www.bleepingcomputer.com Open in urlscan Pro
104.20.59.209  Public Scan

13 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11

• https://www.google.com/coop/cse/brand?form=cse-search-box&lang=en HTTP 302
• https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en

Request Chain 97

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=109b15bc6c9d1766;misc=1584514051245; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=109b15bc6c9d1766;misc=1584514051245

Request Chain 98

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=11024408b762e707;misc=1584514051245; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11024408b762e707;misc=1584514051245

Request Chain 99

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=11154965b831ab97;misc=1584514051245; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11154965b831ab97;misc=1584514051245

Request Chain 100

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=112a12525a3e79a5;misc=1584514051245; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=112a12525a3e79a5;misc=1584514051245

Request Chain 101

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=11329ac45b83e82d;misc=1584514051246; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11329ac45b83e82d;misc=1584514051246

Request Chain 102

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1147d5bb5eba5237;misc=1584514051246; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1147d5bb5eba5237;misc=1584514051246

Request Chain 103

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1159e11b195ccd74;misc=1584514051246; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=1159e11b195ccd74;misc=1584514051246

Request Chain 104

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=11690a506e7dee63;misc=1584514051246; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11690a506e7dee63;misc=1584514051246

Request Chain 105

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=117b6648b71a076f;misc=1584514051246; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=117b6648b71a076f;misc=1584514051246

Request Chain 106

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=118aa317119e1df8;misc=1584514051246; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=118aa317119e1df8;misc=1584514051246

Request Chain 107

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=11960ad14f9f1c12;misc=1584514051246; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11960ad14f9f1c12;misc=1584514051246

Request Chain 108

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=120b0f900f4ca008;misc=1584514051246; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=120b0f900f4ca008;misc=1584514051246

Request Chain 109

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=121d46e3e087484;misc=1584514051246; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=121d46e3e087484;misc=1584514051246

Request Chain 130

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=1159e11b195ccd74;misc=1584514051246 HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;apid=1A5798258e-68e4-11ea-afc3-12ce909f321e;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1159e11b195ccd74;misc=1584514051246

Request Chain 131

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=118aa317119e1df8;misc=1584514051246 HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;apid=1A579b1da2-68e4-11ea-9c72-121ea8d7377c;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=118aa317119e1df8;misc=1584514051246

Request Chain 132

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=112a12525a3e79a5;misc=1584514051245 HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A5772b2c2-68e4-11ea-9917-120f1417a350;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=112a12525a3e79a5;misc=1584514051245

Request Chain 133

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11329ac45b83e82d;misc=1584514051246 HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A57995b84-68e4-11ea-a7cc-12795fd23bd8;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11329ac45b83e82d;misc=1584514051246

Request Chain 220

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1544e112f7ff86eb;misc=1584514052344; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584514052;v=2;cmd=bid;cors=yes;alias=1544e112f7ff86eb;misc=1584514052344

Request Chain 221

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=155e084c7284e57d;misc=1584514052344; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=155e084c7284e57d;misc=1584514052344

Request Chain 222

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=156bf86f222269a;misc=1584514052344; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514052;v=2;cmd=bid;cors=yes;alias=156bf86f222269a;misc=1584514052344

Request Chain 226

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 227

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 228

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 229

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 230

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514052;v=2;cmd=bid;cors=yes;alias=156bf86f222269a;misc=1584514052344 HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A57ee7178-68e4-11ea-85ef-12f0dd10f918;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=156bf86f222269a;misc=1584514052344

Request Chain 231

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=155e084c7284e57d;misc=1584514052344 HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A57ee7e16-68e4-11ea-8ee9-12a867928a20;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=155e084c7284e57d;misc=1584514052344

Request Chain 232

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584514052;v=2;cmd=bid;cors=yes;alias=1544e112f7ff86eb;misc=1584514052344 HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A57eed8a2-68e4-11ea-9af2-12bd5c3e34a0;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1544e112f7ff86eb;misc=1584514052344

Request Chain 333

• https://eb2.3lift.com/sync HTTP 302
• https://eb2.3lift.com/sync?&ld=1

Request Chain 334

• https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 HTTP 302
• https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1

Request Chain 337

• https://eb2.3lift.com/sync HTTP 302
• https://eb2.3lift.com/sync?&ld=1

Request Chain 338

• https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 HTTP 302
• https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1

Request Chain 339

• https://eb2.3lift.com/sync HTTP 302
• https://eb2.3lift.com/sync?&ld=1

Request Chain 341

• https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 HTTP 302
• https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1

