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 24 Mar 2021 11:53:22 GMT
amp-form-0.1.js
cdn.ampproject.org/rtv/012003101714470/v0/ Frame F31E
46 KB
15 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012003101714470/v0/amp-form-0.1.js
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003181643/wrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
eada136c924874367d33d22fb496800b3f6f4e97f457829d2c18b5d41f1019a5
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
17768
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
14863
x-xss-protection
0
server
sffe
date
Tue, 24 Mar 2020 11:53:44 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"db7c050f8b3f760d"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 24 Mar 2021 11:53:44 GMT
css
fonts.googleapis.com/ Frame F31E
7 KB
824 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003181643/wrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d0cbfb1ab0f94123834567e32df7ec74a1c210793f797368d41a4b4c2732d4a0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 24 Mar 2020 16:49:52 GMT
server
ESF
date
Tue, 24 Mar 2020 16:49:52 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 24 Mar 2020 16:49:52 GMT
6592766407814317453
tpc.googlesyndication.com/simgad/12627395100106446540/ Frame F31E
22 KB
22 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/12627395100106446540/6592766407814317453
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e138f7cca84d8d0ed214a5f13ee8c34be0a116dc037d176aaf3ec3759cab0f98
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 10 Mar 2020 21:35:37 GMT
x-content-type-options
nosniff
age
1192455
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
22067
x-xss-protection
0
last-modified
Thu, 12 Sep 2019 14:20:17 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 10 Mar 2021 21:35:37 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/13256797330833292739/ Frame F31E
551 B
673 B
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/13256797330833292739/downsize_200k_v1?w=100&h=100
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f0e7a5dbf42c844d567b6c81602ff3145d6c3cb35f09c9dc84c6d1d0e47ccc3c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 30 Jan 2020 09:39:35 GMT
x-content-type-options
nosniff
age
4691417
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
551
x-xss-protection
0
last-modified
Mon, 22 Jul 2019 17:36:44 GMT
server
sffe
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 29 Jan 2021 09:39:35 GMT
truncated
/ Frame F31E
221 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155

Request headers

Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ Frame F31E
212 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8a47bbb3eff651537c602718b8a1f8c521549fd6d0eaa6ba582e73a2886c42c6