339 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
11 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/	65 KB 14 KB	626ms 577ms	Document text/html	104.20.59.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.59.209 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f33ad665f81a4ef1aa0f18317ed73f0afdaf2154c995500fe629625ff0ae505c Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers :method GET :authority www.bleepingcomputer.com :scheme https :path /news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest document accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Response headers status 200 date Wed, 18 Mar 2020 06:47:29 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d0fee819999a386ad82633865fa9e1f151584514048; expires=Fri, 17-Apr-20 06:47:28 GMT; path=/; domain=.bleepingcomputer.com; HttpOnly; SameSite=Lax; Secure session_id=76fff438b28b770969bb2ec9569dd803; path=/; domain=.bleepingcomputer.com; httponly;Secure lav=7950; expires=Fri, 17-Apr-2020 06:47:29 GMT; Max-Age=2592000; path=/;Secure content-security-policy upgrade-insecure-requests; x-frame-options SAMEORIGIN cache-control no-cache, no-store, must-revalidate pragma no-cache expires 0 last-modified Sun, 15 Mar 2020 15:44:45 GMT vary Accept-Encoding,User-Agent cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 575d00a3faea9c9f-AMS content-encoding br
GET H2	200	css fonts.googleapis.com/	15 KB 1 KB	19ms 17ms	Stylesheet text/css	2a00:1450:4001:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2dda7ea92135dcf21660d4d79391d303fc38f6a6524ae74bbe2986f1d2e990d5 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 x-xss-protection 0 last-modified Wed, 18 Mar 2020 06:47:29 GMT server ESF date Wed, 18 Mar 2020 06:47:29 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 18 Mar 2020 06:47:29 GMT
GET H2	200	bootstrap.css www.bleepstatic.com/css/redesign/	111 KB 17 KB	162ms 54ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/bootstrap.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7e7c74d95df84ef3a6be5c4fcde54fae313a04a9bd611059e6a97a23ff09f26f Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding br cf-cache-status HIT age 4056 cf-polished origSize=137522 status 200 cf-bgj minify last-modified Fri, 23 Sep 2016 14:33:06 GMT server cloudflare etag W/"2184297232" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d00a84b1fee2b-CDG expires Tue, 19 Nov 2019 07:03:01 GMT
GET H2	200	main.css www.bleepstatic.com/css/redesign/	51 KB 9 KB	152ms 45ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c9e727b37a735a7983ea8bdad06a38b246261c239bb80b86cc0ff3663c910adb Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding br cf-cache-status HIT age 443085 cf-polished origSize=60842 status 200 cf-bgj minify last-modified Thu, 16 Aug 2018 15:28:40 GMT server cloudflare etag W/"4249134023" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d00a84b20ee2b-CDG expires Wed, 25 Dec 2019 03:50:37 GMT
GET H2	200	home.css www.bleepstatic.com/css/redesign/	12 KB 3 KB	146ms 38ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/home.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b3498f138f5418bd58413e79e4c0969e618d6f2fee2d9d98c0f4e70a6cbd04ad Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding br cf-cache-status HIT age 3717 cf-polished origSize=14998 status 200 cf-bgj minify last-modified Sat, 24 Mar 2018 16:18:00 GMT server cloudflare etag W/"2402535603" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d00a84b21ee2b-CDG expires Tue, 24 Dec 2019 11:34:37 GMT
GET H2	200	news.css www.bleepstatic.com/css/redesign/	27 KB 5 KB	150ms 42ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/news.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d44b93a0af159f0d547d7ec89e9227a5667ce1171bc630e6fbf79dae0e596e2d Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding br cf-cache-status HIT age 3491 cf-polished origSize=32905 status 200 cf-bgj minify last-modified Tue, 26 Nov 2019 02:56:16 GMT server cloudflare etag W/"400467278" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d00a84b22ee2b-CDG expires Mon, 27 Jan 2020 06:37:13 GMT
GET H2	200	jquery-1.11.1.min.js Show response www.bleepstatic.com/js/redesign/	94 KB 32 KB	169ms 61ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/jquery-1.11.1.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding br cf-cache-status HIT last-modified Thu, 23 Apr 2015 12:36:44 GMT server cloudflare age 1471856 etag W/"3647451394" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript status 200 cache-control max-age=3024000 cf-ray 575d00a84b23ee2b-CDG access-control-allow-origin * expires Sun, 05 Apr 2020 05:56:33 GMT
GET H2	200	news.js Show response www.bleepstatic.com/js/redesign/	183 B 252 B	148ms 40ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/news.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 827252be04765631f8ff21fee8ffe1028e27dfa52f62c08ef3182609a0a0e991 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding br cf-cache-status HIT age 784318 cf-polished origSize=247 status 200 cf-bgj minify last-modified Wed, 16 Dec 2015 15:41:46 GMT server cloudflare etag W/"4218930423" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d00a84b24ee2b-CDG expires Mon, 13 Apr 2020 04:55:31 GMT
GET H2	200	connatix.renderer.infeed.min.js Show response cdn.connatix.com/min/	957 B 1 KB	97ms 24ms	Script application/javascript	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.connatix.com/min/connatix.renderer.infeed.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash 45a3f5d0135ab059ea2ad9f75b800440db8c2c98ae88afacf19cd3366a71f010 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT via 1.1 varnish server Varnish age 0 x-cache HIT content-type application/javascript status 200 x-referer-host bleepingcomputer.com cache-control no-cache, no-store, must-revalidate, max-age=0 x-cache-hits 0 accept-ranges bytes x-timer S1584514049.293087,VS0,VE0 content-length 957 retry-after 0 x-served-by cache-fra19149-FRA
GET H2	200	qc-consent.js Show response www.bleepstatic.com/js/qc-consent/	3 KB 1 KB	36ms 34ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/qc-consent/qc-consent.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3b6a84a416edfb98ed7608dad8cd26ffd7123e54bce2bb13a4a3394e0b948382 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding br cf-cache-status HIT age 1473624 cf-polished origSize=3848 status 200 cf-bgj minify last-modified Thu, 07 Feb 2019 13:49:44 GMT server cloudflare etag W/"3981350888" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d00a8ec4fee2b-CDG expires Sun, 05 Apr 2020 05:27:05 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	75 KB 28 KB	18ms 15ms	Script application/javascript	2a00:1450:4001:817::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-91740-1 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:817::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 025e7e180ec38cee031546ed3a613dc266575a90fb028db4572236863b185c70 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding br status 200 strict-transport-security max-age=31536000; includeSubDomains alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 28648 x-xss-protection 0 last-modified Wed, 18 Mar 2020 06:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin http://www.googletagmanager.com cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 18 Mar 2020 06:47:29 GMT