Request headers

Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
amp4ads-host-v0.js
cdn.ampproject.org/rtv/012003101714470/
20 KB
7 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012003101714470/amp4ads-host-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c2b0d171a4179bf00898c430c1c15464e528aff5762fc70a5d02184834c82eff
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
572
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
7178
x-xss-protection
0
server
sffe
date
Tue, 24 Mar 2020 16:40:20 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"9d3d923337ef7e9b"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 24 Mar 2021 16:40:20 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F31E
2 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 23 Mar 2020 23:33:48 GMT
x-content-type-options
nosniff
content-type
image/png
server
cafe
age
62164
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
2502
x-xss-protection
0
expires
Tue, 24 Mar 2020 23:33:48 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F31E
295 B
409 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 23 Mar 2020 21:53:20 GMT
x-content-type-options
nosniff
content-type
image/png
server
cafe
age
68192
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Tue, 24 Mar 2020 21:53:20 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame F31E
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=C1zPRMDp6Xs6WGpWWgAeN84_QCK7W1YdajZXfhrAKwaGPlQEQASDa18U5YLnovoDUAaABj5SzlwPIAQngAgCoAwHIAwqqBKMCT9BRn2s600FKVuYxPliRddmemOJmRWOBdDXO_TiwVb8_X9ico6xvnicEGuwEF26HV5qsrevvsuR4-bpda_EX8WtNE1iqwi__7JRfCyog7F8ZX2BBxh5SNhtPkrp4KWjtdpCnyyoqYoCNIzUarn60IpEJZBSDWj2_-bfKCzzCxcv6GcBu2bHohYrS51i0ure5KPjlZQmMo1flwmF9jdKe_bbuhKdg2qoi51_9ZkrauNpGB7T2fx-_FbGS6GO0LicLa3HgojrYvhNI7WcXsWeG71vgF4MxjbxNiqczyrn6M7aPqpP6A7-zs7ArEF9IJEgxJDQfXjrHmUt7kACJgFVB1Kx99G1iGtsNRJ9vZSLrneP8C_rryTwL8VmlVJk09NrbMEBawAS7ws2htALgBAGSBQQIBBgBkgUECAUYBKAGLoAH2evMaKgHjs4bqAfVyRuoB5PYG6gHn9sbqAe6BqgH8NkbqAfy2RuoB6a-G6gH7NUb2AcA8gcEENuBDNIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tMTc0MjI0OTYwMzI4OTA4M4AKA8gLAdgTAogUAw&sigh=3gQwySE-c10&template_id=484&tpd=AGWhJmvOIcWawXwpEhpNHp6Cj1F9QWjvIy2K7w3BEuHpSENdKA
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ Frame F31E
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 31 Jan 2020 00:50:19 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:58 GMT
server
sffe
age
4636773
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
11020
x-xss-protection
0
expires
Sat, 30 Jan 2021 00:50:19 GMT
KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ Frame F31E
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 05 Mar 2020 03:21:18 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:52 GMT
server
sffe
age
1690114
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
11180
x-xss-protection
0
expires
Fri, 05 Mar 2021 03:21:18 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F31E
2 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 23 Mar 2020 23:33:48 GMT
x-content-type-options
nosniff
content-type
image/png
server
cafe
age
62164
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
2502
x-xss-protection
0
expires
Tue, 24 Mar 2020 23:33:48 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F31E
295 B
363 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 23 Mar 2020 21:53:20 GMT
x-content-type-options
nosniff
content-type
image/png
server
cafe
age
68192
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Tue, 24 Mar 2020 21:53:20 GMT
ads
securepubads.g.doubleclick.net/gampad/
14 KB
8 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2628311192819134&correlator=2267247213136126&output=ldjh&impl=fifs&adsid=NT&eid=21062452&vrg=2020030501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200324&iu_parts=15184186%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C970x90%7C970x250&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie=ID%3Db52551318ed7ed1d%3AT%3D1585068592%3AS%3DALNI_MZwzXou-o1UcG8LXX0o_xnys1HknA&cookie_enabled=1&bc=31&abxe=1&lmt=1585068592&dt=1585068592939&dlt=1585068588613&idt=529&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=7698&adks=976516616&ucis=6&ifi=3&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&dssz=85&icsg=2252899321161980&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1392x105&msz=1392x90&psts=ABP-KfSe_VWpAWhzyL1XSWxbXNO3oqi62H0R32mrSRlCGyBsDXzKS2WFkQiB_zL79LH1YhdtCcnidQYoBTaS&ga_vid=1846113363.1585068589&ga_sid=1585068591&ga_hid=98792429&fws=4&ohw=1600
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
c88dc26cf19cb4102bc2729c08c1e3982107b83ce8e1c4e3861666d82dd7d1a4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 24 Mar 2020 16:49:53 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
8187
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
c
c.pub.network/
0
267 B
XHR
General
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.226.36.58 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
58.36.226.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Tue, 24 Mar 2020 16:49:52 GMT
Access-Control-Allow-Credentials
true
Content-Length
0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
ads
securepubads.g.doubleclick.net/gampad/
14 KB
8 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2628311192819134&correlator=2267247213136126&output=ldjh&impl=fifs&adsid=NT&eid=21062452&vrg=2020030501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200324&iu_parts=15184186%2Cbleepingcomputer_728x90_320x50_InContent_2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie=ID%3Db52551318ed7ed1d%3AT%3D1585068592%3AS%3DALNI_MZwzXou-o1UcG8LXX0o_xnys1HknA&cookie_enabled=1&bc=31&abxe=1&lmt=1585068593&dt=1585068593108&dlt=1585068588613&idt=529&frm=20&biw=1600&bih=1200&oid=3&adxs=524&adys=1550&adks=1808008496&ucis=7&ifi=4&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F715480%2Fcoronavirus-dns-router-hijack%2F&dssz=85&icsg=2252899321161980&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1177x152&msz=1177x90&psts=ABP-KfSe_VWpAWhzyL1XSWxbXNO3oqi62H0R32mrSRlCGyBsDXzKS2WFkQiB_zL79LH1YhdtCcnidQYoBTaS&ga_vid=1846113363.1585068589&ga_sid=1585068591&ga_hid=98792429&fws=4&ohw=1600
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
089bf0472fe6c4260c048beb334cd60143fd1143a9df5aa1cdba836649a40559
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 24 Mar 2020 16:49:53 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
8514
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame D0FA
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003181643/wrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-37/html/container.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
timing-allow-origin
*
content-length
2973
date
Tue, 24 Mar 2020 15:59:23 GMT
expires
Wed, 24 Mar 2021 15:59:23 GMT
last-modified
Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
3030
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
c
c.pub.network/
0
267 B
XHR
General
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.226.36.58 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
58.36.226.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Tue, 24 Mar 2020 16:49:53 GMT
Access-Control-Allow-Credentials
true
Content-Length
0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame 1B8B
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003181643/wrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-37/html/container.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
timing-allow-origin
*
content-length
2973
date
Tue, 24 Mar 2020 15:59:23 GMT
expires
Wed, 24 Mar 2021 15:59:23 GMT
last-modified
Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
3030
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
activeview
pagead2.googlesyndication.com/pcs/ Frame F31E
42 B
110 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstufAgbAQDg1jeXC_Xd_E_vbvYysNuAhcrYwPUkGZj2hS3Y19e-jRgkjssBSMxXZ-W0kwF-cH1J_5GkYikWYcxCyYRsH6Y0rrwYcjJekVMJbMvpTvi7lOAbdRDiZA&sai=AMfl-YSZLjL_A5oZT-7jU0nABqsCjyIjCEDc_3v77bt_m-BKPwJwBZP2Pq0fyDU3lGnS3lSY21DMrh2ZOcE659TqOzgEm1iT9emWPoyPi0NfvQ&sig=Cg0ArKJSzL-OQhGhXFVeEAE&id=ampim&o=315,230&d=970,90&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&tfs=90&tls=1091&g=100&h=100&tt=1091&r=v&adk=960084856&avms=ampa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Tue, 24 Mar 2020 16:49:53 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, must-revalidate
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
c
c.pub.network/
0
267 B
XHR
General
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.226.36.58 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
58.36.226.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Tue, 24 Mar 2020 16:49:53 GMT
Access-Control-Allow-Credentials
true
Content-Length
0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
c
c.pub.network/
0
267 B
XHR
General
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.226.36.58 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
58.36.226.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Tue, 24 Mar 2020 16:49:54 GMT
Access-Control-Allow-Credentials
true
Content-Length
0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
sync
eb2.3lift.com/ Frame 29F2
Redirect Chain
  • https://eb2.3lift.com/sync?
  • https://eb2.3lift.com/sync?&ld=1
0
0
Document
General
Full URL
https://eb2.3lift.com/sync?&ld=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.157.108.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-108-20.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

:method
GET
:authority
eb2.3lift.com
:scheme
https
:path
/sync?&ld=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
tluid=1461727645515177282
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

status
200
date
Tue, 24 Mar 2020 16:49:57 GMT
content-type
text/html; charset=utf-8
content-length
493
set-cookie
sync=CgoIgQIQyMTN65AuCgoI4gEQyMTN65AuCgoI5gEQyMTN65AuCgkICRDIxM3rkC4KCgipARDIxM3rkC4KCQg5EMjEzeuQLgoJCDoQyMTN65AuCgkICxDIxM3rkC4KCgjOARDIxM3rkC4KCQgfEMjEzeuQLg==; Max-Age=7776000; Expires=Mon, 22 Jun 2020 16:49:57 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=1461727645515177282; Max-Age=7776000; Expires=Mon, 22 Jun 2020 16:49:57 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
content-encoding
gzip
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control
no-cache, no-store, must-revalidate

Redirect headers

status
302
date
Tue, 24 Mar 2020 16:49:57 GMT
content-length
0
set-cookie
tluid=12795725079131594115; Max-Age=7776000; Expires=Mon, 22 Jun 2020 16:49:57 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
location
/sync?&ld=1
cache-control
no-cache, no-store, must-revalidate
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
pd
eu-u.openx.net/w/1.0/ Frame F4A7
Redirect Chain
  • https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
  • https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
0
0
Document
General
Full URL
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.179.0 /
Resource Hash

Request headers

:method
GET
:authority
eu-u.openx.net
:scheme
https
:path
/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
i=41f7480b-06b4-0648-39dd-4c0ba0c2bd12|1585068597
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

status
200
vary
Accept, Accept-Encoding
set-cookie
i=41f7480b-06b4-0648-39dd-4c0ba0c2bd12|1585068597; Version=1; Expires=Wed, 24-Mar-2021 16:49:57 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1585068597|mOsLgqgikin0fcmWiygu; Version=1; Expires=Wed, 08-Apr-2020 16:49:57 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.179.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Tue, 24 Mar 2020 16:49:57 GMT
content-type
text/html
content-length
483
content-encoding
gzip
via
1.1 google
alt-svc
clear

Redirect headers

status
302
set-cookie
i=82442e1a-9f7f-0fed-0cb8-71883ecf2c50|1585068597; Version=1; Expires=Wed, 24-Mar-2021 16:49:57 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.179.0
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
date
Tue, 24 Mar 2020 16:49:57 GMT
content-length
0
via
1.1 google
alt-svc
clear
async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame 90B3
0
0
Document
General
Full URL
https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.184.231 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-101-184-231.deploy.static.akamaitechnologies.com
Software
nginx/1.13.10 /
Resource Hash

Request headers

Host
acdn.adnxs.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

Server
nginx/1.13.10
Content-Type
text/html
Last-Modified
Fri, 20 May 2016 02:07:09 GMT
Vary
Accept-Encoding
ETag
W/"573e714d-3e3"
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Content-Length
506
Cache-Control
max-age=31536000
Expires
Wed, 24 Mar 2021 16:49:57 GMT
Date
Tue, 24 Mar 2020 16:49:57 GMT
Connection
keep-alive
index.html
cdn.districtm.io/ids/ Frame B187
0
0
Document
General
Full URL
https://cdn.districtm.io/ids/index.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
cdn.districtm.io
:scheme
https
:path
/ids/index.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

status
204
date
Tue, 24 Mar 2020 16:49:57 GMT
set-cookie
__cfduid=d2d5eb625b2ac02db898d26dec658a5741585068597; expires=Thu, 23-Apr-20 16:49:57 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
server
cloudflare
cf-ray
5791e36ffea7c785-AMS
pd
eu-u.openx.net/w/1.0/ Frame 0543
Redirect Chain
  • https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
  • https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
0
0
Document
General
Full URL
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.179.0 /
Resource Hash

Request headers

:method
GET
:authority
eu-u.openx.net
:scheme
https
:path
/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
i=41f7480b-06b4-0648-39dd-4c0ba0c2bd12|1585068597
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

status
200
vary
Accept, Accept-Encoding
set-cookie
i=41f7480b-06b4-0648-39dd-4c0ba0c2bd12|1585068597; Version=1; Expires=Wed, 24-Mar-2021 16:49:57 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1585068597|mOsLgqgikin0fcmWiygu; Version=1; Expires=Wed, 08-Apr-2020 16:49:57 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.179.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Tue, 24 Mar 2020 16:49:57 GMT
content-type
text/html
content-length
483
content-encoding
gzip
via
1.1 google
alt-svc
clear

Redirect headers

status
302
set-cookie
i=068d5a83-740f-054d-00f9-ad095c74dc31|1585068597; Version=1; Expires=Wed, 24-Mar-2021 16:49:57 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.179.0
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
date
Tue, 24 Mar 2020 16:49:57 GMT
content-length
0
via
1.1 google
alt-svc
clear
async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame E955
0
0
Document
General
Full URL
https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.184.231 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-101-184-231.deploy.static.akamaitechnologies.com
Software
nginx/1.13.10 /
Resource Hash

Request headers

Host
acdn.adnxs.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

Server
nginx/1.13.10
Content-Type
text/html
Last-Modified
Fri, 20 May 2016 02:07:09 GMT
Vary
Accept-Encoding
ETag
W/"573e714d-3e3"
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Content-Length
506
Cache-Control
max-age=31536000
Expires
Wed, 24 Mar 2021 16:49:57 GMT
Date
Tue, 24 Mar 2020 16:49:57 GMT
Connection
keep-alive
sync
eb2.3lift.com/ Frame D22E
Redirect Chain
  • https://eb2.3lift.com/sync?
  • https://eb2.3lift.com/sync?&ld=1
0
0
Document
General
Full URL
https://eb2.3lift.com/sync?&ld=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.157.108.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-108-20.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

:method
GET
:authority
eb2.3lift.com
:scheme
https
:path
/sync?&ld=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
tluid=1461727645515177282
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

status
200
date
Tue, 24 Mar 2020 16:49:57 GMT
content-type
text/html; charset=utf-8
content-length
493
set-cookie
sync=CgoIgQIQysTN65AuCgoI4gEQysTN65AuCgoI5gEQysTN65AuCgkICRDKxM3rkC4KCgipARDKxM3rkC4KCQg5EMrEzeuQLgoJCDoQysTN65AuCgkICxDKxM3rkC4KCgjOARDKxM3rkC4KCQgfEMrEzeuQLg==; Max-Age=7776000; Expires=Mon, 22 Jun 2020 16:49:57 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=1461727645515177282; Max-Age=7776000; Expires=Mon, 22 Jun 2020 16:49:57 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
content-encoding
gzip
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control
no-cache, no-store, must-revalidate

Redirect headers

status
302
date
Tue, 24 Mar 2020 16:49:57 GMT
content-length
0
set-cookie
tluid=1461727645515177282; Max-Age=7776000; Expires=Mon, 22 Jun 2020 16:49:57 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
location
/sync?&ld=1
cache-control
no-cache, no-store, must-revalidate
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
pd
eu-u.openx.net/w/1.0/ Frame 03D1
Redirect Chain
  • https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
  • https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
0
0
Document
General
Full URL
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.179.0 /
Resource Hash

Request headers

:method
GET
:authority
eu-u.openx.net
:scheme
https
:path
/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
i=41f7480b-06b4-0648-39dd-4c0ba0c2bd12|1585068597
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

status
200
vary
Accept, Accept-Encoding
set-cookie
i=41f7480b-06b4-0648-39dd-4c0ba0c2bd12|1585068597; Version=1; Expires=Wed, 24-Mar-2021 16:49:57 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1585068597|mOsLgqgikin0fcmWiygu; Version=1; Expires=Wed, 08-Apr-2020 16:49:57 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.179.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Tue, 24 Mar 2020 16:49:57 GMT
content-type
text/html
content-length
483
content-encoding
gzip
via
1.1 google
alt-svc
clear