GET H2	200	logo.png www.bleepstatic.com/images/site/	1 KB 1 KB	37ms 34ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/logo.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 19db4a2cde712e2ceaac317e732b4ec40b62818a938a8bf8391ad68470845019 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:29 GMT cf-cache-status HIT age 482961 cf-polished origFmt=png, origSize=1882 status 200 content-disposition inline; filename="logo.webp" cf-bgj imgq:85 content-length 1152 last-modified Sat, 04 Mar 2017 04:12:00 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d00a8ec51ee2b-CDG expires Sat, 11 Apr 2020 16:38:08 GMT
GET H2	200	brand Show response cse.google.com/coop/cse/ Redirect Chain https://www.google.com/coop/cse/brand?form=cse-search-box&lang=en https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en	3 KB 2 KB	17ms 6ms	Script text/javascript	2a00:1450:4001:815::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software pfe / Resource Hash 4eeb4df3522892ea2ec61de6a58e870e8262019f8e3c759c099450cefb589313 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 06:24:07 GMT content-encoding gzip x-content-type-options nosniff server pfe age 1402 x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 status 200 cache-control public, max-age=1800 content-disposition attachment; filename="f.txt" alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1181 x-xss-protection 0 expires Wed, 18 Mar 2020 06:54:07 GMT Redirect headers date Wed, 18 Mar 2020 06:47:29 GMT x-content-type-options nosniff server sffe location https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en content-type text/html; charset=UTF-8 status 302 cache-control private alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 266 x-xss-protection 0
GET H2	200	cloudflare-stroked.jpg www.bleepstatic.com/content/hl-images/2020/03/14/	149 KB 150 KB	45ms 43ms	Image image/jpeg	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/content/hl-images/2020/03/14/cloudflare-stroked.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b7270a8c8fd515c3b71e85d83ff6b947bd549c55671dc7b12a4391bd98efd524 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:29 GMT cf-cache-status HIT age 303114 cf-polished status=not_needed status 200 cf-bgj imgq:85 content-length 152793 last-modified Sat, 14 Mar 2020 15:16:58 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d00a8ec52ee2b-CDG expires Mon, 13 Apr 2020 18:35:35 GMT
GET H2	200	extension.jpg www.bleepstatic.com/images/news/malware/b/blackwater/	35 KB 35 KB	39ms 36ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/news/malware/b/blackwater/extension.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7b929d3ac5dffec5f2dcf7e7f63c1b281300e3a8a482eb3c46943677c82d592e Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:29 GMT cf-cache-status HIT age 303019 cf-polished qual=85, origFmt=jpeg, origSize=53102 status 200 content-disposition inline; filename="extension.webp" cf-bgj imgq:85 content-length 35926 last-modified Sat, 14 Mar 2020 16:33:35 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d00a8ec53ee2b-CDG expires Mon, 13 Apr 2020 18:37:10 GMT
GET H2	200	decoy-doc.jpg www.bleepstatic.com/images/news/malware/b/blackwater/	160 KB 160 KB	64ms 62ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/news/malware/b/blackwater/decoy-doc.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6301773c976fdc9639415e380fc70c78ede069d572cf6c391c7c070081973e84 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:29 GMT cf-cache-status HIT age 303019 cf-polished qual=85, origFmt=jpeg, origSize=180163 status 200 content-disposition inline; filename="decoy-doc.webp" cf-bgj imgq:85 content-length 163568 last-modified Sat, 14 Mar 2020 16:33:35 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d00a8ec54ee2b-CDG expires Mon, 13 Apr 2020 18:37:09 GMT
GET H2	200	adsbygoogle.js Show response pagead2.googlesyndication.com/pagead/js/	106 KB 38 KB	23ms 21ms	Script text/javascript	2a00:1450:4001:818::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 1aed87072b3ad1e8bede086e65fddd450a76628f35c7c6e3e14bac16ebd2d50d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 38653 x-xss-protection 0 server cafe etag 3682008271491073185 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Wed, 18 Mar 2020 06:47:29 GMT
GET H2	200	twitter.png www.bleepstatic.com/images/site/login/	282 B 674 B	38ms 36ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/login/twitter.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 67d86a29de7993fbd23b7dde2c4f26bdc434055c35a4b08c830c0d02fcfa6dd2 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:29 GMT cf-cache-status HIT age 474417 cf-polished origFmt=png, origSize=475 status 200 content-disposition inline; filename="twitter.webp" cf-bgj imgq:85 content-length 282 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d00a8ec55ee2b-CDG expires Sat, 11 Apr 2020 19:00:32 GMT
GET H2	200	bootstrap.js Show response www.bleepstatic.com/js/redesign/	44 KB 10 KB	44ms 42ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/bootstrap.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e5e0f326458e8b8ed839d42a0cf6892df80bf26d7dc7e4f8276a65c41582ab85 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding br cf-cache-status HIT age 3741 cf-polished origSize=65813 status 200 cf-bgj minify last-modified Thu, 23 Apr 2015 12:36:43 GMT server cloudflare etag W/"3930092018" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d00a8ec56ee2b-CDG expires Tue, 24 Dec 2019 11:34:37 GMT
GET H2	200	blazy.min.js Show response www.bleepstatic.com/js/blazy/	5 KB 2 KB	36ms 34ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/blazy/blazy.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0f427d0f88a0698c955ff63bf13af4ca80c9b32f218b5e210847450da901a74f Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding br cf-cache-status HIT last-modified Thu, 16 Aug 2018 21:06:19 GMT server cloudflare age 1004 etag W/"753357888" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript status 200 cache-control max-age=3024000 cf-ray 575d00a89bcbee2b-CDG access-control-allow-origin * expires Wed, 16 Oct 2019 12:18:00 GMT