Redirect headers

status
302
set-cookie
i=af7ff834-de9c-03cd-2522-b6f53f4db892|1585068597; Version=1; Expires=Wed, 24-Mar-2021 16:49:57 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.179.0
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
date
Tue, 24 Mar 2020 16:49:57 GMT
content-length
0
via
1.1 google
alt-svc
clear
pd
eu-u.openx.net/w/1.0/ Frame 40E0
Redirect Chain
  • https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
  • https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
0
0
Document
General
Full URL
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.179.0 /
Resource Hash

Request headers

:method
GET
:authority
eu-u.openx.net
:scheme
https
:path
/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
i=41f7480b-06b4-0648-39dd-4c0ba0c2bd12|1585068597
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

status
200
vary
Accept, Accept-Encoding
set-cookie
i=41f7480b-06b4-0648-39dd-4c0ba0c2bd12|1585068597; Version=1; Expires=Wed, 24-Mar-2021 16:49:57 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1585068597|mOsLgqgikin0fcmWiygu; Version=1; Expires=Wed, 08-Apr-2020 16:49:57 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.179.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Tue, 24 Mar 2020 16:49:57 GMT
content-type
text/html
content-length
483
content-encoding
gzip
via
1.1 google
alt-svc
clear

Redirect headers

status
302
set-cookie
i=41f7480b-06b4-0648-39dd-4c0ba0c2bd12|1585068597; Version=1; Expires=Wed, 24-Mar-2021 16:49:57 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.179.0
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
date
Tue, 24 Mar 2020 16:49:57 GMT
content-length
0
via
1.1 google
alt-svc
clear
async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame 2CF0
0
0
Document
General
Full URL
https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.184.231 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-101-184-231.deploy.static.akamaitechnologies.com
Software
nginx/1.13.10 /
Resource Hash

Request headers

Host
acdn.adnxs.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

Server
nginx/1.13.10
Content-Type
text/html
Last-Modified
Fri, 20 May 2016 02:07:09 GMT
Vary
Accept-Encoding
ETag
W/"573e714d-3e3"
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Content-Length
506
Cache-Control
max-age=31536000
Expires
Wed, 24 Mar 2021 16:49:57 GMT
Date
Tue, 24 Mar 2020 16:49:57 GMT
Connection
keep-alive
usync.html
eus.rubiconproject.com/ Frame 6162
0
0
Document
General
Full URL
https://eus.rubiconproject.com/usync.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.8.15.54 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-8-15-54.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host
eus.rubiconproject.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified
Wed, 04 Mar 2020 22:48:14 GMT
Content-Encoding
gzip
Content-Length
7619
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=12161
Expires
Tue, 24 Mar 2020 20:12:38 GMT
Date
Tue, 24 Mar 2020 16:49:57 GMT
Connection
keep-alive
Vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame 416A
0
0
Document
General
Full URL
https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.184.231 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-101-184-231.deploy.static.akamaitechnologies.com
Software
nginx/1.13.10 /
Resource Hash

Request headers

Host
acdn.adnxs.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

Server
nginx/1.13.10
Content-Type
text/html
Last-Modified
Fri, 20 May 2016 02:07:09 GMT
Vary
Accept-Encoding
ETag
W/"573e714d-3e3"
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Content-Length
506
Cache-Control
max-age=31536000
Expires
Wed, 24 Mar 2021 16:49:57 GMT
Date
Tue, 24 Mar 2020 16:49:57 GMT
Connection
keep-alive
index.html
cdn.districtm.io/ids/ Frame 9A69
0
0
Document
General
Full URL
https://cdn.districtm.io/ids/index.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
cdn.districtm.io
:scheme
https
:path
/ids/index.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

status
204
date
Tue, 24 Mar 2020 16:49:57 GMT
set-cookie
__cfduid=d2d5eb625b2ac02db898d26dec658a5741585068597; expires=Thu, 23-Apr-20 16:49:57 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
server
cloudflare
cf-ray
5791e3702f6ac785-AMS
sync
eb2.3lift.com/ Frame DF21
Redirect Chain
  • https://eb2.3lift.com/sync?
  • https://eb2.3lift.com/sync?&ld=1
0
0
Document
General
Full URL
https://eb2.3lift.com/sync?&ld=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.157.108.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-108-20.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

:method
GET
:authority
eb2.3lift.com
:scheme
https
:path
/sync?&ld=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
tluid=1461727645515177282
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

status
200
date
Tue, 24 Mar 2020 16:49:57 GMT
content-type
text/html; charset=utf-8
content-length
493
set-cookie
sync=CgoIgQIQyMTN65AuCgoI4gEQyMTN65AuCgoI5gEQyMTN65AuCgkICRDIxM3rkC4KCgipARDIxM3rkC4KCQg5EMjEzeuQLgoJCDoQyMTN65AuCgkICxDIxM3rkC4KCgjOARDIxM3rkC4KCQgfEMjEzeuQLg==; Max-Age=7776000; Expires=Mon, 22 Jun 2020 16:49:57 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=1461727645515177282; Max-Age=7776000; Expires=Mon, 22 Jun 2020 16:49:57 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
content-encoding
gzip
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control
no-cache, no-store, must-revalidate

Redirect headers

status
302
date
Tue, 24 Mar 2020 16:49:57 GMT
content-length
0
set-cookie
tluid=16145415772872398126; Max-Age=7776000; Expires=Mon, 22 Jun 2020 16:49:57 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
location
/sync?&ld=1
cache-control
no-cache, no-store, must-revalidate
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
sync
eb2.3lift.com/ Frame 0E12
Redirect Chain
  • https://eb2.3lift.com/sync?
  • https://eb2.3lift.com/sync?&ld=1
0
0
Document
General
Full URL
https://eb2.3lift.com/sync?&ld=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.157.108.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-108-20.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

:method
GET
:authority
eb2.3lift.com
:scheme
https
:path
/sync?&ld=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
tluid=1461727645515177282
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

status
200
date
Tue, 24 Mar 2020 16:49:57 GMT
content-type
text/html; charset=utf-8
content-length
493
set-cookie
sync=CgoIgQIQysTN65AuCgoI4gEQysTN65AuCgoI5gEQysTN65AuCgkICRDKxM3rkC4KCgipARDKxM3rkC4KCQg5EMrEzeuQLgoJCDoQysTN65AuCgkICxDKxM3rkC4KCgjOARDKxM3rkC4KCQgfEMrEzeuQLg==; Max-Age=7776000; Expires=Mon, 22 Jun 2020 16:49:57 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=1461727645515177282; Max-Age=7776000; Expires=Mon, 22 Jun 2020 16:49:57 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
content-encoding
gzip
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control
no-cache, no-store, must-revalidate

Redirect headers

status
302
date
Tue, 24 Mar 2020 16:49:57 GMT
content-length
0
set-cookie
tluid=260259383851799151; Max-Age=7776000; Expires=Mon, 22 Jun 2020 16:49:57 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
location
/sync?&ld=1
cache-control
no-cache, no-store, must-revalidate
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
index.html
cdn.districtm.io/ids/ Frame 72BC
0
0
Document
General
Full URL
https://cdn.districtm.io/ids/index.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
cdn.districtm.io
:scheme
https
:path
/ids/index.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

status
204
date
Tue, 24 Mar 2020 16:49:57 GMT
set-cookie
__cfduid=d2d5eb625b2ac02db898d26dec658a5741585068597; expires=Thu, 23-Apr-20 16:49:57 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
server
cloudflare
cf-ray
5791e3703f98c785-AMS
index.html
cdn.districtm.io/ids/ Frame F121
0
0
Document
General
Full URL
https://cdn.districtm.io/ids/index.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
cdn.districtm.io
:scheme
https
:path
/ids/index.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Response headers

status
204
date
Tue, 24 Mar 2020 16:49:57 GMT
set-cookie
__cfduid=d2d5eb625b2ac02db898d26dec658a5741585068597; expires=Thu, 23-Apr-20 16:49:57 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
server
cloudflare
cf-ray
5791e3703fa8c785-AMS

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
adserver-us.adtech.advertising.com
URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A7a77982c-6def-11ea-ba5b-1274c1fe5bf6;cfp=1;rndc=1585068590;v=2;cmd=bid;cors=yes;alias=644cbeb9e5d6a0b;misc=1585068590543

Verdicts & Comments Add Verdict or Comment

175 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate boolean| isRTL string| rtlIe string| rtlFull number| jsDebug number| DISABLE_AJAX boolean| inACP object| Prototype object| Class function| PeriodicalExecuter function| Template object| $break object| Enumerable function| $A function| $w function| $H function| Hash function| $R function| ObjectRange object| Abstract object| Try object| Ajax object| Form object| Field function| $F object| Toggle object| Insertion object| $continue object| Position function| $ function| $$ function| Sizzle function| Selector number| USE_RTE object| Debug function| isBody function| isHtml function| isDocument function| isDetached object| Loader object| callback function| _global function| _menu function| warningPopup function| IPBoard function| getQueryStringParamByName function| _popup function| _ticker object| ipb object| Scriptaculous object| Effect object| Droppables object| Draggables function| Draggable function| SortableObserver object| Sortable object| Builder function| _quickpm function| _sharelinks function| _topic function| _like object| freestar object| apd_options function| gtag object| dataLayer object| google_tag_manager string| GoogleAnalyticsObject function| ga number| pid object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| elem object| scpt function| __cmp boolean| fifabAlready function| fi_fab object| gapi object| ___jsl boolean| PR_SHOULD_USE_CONTINUATION function| prettyPrintOne function| prettyPrint object| PR undefined| _ object| fsdata function| load_script object| googletag object| fsprebid function| Lightbox string| _to string| _last function| gbl_addDownloadButton object| LightboxOptions object| FB function| get_real_link object| __SKIM_JS_GLOBAL__ object| skimlinksAPI function| __uspapi number| totalW object| skip object| cookies undefined| _thislightbox string| id number| quoted string| attribute object| ipsLightbox object| gadgets object| osapi object| shindig object| iframer function| ToolbarApi object| iframes function| IframeBase function| Iframe function| IframeProxy function| IframeWindow object| __gapi_jstiming__ object| ggeac object| closure_memoize_cache_ object| googleToken object| googleIMState object| google_js_reporting_queue function| processGoogleToken function| _slicedToArray function| _nonIterableRest function| _iterableToArrayLimit function| _arrayWithHoles function| _typeof function| ownKeys function| _objectSpread function| _defineProperty object| _0x1ae3 function| _0x2d13 object| BT object| BT_PAGEVIEW_MAP object| blockthrough object| BT_RETRY object| BT_REDIRECT_RULES object| oauth2 function| __cmpui number| google_srt undefined| google_measure_js_timing object| apstag object| confiant function| fsprebidChunk object| _pbjsGlobals object| __core-js_shared__ string| btID boolean| apstagLOADED function| btjsonpcallback1585068589637 number| __google_ad_urls_id number| google_unique_id function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter object| __google_ad_urls function| confiantDfpWrap object| ampInaboxIframes object| ampInaboxPendingMessages boolean| google_osd_loaded boolean| google_onload_fired object| GoogleGcLKhOms function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| google_image_requests object| __AMP_LOG object| __AMP_ERRORS boolean| ampInaboxInitialized object| __AMP_MODE function| __AMP_REPORT_ERROR object| ampInaboxPositionObserver object| ampInaboxFrameOverlayManager object| AMP

11 Cookies

Domain/Path Name / Value
.google.com/ Name: NID
Value: 200=gpQkFulIHAQpT1WCi6MciQ4jt9yOFCZ1sqtmAv0JURa5EH0C0bAEFscqPexQGhRrCXRNThwBVsXFtJ-HnM06w8YK2X07Rd9h8gZewe7su4Gr-80ugiVFmbA2iCvmC1PdkF-1MPZlQKo2Ukwa2Wigx4fIh-GAU-Xkx3m2lZX2orQ
.bleepingcomputer.com/ Name: __beaconTrackerID
Value: uhwlj161w
www.bleepingcomputer.com/ Name: _cmpQcif3pcsupported
Value: 1
www.bleepingcomputer.com/ Name: fssts
Value: false
www.bleepingcomputer.com/ Name: _fssid
Value: 5e1aa16f-4502-4013-8c18-9d3526360184
.bleepingcomputer.com/ Name: _ga
Value: GA1.2.1846113363.1585068589
.bleepingcomputer.com/ Name: _gat_gtag_UA_91740_1
Value: 1
.bleepingcomputer.com/ Name: session_id
Value: a06ba1247ebf42f0189170f29b01beae
.bleepingcomputer.com/ Name: __cfduid
Value: d62deb40f6978098539d9e6e6bb75b0961585068587
.bleepingcomputer.com/ Name: _gid
Value: GA1.2.498617082.1585068589
www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack Name: fsbotchecked
Value: true