GET H2	200	bleep.js Show response www.bleepstatic.com/js/redesign/	3 KB 765 B	44ms 42ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/bleep.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 22e977346d45bab9f531ce1132d7ecfbe8e46868eaea790a0d4dcd1d0649d74b Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding br cf-cache-status HIT age 642 cf-polished origSize=3600 status 200 cf-bgj minify last-modified Mon, 01 Oct 2018 12:47:57 GMT server cloudflare etag W/"2696894447" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d00a8ec58ee2b-CDG expires Wed, 11 Dec 2019 01:44:46 GMT
GET H2	200	jquery.fancybox.js Show response www.bleepstatic.com/js/redesign/fancybox/	31 KB 9 KB	42ms 40ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 31cd7d9398307ca2e6cfaa111bbe7b69d69cbaaed2ff74034412ebc5008671fd Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding br cf-cache-status HIT age 3648 cf-polished origSize=48706 status 200 cf-bgj minify last-modified Wed, 14 Oct 2015 20:25:51 GMT server cloudflare etag W/"327140449" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d00a8ec5aee2b-CDG expires Wed, 16 Oct 2019 12:18:22 GMT
GET H2	200	fixto.min.js Show response www.bleepstatic.com/js/fixto/	8 KB 3 KB	40ms 36ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/fixto/fixto.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7d6d26827b887aa09b2a5eb7c001e35b93773e53c36ddbfc127ad824e0a6ba39 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding br cf-cache-status HIT last-modified Sat, 13 Jun 2015 21:34:42 GMT server cloudflare age 2853 etag W/"1740214911" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript status 200 cache-control max-age=3024000 cf-ray 575d00a8abe7ee2b-CDG access-control-allow-origin * expires Mon, 23 Dec 2019 21:16:36 GMT
GET H2	200	addthis_widget.js Show response s9.addthis.com/js/300/	349 KB 113 KB	88ms 31ms	Script application/javascript	23.210.248.44 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://s9.addthis.com/js/300/addthis_widget.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-248-44.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash ab8ceea757a634f5ce5a9ed6f6b4bcdd555869b385d315854e16914a2f5a3bc7 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip last-modified Tue, 21 Jan 2020 20:57:37 GMT server nginx/1.15.8 etag "5e2765c1-57446" vary Accept-Encoding x-distribution 99 content-type application/javascript status 200 cache-control public, max-age=600 date Wed, 18 Mar 2020 06:47:29 GMT x-host s9.addthis.com content-length 114924
GET H2	200	pubfig.min.js Show response a.pub.network/bleepingcomputer-com/	440 KB 117 KB	56ms 32ms	Script application/javascript	2606:4700:20::681a:8b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://a.pub.network/bleepingcomputer-com/pubfig.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:8b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a2539dc15986b9b35d8bfb45cd0afd56f1a946f18d21e7da3bd8193bb55109e3 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding br cf-cache-status HIT age 48 status 200 x-guploader-uploadid AEnB2UrXgNm0OKSMsZtBb02mfh5p1wXdAzHSNMhM2R63CnpngVbC5s55KUONWf1X1KXAV3XPxz9m7YiYcJq03wHM6Bd9mhlzDA x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity last-modified Tue, 17 Mar 2020 22:05:15 GMT server cloudflare etag W/"f08464270a5460e6b9ae203ad0c9057a" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=AN1klA==, md5=8IRkJwpUYOa5riA60MkFeg== content-type application/javascript x-goog-generation 1584482715941725 cache-control public, max-age=1800 x-goog-stored-content-length 450302 cf-ray 575d00a90b8dc2c7-FRA expires Wed, 18 Mar 2020 06:47:41 GMT
GET H/1.1	200 OK	fab.js Show response ecdn.analysis.fi/static/js/	4 KB 2 KB	125ms 28ms	Script application/javascript	212.71.236.117 LINODE-AP Linode
General Check archive.org Show headers Download Go to Full URL https://ecdn.analysis.fi/static/js/fab.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 212.71.236.117 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS nb-212-71-236-117.london.nodebalancer.linode.com Software nginx/1.12.2 / Resource Hash affd87461f2babd57a2f7aec75e9193e8e71a377e8249a02c95a5f43326e289e Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Wed, 18 Mar 2020 06:46:54 GMT Content-Encoding gzip Last-Modified Wed, 15 Jul 2015 00:00:00 GMT Server nginx/1.12.2 ETag "55a5a280-560" Content-Type application/javascript Cache-Control max-age=3600 Connection close Content-Length 1376 Expires Wed, 18 Mar 2020 07:46:54 GMT
GET H2	200	login_bg.png www.bleepstatic.com/images/site/	126 B 414 B	58ms 58ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/login_bg.png Requested by Host: cdn.connatix.com URL: https://cdn.connatix.com/min/connatix.renderer.infeed.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 32e73e8e0eec3e6c1345d84e7ef091b90e71fb0045814043b34c914156235eb9 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:29 GMT cf-cache-status HIT age 480200 cf-polished origFmt=png, origSize=187 status 200 content-disposition inline; filename="login_bg.webp" cf-bgj imgq:85 content-length 126 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d00a8fc6bee2b-CDG expires Sat, 11 Apr 2020 17:24:09 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:815::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: cdn.connatix.com URL: https://cdn.connatix.com/min/connatix.renderer.infeed.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 08:47:06 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 1720823 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11016 x-xss-protection 0 expires Fri, 26 Feb 2021 08:47:06 GMT
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	7ms 7ms	Font font/woff2	2a00:1450:4001:815::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2 Requested by Host: cdn.connatix.com URL: https://cdn.connatix.com/min/connatix.renderer.infeed.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 31 Jan 2020 00:50:19 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:58 GMT server sffe age 4082230 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11020 x-xss-protection 0 expires Sat, 30 Jan 2021 00:50:19 GMT
GET H2	200	connatix.renderer.infeed.min_dc.js Show response cdns.connatix.com/p/1911/min/ Frame E6FA	725 KB 191 KB	29ms 22ms	Script application/x-javascript	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Requested by Host: cdn.connatix.com URL: https://cdn.connatix.com/min/connatix.renderer.infeed.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 180ef002784b30cbe662cc5e8cde9b65da0adca8a993371fbb9bfa9a990182e4 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding gzip age 560610 x-cache HIT, HIT status 200 content-length 194812 via 1.1 varnish, 1.1 varnish x-served-by cache-dca17725-DCA, cache-fra19149-FRA last-modified Wed, 11 Mar 2020 19:03:09 GMT x-timer S1584514049.442692,VS0,VE0 etag "ff3bcb0ad90321a624e17d47c9d54127" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control max-age=31557600 accept-ranges bytes x-cache-hits 1, 92846
GET DATA	200 OK	truncated /	37 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	nav_bg.png www.bleepstatic.com/images/site/	72 B 354 B	45ms 45ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/nav_bg.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ab52a578c101a14bbc790f87f9a7400dda65469f23c6ce85c461e07cdf776460 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:29 GMT cf-cache-status HIT age 473511 cf-polished origFmt=png, origSize=83 status 200 content-disposition inline; filename="nav_bg.webp" cf-bgj imgq:85 content-length 72 last-modified Sat, 04 Mar 2017 07:57:02 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d00a90c93ee2b-CDG expires Sat, 11 Apr 2020 19:15:37 GMT
GET H2	200	20x20-printer.png www.bleepstatic.com/images/site/	422 B 590 B	46ms 46ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/20x20-printer.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b34676178982122b66b0a55d3ee411fa343b1d19a6c119c0c9b0ea2c892738a1 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:29 GMT cf-cache-status HIT age 474417 cf-polished origFmt=png, origSize=824 status 200 content-disposition inline; filename="20x20-printer.webp" cf-bgj imgq:85 content-length 422 last-modified Sat, 03 Oct 2015 03:18:32 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d00a91ca8ee2b-CDG expires Sat, 11 Apr 2020 19:00:32 GMT
GET H2	200	calendar.png www.bleepstatic.com/images/site/	86 B 250 B	46ms 45ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/calendar.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 85ae9534729617e69eafa40195c7854697eb3d13b4205f3ee467e07c4af0a24b Request headers Referer https://www.bleepstatic.com/css/redesign/news.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:29 GMT cf-cache-status HIT age 428794 cf-polished origFmt=png, origSize=129 status 200 content-disposition inline; filename="calendar.webp" cf-bgj imgq:85 content-length 86 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d00a91ca9ee2b-CDG expires Sun, 12 Apr 2020 07:40:54 GMT
GET H2	200	clock.png www.bleepstatic.com/images/site/	252 B 522 B	44ms 44ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/clock.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 82c7fdbc4d001907e1e5d56cd335af3f0d48e0ffa7f0ad2aa3486ebb1123cb21 Request headers Referer https://www.bleepstatic.com/css/redesign/news.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:29 GMT cf-cache-status HIT age 482818 cf-polished origFmt=png, origSize=1316 status 200 content-disposition inline; filename="clock.webp" cf-bgj imgq:85 content-length 252 last-modified Fri, 29 May 2015 07:08:14 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d00a91caaee2b-CDG expires Sat, 11 Apr 2020 16:40:31 GMT
GET H2	200	comment-light.png www.bleepstatic.com/images/site/	96 B 308 B	45ms 45ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/comment-light.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bfc8e65089dc5421d56ecc71a0328eafd4feb2a602503ae5c15bfa3189c02f7e Request headers Referer https://www.bleepstatic.com/css/redesign/news.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:29 GMT cf-cache-status HIT age 481074 cf-polished origFmt=png, origSize=1034 status 200 content-disposition inline; filename="comment-light.webp" cf-bgj imgq:85 content-length 96 last-modified Fri, 29 May 2015 07:08:28 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d00a91cacee2b-CDG expires Sat, 11 Apr 2020 17:09:35 GMT
GET H2	200	32x32-printer.png www.bleepstatic.com/images/site/	256 B 425 B	44ms 43ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/32x32-printer.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 33eb81af8a0101c1ad2a210f322fb362ce1598e6e37f0a7ecc62d6ff39add590 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:29 GMT cf-cache-status HIT age 475826 cf-polished origFmt=png, origSize=618 status 200 content-disposition inline; filename="32x32-printer.webp" cf-bgj imgq:85 content-length 256 last-modified Fri, 02 Oct 2015 21:57:19 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d00a91cadee2b-CDG expires Sat, 11 Apr 2020 18:37:03 GMT
GET H2	200	21beb902b545b086a90ec39f1df36b94.jpg www.bleepstatic.com/author/photos/	7 KB 8 KB	43ms 43ms	Image image/jpeg	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/author/photos/21beb902b545b086a90ec39f1df36b94.jpg Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 19e1dbba639ba68ceb71cdada9621e11d0aec6edba410971f1937d6cc4935b32 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:29 GMT cf-cache-status HIT age 1604 cf-polished origSize=7617, status=webp_bigger status 200 cf-bgj imgq:85 content-length 7581 last-modified Mon, 26 Oct 2015 17:15:33 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d00a91caeee2b-CDG expires Wed, 18 Dec 2019 21:16:38 GMT
GET H2	200	h4-bg.png www.bleepstatic.com/images/site/	38 B 200 B	42ms 42ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/h4-bg.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 942935ead42820e6c9184f099c77dde34fa4be70d395a17c47b5d7ad07967339 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:29 GMT cf-cache-status HIT age 483504 cf-polished origFmt=png, origSize=72 status 200 content-disposition inline; filename="h4-bg.webp" cf-bgj imgq:85 content-length 38 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d00a91cb0ee2b-CDG expires Sat, 11 Apr 2020 16:29:04 GMT
GET H2	200	news_email_icon.png www.bleepstatic.com/images/site/	126 B 400 B	43ms 43ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/news_email_icon.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7c42933014424dabb2256a0732a9f792559d26ba09a84308c278f52834522f9a Request headers Referer https://www.bleepstatic.com/css/redesign/home.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:29 GMT cf-cache-status HIT age 542826 cf-polished origFmt=png, origSize=1105 status 200 content-disposition inline; filename="news_email_icon.webp" cf-bgj imgq:85 content-length 126 last-modified Fri, 29 May 2015 07:10:12 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d00a91cb1ee2b-CDG expires Sat, 11 Apr 2020 00:00:23 GMT