9 Console Messages

Source Level URL
Text
console-api warning URL: https://quantcast.mgr.consensu.org/cmp.js(Line 1)
Message:
Dependency check failed for Publisher Purpose Legitimate Interest IDs: Publisher Purpose Legitimate Interest IDs must be an array containing only purpose IDs contained in the Publisher Purpose IDs array, the following purpose IDs will be ignored: 1, 4, 5
console-api log URL: https://freestar-io.videoplayerhub.com/gallery.js(Line 1)
Message:
Video gallery initializing
console-api warning URL: https://static.quantcast.mgr.consensu.org/v31/cmpui-popup.js(Line 1)
Message:
Unable to get NonIab Vendor list.
console-api warning URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js(Line 6)
Message:
Invalid GPT size specification: [[728,90],[970,90],[970,250]]
console-api warning URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js(Line 6)
Message:
Invalid GPT size specification: [[728,90],[970,90],[970,250]]
console-api warning URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js(Line 6)
Message:
Invalid GPT size specification: [[728,90]]
console-api warning URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js(Line 6)
Message:
Invalid GPT size specification: [[1,1]]
console-api error URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js(Line 6)
Message:
Exception in queued GPT command TypeError: Cannot read property 'getItem' of null
console-api info URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js(Line 407)
Message:
Powered by AMP ⚡ HTML – Version 2003101714470 https://www.bleepingcomputer.com/forums/t/715480/coronavirus-dns-router-hijack/

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.pub.network
accounts.google.com
acdn.adnxs.com
ad-delivery.net
ad.doubleclick.net
adserver-us.adtech.advertising.com
adservice.google.com
adservice.google.de
api.quantcast.mgr.consensu.org
api.skimlinks.mgr.consensu.org
apis.google.com
as-sec.casalemedia.com
audit.quantcast.mgr.consensu.org
btlr.sharethrough.com
c.amazon-adsystem.com
c.pub.network
cdn.ampproject.org
cdn.districtm.io
cluster-na.cdnjquery.com
confiant-integrations.global.ssl.fastly.net
connect.facebook.net
d.pub.network
dmx.districtm.io
eb2.3lift.com
ecdn.analysis.fi
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
freestar-d.openx.net
freestar-io.videoplayerhub.com
i.imgur.com
ib.adnxs.com
load77.exelator.com
loadeu.exelator.com
p.skimresources.com
pagead2.googlesyndication.com
quantcast.mgr.consensu.org
r.skimresources.com
s.skimresources.com
securepubads.g.doubleclick.net
static.quantcast.mgr.consensu.org
sync.crwdcntrl.net
t.skimresources.com
tlx.3lift.com
tpc.googlesyndication.com
vendorlist.consensu.org
web.hb.ad.cpe.dotomi.com
www.bleepingcomputer.com
www.bleepstatic.com
www.facebook.com
www.google-analytics.com
www.googletagmanager.com
www.googletagservices.com
x.skimresources.com
adserver-us.adtech.advertising.com
104.16.68.69
104.20.60.209
104.26.13.6
143.204.178.2
143.204.201.21
147.75.102.200
151.101.12.193
151.101.13.194
151.139.128.10
152.199.21.89
172.217.16.194
172.217.18.166
18.202.137.180
185.33.223.200
195.181.175.55
212.71.236.117
23.8.15.54
2600:9000:2057:b200:9:46dc:4700:93a1
2600:9000:214f:9200:1:af78:4c0:93a1
2600:9000:214f:ca00:9:46dc:4700:93a1
2606:4700:20::681a:18b
2a00:1450:4001:800::200e
2a00:1450:4001:80b::200e
2a00:1450:4001:814::2003
2a00:1450:4001:815::2002
2a00:1450:4001:815::200a
2a00:1450:4001:81a::200d
2a00:1450:4001:81b::2001
2a00:1450:4001:81d::2008
2a00:1450:4001:81f::2002
2a00:1450:4001:821::2002
2a02:fa8:8806:16::1460
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
34.95.120.147
35.157.108.20
35.157.40.44
35.188.71.214
35.190.40.172
35.190.59.101
35.201.67.47
35.226.36.58
52.19.221.77
52.2.175.122
54.93.119.217
69.173.144.140
95.101.184.231
95.101.185.51
99.86.0.120
99.86.3.23
99.86.3.44
0046b574f57cf9b0c63b743a3decdbe6ba204166f6cf786caa99f14be1bd2b52
00a30ea925e1a7fdcb597a0c8fe4320e4a897495f6c24ad89bacfb9772d2d7e8
025e7e180ec38cee031546ed3a613dc266575a90fb028db4572236863b185c70
0383091aa583cc3b14164c27c9d41f6f7a17dbb0755504b58969d7f34bd33ff0
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
0791793cd6397fb3ac6578bdca31e043b4951d4e4eacc45894ce2d76ec62159d
089bf0472fe6c4260c048beb334cd60143fd1143a9df5aa1cdba836649a40559
0b5a35aa59af15012b03c44769087fb85282ed12e3c417030d78f95f61697b53
0bc2ee096d68f1de3dfd74d23e4a3d1550001d5a459a537e276b5bdf6f011893
0d65062d11c6c427b3efe1049e8df05b398260fbc78a2c5ac7a5e05a1c9e52ee
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
0f1e90548e911e24dedcb2ca0ffee6847a49a8648e9c615bcd0582bb7c7993fd
114af008615fbe18f9cc0dfd36ebafd202e12eda91137d48d8a2cab529274d9f
11f8afeee2efd88c6fd1beb2de291f18e93bc6bad5e0f6049ac01329a4900c7d
1457b36acce37419d32c4404c4ae21c4b788d076069351cad4d4c3e4600a37c8
154f3a9ed4f3ac0059fc18337f3cb4d28103f349b3e256458f6a39b23d3c092b
17bdae407969fa91483ae19f11829e22b6fe7bb58860feb97f813d0907501729
18d824646c1147f2687333fa22e37718e5c666d078eb27ffffa017f59415cac5
1a4f0e8c39215f22253ccbba8d94aaf7d5cce967a7f746234af6750de3df5af3
1a78f7bf63f851cbab54a7f7e9ccb76b53ef79834c33cd242aa98d16d228e855
1c4777fe3a673a05492e27d08032cc91c23ac5389897c9235b09b8b0f5a74db3
1fca7c65d0131a229f86bb94386f4529b30a9994151dd3fa61b941ce8e45ba34
1fee2ab8ca44cafc492ea3994cbbee5b066966ca34919768992ad8d0b74c9165
23b4fe351d658defec49b990d1d9efd9879459ef18e460213f2145b5e87ab56b
24b45790f58b5d8c376ea8320617b5defa1c88576b7b8df5abf1337a758adba3
272eee41293bc12ce331c1bfaba020f71b0ec3436d56cc35a31d7618ff332f93
2a7d4a2616cf9618b236c398bb0bb8fef4df2e0b461248a15d40ded342dc555a
2b1973900c2619efe19a4ab5f0621e5aa82713628d1b4da9116db7c1fd700551
2d0f6b590917e7d27ddeb026b280d62dde9d03bb92f47f56342fc5f68f0c24eb
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2ec8793fb4ee5ddbd6a7aed8c3fbb460e4a45f94db9bca60e321da42a2188106
311b90855c9f23f4f7531137aa339d941b81af0409120d0281a535f0d2920d49
3279cb3a3f494df929b499b840c3bc4082c3700103f003859d830e3d8b115063
3293c5f2531772cf8d1c6518dd1be400301d77916920b8c1892a1915274a9ff1
351e508c1da4f9d1535747086accb41121466a52044aa868eba4a36009fdb101
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
3b6a84a416edfb98ed7608dad8cd26ffd7123e54bce2bb13a4a3394e0b948382
3d0c18b56d3b9bd3640250af1ce1e624bda890531f830d64c99d45e6c07bb349
3e3b8f6c06d2d74cc294ee6439e67b08890587be0081249a158469ace2eaeaaf
3e3f47fbbf144c3d1a61ff6a7f75f735b987821ba23cad6876dd06cf1ebb7510
3e89beb7d66ef7d5e58dfcefd22a51e1a8ae452a49bc20d020418cf2b6c666d0
424b5f41dcbc693d32ca73f0e2b1daa5cf5524bc2220865c15b81f032bf3052d
4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10
48100a7efdd07d27ede8e151c39cad2a2b55853d038c25fc2a846316ea0184ef
4898c2b9f8c2f931ef6a819d36e0019867931d9519af933ab4bd5edce724b2a8
48d6e3c1f8af64f286c4f199c5de33cb1be76d36fd2042bd9c1bb2481ee495ee
4971f445a9afb6ad6cec2060b8fbbf87c6347e2cc08fe7dea629c7048943c8f0
509c7947a6d75ef3578657f940c2da777ba48c3ba78ea9293fe59c248118aa66
51f20d95dad9ea1473e4f877b5f7a7d8bcd589f1f989b8875ffddd83ae716a21
563777fc54d07e48cbea78dd97911bdd12a62d1888d12fe4dfeaaa9b3563d676
597abb34ce334261a017d4973527a09b591c26c3f327eacf0953f452a35f774e
5a1b118736ba9dc41f144f350574bec748a1ba0e8b355a99cbfe570ad236b50e
5a4061ff8312e2ad494bd984b7df966438232be64a3b284ab69f66c6705009a6
5c5493de2d83c24647a2da39b8abcbf696ddab1e53cf476f62ad80d97baea2bb
5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5
5e1d336d7db2f9e3cc231074bc85263276b9d8e6274b694d3dbcd6da15533b7b
608501196c0571ec771c62b340f68dbcd57d10b119d7c4fe87cca2ed81a79e2a
613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155
61da0a4638505960ec52709b7df80d92683c56e13042079daf5f082fc9548d5e
61e225f0d67c03cc5a2cdfa2f63e971048d0201711c3cda27c4d4ea0f9f65176
6358c6ea8da1fcf2fc88c991a803c1a5f63b13247d7c546f1e3365ce17ec484d