GET H2	200	news_footer_icon.png www.bleepstatic.com/images/site/	110 B 485 B	43ms 43ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/news_footer_icon.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d020fa6036628dd1d6dbf760edc742273359e93119832249bdce332d05d6db4d Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:29 GMT cf-cache-status HIT age 482883 cf-polished origFmt=png, origSize=186 status 200 content-disposition inline; filename="news_footer_icon.webp" cf-bgj imgq:85 content-length 110 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d00a91cb3ee2b-CDG expires Sat, 11 Apr 2020 16:39:26 GMT
GET H2	200	KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:815::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2 Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:21:18 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:52 GMT server sffe age 1135571 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11180 x-xss-protection 0 expires Fri, 05 Mar 2021 03:21:18 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:815::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:12:39 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 1136090 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11056 x-xss-protection 0 expires Fri, 05 Mar 2021 03:12:39 GMT
GET H2	200	integrator.js Show response adservice.google.de/adsid/	109 B 171 B	15ms 14ms	Script application/javascript	2a00:1450:4001:800::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.de/adsid/integrator.js?domain=www.bleepingcomputer.com Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding gzip x-content-type-options nosniff content-type application/javascript; charset=UTF-8 server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." status 200 cache-control private, no-cache, no-store content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 104 x-xss-protection 0
GET H2	200	integrator.js Show response adservice.google.com/adsid/	109 B 171 B	14ms 14ms	Script application/javascript	2a00:1450:4001:800::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=www.bleepingcomputer.com Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding gzip x-content-type-options nosniff content-type application/javascript; charset=UTF-8 server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." status 200 cache-control private, no-cache, no-store content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 104 x-xss-protection 0
GET H2	200	show_ads_impl_fy2019.js Show response pagead2.googlesyndication.com/pagead/js/r20200312/r20190131/	222 KB 83 KB	27ms 27ms	Script text/javascript	2a00:1450:4001:818::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20200312/r20190131/show_ads_impl_fy2019.js Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 2ce2129da582125d26c643bfa3ad19f6f2532b7c2a57da274139de2c79b48af7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 84992 x-xss-protection 0 server cafe etag 12744657352742557000 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=1209600 timing-allow-origin * expires Wed, 18 Mar 2020 06:47:29 GMT
GET H2	200	zrt_lookup.html googleads.g.doubleclick.net/pagead/html/r20200312/r20190131/ Frame 1755	0 0	6ms 6ms	Document text/html	2a00:1450:4001:81c::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/html/r20200312/r20190131/zrt_lookup.html Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority googleads.g.doubleclick.net :scheme https :path /pagead/html/r20200312/r20190131/zrt_lookup.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Response headers status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * vary Accept-Encoding date Fri, 13 Mar 2020 05:08:45 GMT expires Fri, 27 Mar 2020 05:08:45 GMT content-type text/html; charset=UTF-8 etag 10348540741379653356 x-content-type-options nosniff content-encoding gzip server cafe content-length 4494 x-xss-protection 0 cache-control public, max-age=1209600 age 437924 alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
GET H2	200	292x176_Elephant_Donkey.jpg www.bleepstatic.com/content/hl-images/2020/03/16/thumb/	7 KB 7 KB	37ms 36ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/content/hl-images/2020/03/16/thumb/292x176_Elephant_Donkey.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d8cf9429bf3be47fe003699a30c6b81385677687e5043859b777f9054184822b Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:29 GMT cf-cache-status HIT age 112100 cf-polished qual=85, origFmt=jpeg, origSize=8753 status 200 content-disposition inline; filename="292x176_Elephant_Donkey.webp" cf-bgj imgq:85 content-length 7176 last-modified Mon, 16 Mar 2020 21:54:21 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d00a99e05ee2b-CDG expires Wed, 15 Apr 2020 23:39:09 GMT
GET H2	200	292x176_Windows__10.jpg www.bleepstatic.com/content/hl-images/2019/05/30/thumb/	3 KB 3 KB	41ms 40ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/content/hl-images/2019/05/30/thumb/292x176_Windows__10.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ef17bf1995f4f731446456c0e56c45eda744cd59d7ef0ba91348bf16ab8b055c Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:29 GMT cf-cache-status HIT age 92016 cf-polished qual=85, origFmt=jpeg, origSize=3881 status 200 content-disposition inline; filename="292x176_Windows__10.webp" cf-bgj imgq:85 content-length 2594 last-modified Thu, 30 May 2019 21:34:22 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d00a99e07ee2b-CDG expires Thu, 16 Apr 2020 05:13:53 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	44 KB 18 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:814::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-91740-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Thu, 06 Feb 2020 00:21:02 GMT server Golfe2 age 837 date Wed, 18 Mar 2020 06:33:32 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 18174 expires Wed, 18 Mar 2020 08:33:32 GMT
GET H2	200	cmp.js Show response quantcast.mgr.consensu.org/	225 KB 61 KB	25ms 8ms	Script text/javascript	2600:9000:20eb:6600:9:46dc:4700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://quantcast.mgr.consensu.org/cmp.js Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:20eb:6600:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 826acef37820db4f3e9b999fa220c33e40cdd0b862f9717190a775dddd38d846 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:46:33 GMT content-encoding gzip last-modified Tue, 17 Mar 2020 20:57:22 GMT server AmazonS3 age 572 x-amz-server-side-encryption AES256 vary Accept-Encoding x-cache Hit from cloudfront content-type text/javascript;charset=UTF-8 status 200 x-amz-meta-qc-ineu True x-amz-cf-pop FRA2-C1 x-amz-cf-id Dg6LjqYpt6QBYhQrLv-dfGHLJ63LrauQgJTCsGxvCZq6I_q4d1IGxg== via 1.1 29051585a13addd312c8ac9d527433c6.cloudfront.net (CloudFront)