63f573d22389d46e98f454e27c0a7489d1321767e6e5fdf0147218ea2ba7349a
669641985eb1bb7b0e71762f8e734ae2d1832b6976a97f099218d714da1f214e
6b4d614703fd5f34438877997d129d5f49955a62ba866e8de5ca8b1a6f457afe
6e0533d6585c026d1f72a040b902b67d76994eafa3593049d16ee319e9ec9be8
70143c43ddb939c012fc180c08f3a1373d4f40297510c4a3207b479cec263686
729cdb86c9ced4c6de9449c1a9b74a9b1e3d22faff4a06c2b6b77b5ee79fb35a
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
76d7f8e240594fecc1ef4d08777d6fde32d40d4e2761aa21c2b2357a05a66095
770cb6f8747e90dad261e049dfa5cf42e622dac61bcbc86ecb0a8c134228eb91
781a78ca3fab782126c9e219fc35eeefb84f44316bf1b220a849847b42c1b688
7a0c5b3310cbb9aa39d50ac3cf0b7303fa80da5c754e4adb044049adf0104cd9
7b795ad72976ab8e30274524f9ae792a16ee8d13598a39b6674bb950439e0557
7b7ebe6979063a4bc7e94fad82f8e9c192b480bae435101a285dc9879c35a59a
7b8ef4f3c2daa40e68de70096105302da24a586c1d75b620dff0ff579db73ba8
7bcd14157e953f4628d18d238be8e9495c490942e33f161f61fee896cf352d4d
7cc36f47b70988855c5cde9579581871e9dc92a285a8b1ba4602a89c915c902c
7e94fbebf526effec4239c82e5435a412d81ffc4bc9bddf13f9aa1170f6d803e
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
822b61d13ed7025a31c6c1228934c4fb3c4d9ba2ddb4ac78249c698e3cc47925
826acef37820db4f3e9b999fa220c33e40cdd0b862f9717190a775dddd38d846
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8347a92981a0fdc73af9e2536f688b1a14e6ebea3b4ee5df22e6654bb5e8ca6c
87562d3773ffab3d0716a70faa73c38b322fde3b8f265c3d646a3cea976ef67e
8856e209b20c00bc8b3f47cb603948302c4171b14518936952660eca422901f3
89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4
8a47bbb3eff651537c602718b8a1f8c521549fd6d0eaa6ba582e73a2886c42c6
8bcc67dca0129075934b6b8ffe78f5eb03ed8df094e9ae5e5c57d4a589e1ecf8
8ee04e0441c9e51785d17ac835a93cf4d30d90826f87350b42ba233496a26f55
914053e444ff358317ec2778690f8dfff7c41eeb985a6b3ee2906280bbc4b61a
9158290895e962ac081ae5856cf1c361811b63e1dadf7a6b09fa2f3abbd6ecb5
91772941c245b12f8fcb8447413a0d7ceb9864bf67147894775ea9062c59f82a
92597d72536ce2725db3f04c7ad34252f8d4037ae0a61cdec08f93a0c2db05f2
92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc
967e2ca4f6acdd30fe8199d905a42f91e578494c5ae014f79d8cae4423219edc
970765cc868595b606cdb103e1b779deb9f1f01091d19435f67a504f205b68ff
98a2c6fe0f10d0fa202cdd6df45a7260c82e24222f299feef2fb4c9b5c495948
9bb1240bcc5820503f4b7bffe45b39a39f39950904618d2a0fee960f3b71f920
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
a51f645170637f10f3eba218020318af3fff3ad8e7087db87ef607896f19a940
a55c6652514d6e2ebc88198444ac6b199e6ad119d0d009eea0a52e87cd7b39df
a915aab28857afeac49311ceff852888da1623eb0f589d7f43fbfbfbceb562e9
ab1a12c0da652f8e525d21b28ca7c45b5ea34e787b561120cd8564089faf2a96
ac2a58f9d55c4642121cfb6f7e213cbc882bbdd75ef171ca8a07ed982ef693ce
ad4d57b8c2ac583a0b890f4bd88990ecbe76a7e1463f2508dd7cde85fa55aad9
affd87461f2babd57a2f7aec75e9193e8e71a377e8249a02c95a5f43326e289e
b3d580b8e7e3a0ad4bf3780732a32ffef63e1d1dd71b39e6e7742837aebc1ee2
b4624c4082093db28bdec01dd4292f7c6602bfede3a3a9a7ccbd1202e027286c
b5c49508cb6634bd049bc6086fb77f3ba315da719c4d541313e639c02138dae6
b937537ed7f13e70dc6a69b6e9b308237cd369e11fa2a2b97a24d97d8487673e
bd22135631e382a4d981e14dce6427a150d8c12cc5b779110652e0b00407eb69
bef51e48ff135e7ad05d8c18b2768cc28af0d83d6b5159e17909443c65b2d6e9
bf50c94253085740a5cce42e9c14f7b897cfc384303b38a5d9d7a0ab8ea5160f
bfd753d445592a633d4e3b8f74fe6e4ca85ab95a1f0b2fc00f11afeaaeed8194
c2a0ed3ea5aebdf80781e96b0e677656f9db72ea592b679299953852fef84b02
c2b0d171a4179bf00898c430c1c15464e528aff5762fc70a5d02184834c82eff
c57c86686c599401b7308e9bd9dd46be8790500a8423bf8b087a1603e735b9d0
c88dc26cf19cb4102bc2729c08c1e3982107b83ce8e1c4e3861666d82dd7d1a4
c999311887e70c7bc06144c364bc5c54f7fe11c740cf0eba8e5754c0afe30d7d
cbd8236978dd3f165bc49566f78c460e3937e552df38787439c1ef2797c4c709
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0cbfb1ab0f94123834567e32df7ec74a1c210793f797368d41a4b4c2732d4a0
d79c06d7a6cedcb36e87c4fc81ab9bc490f526139eb30ecfaf35e771c8c4f35f
d903935e1b2e1522b350ae6c220977d84b27286b246d66f0123b2ca98df71d10
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
d9c1e24df0b147b55f3c37ab1ed4082720620ba4fb66dcf5132b57267ec59ceb
da24f37a3ad56fc3b77e90a32126666618054524db6f13f7be6ad68bfa84340f
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e099cbd4b2f4ddf8fc0c4715ac73f46a9c3134ec539a045c87db7252a854f77b
e12fd28b1ae95db1f1a9ccf9c6a10126620766a7fca7447bd5d59c7fdb5f9478
e138f7cca84d8d0ed214a5f13ee8c34be0a116dc037d176aaf3ec3759cab0f98
e17e03dc3ff1767a8d185975a2bf392068a0b2f2848503c38ceaa3f10fb0ea84
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4daf78a5bee354c332666a7b2ad914a7434128e8b9a5a0c7db8741eda45f3f2
e6f53994bd0a6283fdf4da164ad798f20405f97f93d533091fc34bbe69a3c57f
e979a79dc02c25b72c9d268c5d6248c27c8a3f57e2bcc3e8cafa97a2d4a817f6
ea99b0d7d706f0144a121af332e2efaae3a1fa76a4a3dbdbec7faa2b0177a2b0
eada136c924874367d33d22fb496800b3f6f4e97f457829d2c18b5d41f1019a5
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
eb9249fb81640ba4dfc1c8294035105d330ef0c04ddc7e539a3acdbcec34305d
ebbdc09f56e8b9cba9117f0d84b4903fdc89508496a9b5d5b8d6bf59ff13ebbf
ee469e3d281e77f7dcc2655ff8d187907f2240c76a03bf868e7dcfd67f08d880
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef879b83b39fe97ac9e83cc9329bf03ec9199fe7433b1ae62d311ef1dac86cbc
f05e5537bc91bd6026cd2ee7a4ce48d5141ba791f68f1ce1264283c8af6c3aeb
f0e7a5dbf42c844d567b6c81602ff3145d6c3cb35f09c9dc84c6d1d0e47ccc3c
f34544ddb27241b3eccb8e06d7447230005e8718b463a30d9dd83d1e8bada1a1
f38f1f7d199b34e6221e05a075e0736c41d6d7353fdb3406ad50db9167f0af0c
f7756febea07a0adbb8ed030778aaac42302ed662089778427a1238c35f16747
f911bdd7b17d93b0528cbd2ece126cc99e61bc25addfb75e3d2ff4a69e115c9d
f949e72e543339dded097f4b07904d2162b2f44cfc3f68d9b41ffd6a2f1e8780
f988bd12377e5e223349a8283d2ff1b48c185d4ab13a11a9f9d0ed9bd374d071
fb182fea82c5fe2b1b8e719010edd3a5bf03d79ff97f6c4e7865a9ead22b4be0
fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf
fdb90f3de3d92b772d9e13acb2f4a21b35184303075c1e8fb87b4902a494fcdc
ffdc18ac8f47bcd50dd9c33532c334e7073717a62b367d95b9cb1561048547dc