GET H2	200	jquery.fancybox.css www.bleepstatic.com/js/redesign/fancybox/	4 KB 1 KB	34ms 34ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6e86593083facba2710a2312f26bd7b436d7ef299f99cbc2ccc1b32693ec3144 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding br cf-cache-status HIT age 2721 cf-polished origSize=4895 status 200 cf-bgj minify last-modified Wed, 14 Oct 2015 20:25:51 GMT server cloudflare etag W/"9108074" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d00a9be31ee2b-CDG expires Tue, 19 Nov 2019 07:02:56 GMT
GET H2	200	font-awesome.css www.bleepstatic.com/css/redesign/	22 KB 5 KB	38ms 37ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/font-awesome.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8733e2183f16906b2fa2e58fdab82cf336f249ab71ac1b184470da2dd3c6e29f Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding br cf-cache-status HIT age 3330 cf-polished origSize=26776 status 200 cf-bgj minify last-modified Tue, 03 May 2016 04:39:29 GMT server cloudflare etag W/"1700274315" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d00a9be33ee2b-CDG expires Wed, 11 Dec 2019 01:44:49 GMT
GET H2	200	g Show response ck.connatix.com/	46 B 235 B	3099ms 22ms	Script text/plain	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Full URL https://ck.connatix.com/g?callback=cnxJSONP_2bae8d962a0fcbc250381584514049561 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash 5c3ef8ff0a4b3f29dd7ebde48bb3a92bdfff7b8ca6d28b662b6ddbdfa7f99395 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:32 GMT via 1.1 varnish server Varnish age 0 x-cache HIT status 200 cache-control no-cache, no-store, must-revalidate, max-age=0 x-cache-hits 0 accept-ranges bytes x-timer S1584514053.647362,VS0,VE0 content-length 46 retry-after 0 x-served-by cache-hhn4060-HHN
GET H/1.1	200 OK	cookie Show response d.pub.network/	36 B 472 B	489ms 118ms	XHR text/plain	35.188.71.214 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://d.pub.network/cookie Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.71.214 , United States, ASN15169 (GOOGLE, US), Reverse DNS 214.71.188.35.bc.googleusercontent.com Software / Resource Hash 45b0910ba9220a65c657fd2c12cf911f56a37300e200acb3d97227384b978d9d Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Wed, 18 Mar 2020 06:47:30 GMT Access-Control-Allow-Credentials true Content-Length 36 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Content-Type text/plain;charset=utf-8
GET H2	200	gpt.js Show response www.googletagservices.com/tag/js/	42 KB 14 KB	15ms 14ms	Script text/javascript	2a00:1450:4001:800::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/tag/js/gpt.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a519a1e5dbf70e322138ea492c71bdadae357cfab95bf924598dc708e4096da3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "459 / 757 of 1000 / last-modified: 1584453129" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 14363 x-xss-protection 0 expires Wed, 18 Mar 2020 06:47:29 GMT
GET H/1.1	200 OK	gallery.js Show response freestar-io.videoplayerhub.com/	100 KB 26 KB	92ms 21ms	Script application/javascript	13.224.194.107 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://freestar-io.videoplayerhub.com/gallery.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.194.107 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-194-107.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 13c421211a0dab4d46d963d3dfc1e0266763f7ac2cdd93284f617adfb8dab691 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers x-amz-version-id Pqn3HZ.yob7Q8DzEleg2kh2VtSM5_7QY Content-Encoding gzip Last-Modified Fri, 13 Mar 2020 13:59:51 GMT Server AmazonS3 Age 15 Date Wed, 18 Mar 2020 06:47:20 GMT Vary Accept-Encoding X-Cache Hit from cloudfront Content-Type application/javascript Via 1.1 e0efba8a72628bfc3dc6d4d637b28302.cloudfront.net (CloudFront) Transfer-Encoding chunked X-Amz-Cf-Pop FRA2-C1 Connection keep-alive X-Amz-Cf-Id 5bgaW1n5HbKbDtsVAoviBBd2ZuCI0Cbkx_PO0VadlxUf_oqxLm1SpA==
GET H2	200	prebid-analytics-3.6.2.js Show response a.pub.network/core/	350 KB 107 KB	153ms 153ms	Script text/html	2606:4700:20::681a:8b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://a.pub.network/core/prebid-analytics-3.6.2.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:8b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8bfc61f56cf987bfbf5e1c86e6746d24c7dcd6ad98806dfca9d63c6110810582 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding br cf-cache-status BYPASS status 200 x-guploader-uploadid AEnB2UqbdPwDDRgRttnfiPIFO5VL-RYX0cvmvrbn3M1toO4mD5EUKCAB6wZ69Pyd-2JuElqxnEqHLER_uPPD6sZeWKJjI6w0JA x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 3 x-goog-stored-content-encoding identity last-modified Fri, 28 Feb 2020 20:11:08 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=zs10DQ==, md5=a/aOr3cetk5W0I0PmuPrIQ== content-type text/html x-goog-generation 1582920668771105 cache-control private x-goog-stored-content-length 358240 cf-ray 575d00aa7ecfc2c7-FRA expires Thu, 18 Mar 2021 06:47:29 GMT
GET H/1.1	200 OK	location Show response d.pub.network/	51 B 498 B	475ms 117ms	XHR application/json	35.188.71.214 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://d.pub.network/location Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.71.214 , United States, ASN15169 (GOOGLE, US), Reverse DNS 214.71.188.35.bc.googleusercontent.com Software / Resource Hash 6358c6ea8da1fcf2fc88c991a803c1a5f63b13247d7c546f1e3365ce17ec484d Request headers Accept application/json, text/plain, */* Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Wed, 18 Mar 2020 06:47:30 GMT Access-Control-Allow-Credentials true Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Transfer-Encoding chunked Content-Type application/json
GET H2	200	fontawesome-webfont.woff www.bleepstatic.com/fonts/	64 KB 64 KB	114ms 52ms	Font application/octet-stream	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/fonts/fontawesome-webfont.woff?v=4.2.0 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1 Request headers Referer https://www.bleepstatic.com/css/redesign/font-awesome.css Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 06:47:29 GMT cf-cache-status HIT last-modified Thu, 23 Apr 2015 09:36:00 GMT server cloudflare age 4396 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/octet-stream status 200 accept-ranges bytes cf-ray 575d00ab0d6da8df-CDG access-control-allow-origin * content-length 65452
GET H2	200	moatframe.js Show response z.moatads.com/addthismoatframe568911941483/	2 KB 1 KB	79ms 25ms	Script application/x-javascript	23.210.250.213 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/addthismoatframe568911941483/moatframe.js Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-250-213.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding gzip last-modified Fri, 08 Nov 2019 20:13:52 GMT server AmazonS3 x-amz-request-id FBAF69B7861DE212 etag "f14b4e1f799b14f798a195f43cf58376" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=42101 accept-ranges bytes content-length 948 x-amz-id-2 mINJDBnKUfP83RzDJ6hQaYSGPvMPOM770jd+gXVSD8LFScfPdVPaVzI4W2IwmrtEKhDna93Nv9A=
GET H2	200	_ate.track.config_resp Show response v1.addthisedge.com/live/boost/ra-561517d2c7f964d6/	2 KB 855 B	207ms 206ms	Script application/javascript	23.210.248.44 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://v1.addthisedge.com/live/boost/ra-561517d2c7f964d6/_ate.track.config_resp Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-248-44.deploy.static.akamaitechnologies.com Software / Resource Hash 6d23d10111755a12c87198df1c71cce449de31eca9643030c6327a2157f9bd86 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding gzip etag -1659864586--gzip vary Accept-Encoding content-type application/javascript;charset=utf-8 status 200 cache-control public, max-age=55, s-maxage=86400 content-disposition attachment; filename=1.txt content-length 678
GET H2	200	ads googleads.g.doubleclick.net/pagead/ Frame 5697	0 0	524ms 524ms	Document text/html	2a00:1450:4001:81c::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1584287085&rafmt=9&psa=0&guci=1.2.0.0.2.2.0.0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&adsid=NT&dt=1584514049498&bpp=13&bdt=289&fdt=222&idt=222&shv=r20200312&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=596583608777&frm=20&pv=2&ga_vid=2079321426.1584514050&ga_sid=1584514050&ga_hid=511514683&ga_fc=0&iag=0&icsg=35321813671936&dssz=46&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=208&ady=4717&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=26835106&oid=3&pvsid=1724307350463099&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=144&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=pc5V544sKI&p=https%3A//www.bleepingcomputer.com&dtd=242 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200312/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority googleads.g.doubleclick.net :scheme https :path /pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1584287085&rafmt=9&psa=0&guci=1.2.0.0.2.2.0.0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&adsid=NT&dt=1584514049498&bpp=13&bdt=289&fdt=222&idt=222&shv=r20200312&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=596583608777&frm=20&pv=2&ga_vid=2079321426.1584514050&ga_sid=1584514050&ga_hid=511514683&ga_fc=0&iag=0&icsg=35321813671936&dssz=46&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=208&ady=4717&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=26835106&oid=3&pvsid=1724307350463099&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=144&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=pc5V544sKI&p=https%3A//www.bleepingcomputer.com&dtd=242 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Response headers status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding br date Wed, 18 Mar 2020 06:47:30 GMT server cafe content-length 25608 x-xss-protection 0 set-cookie test_cookie=CheckForPermission; expires=Wed, 18-Mar-2020 07:02:29 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 expires Wed, 18 Mar 2020 06:47:30 GMT cache-control private
GET H2	200	osd.js Show response www.googletagservices.com/activeview/js/current/	73 KB 27 KB	13ms 13ms	Script text/javascript	2a00:1450:4001:800::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200312/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 909009056877bdbc198a45c7adec7d4b0615aa97d0a4d61ac493472dd0b4a97f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1584217929168357" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 27546 x-xss-protection 0 expires Wed, 18 Mar 2020 06:47:29 GMT
GET H2	200	collect www.google-analytics.com/r/	35 B 111 B	13ms 13ms	Image image/gif	2a00:1450:4001:814::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/r/collect?v=1&_v=j81&a=511514683&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&ul=en-us&de=UTF-8&dt=BlackWater%20Malware%20Abuses%20Cloudflare%20Workers%20for%20C2%20Communication&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IAhAAUAB~&jid=1523317053&gjid=2027553858&cid=2079321426.1584514050&tid=UA-91740-1&_gid=200213905.1584514050&_r=1&gtm=2ou3b2&z=1642514925 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:29 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 access-control-allow-origin * content-type image/gif status 200 cache-control no-cache, no-store, must-revalidate alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 35 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	favicon.ico ad.doubleclick.net/	1 KB 456 B	76ms 23ms	Image image/x-icon	216.58.207.38 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.207.38 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s24-in-f6.1e100.net Software sffe / Resource Hash d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 19:07:05 GMT content-encoding gzip x-content-type-options nosniff age 42024 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 104 x-xss-protection 0 last-modified Tue, 08 May 2012 13:08:06 GMT server sffe vary Accept-Encoding content-type image/x-icon access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes expires Wed, 18 Mar 2020 19:07:05 GMT
GET H2	200	cmp-3pc-check.html static.quantcast.mgr.consensu.org/v31/ Frame DAF4	0 0	22ms 6ms	Document text/html	2600:9000:214f:7000:9:46dc:4700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.quantcast.mgr.consensu.org/v31/cmp-3pc-check.html Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/cmp.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:214f:7000:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers :method GET :authority static.quantcast.mgr.consensu.org :scheme https :path /v31/cmp-3pc-check.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Response headers status 200 content-type text/html content-length 645 last-modified Tue, 17 Mar 2020 20:57:17 GMT x-amz-server-side-encryption AES256 accept-ranges bytes server AmazonS3 date Wed, 18 Mar 2020 06:45:25 GMT etag "55b98270d639ef0c34781d9f03cce91f" x-cache Hit from cloudfront via 1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront) x-amz-cf-pop FRA53-C1 x-amz-cf-id jr26pggBfuxeGJ5PaQT7mqxM6rn1kjSnFrLe8dct_yMGjR-MDeAd3A== age 194
GET H2	200	pubads_impl_2020030501.js Show response securepubads.g.doubleclick.net/gpt/	165 KB 60 KB	78ms 31ms	Script text/javascript	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/tag/js/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software sffe / Resource Hash 8ee04e0441c9e51785d17ac835a93cf4d30d90826f87350b42ba233496a26f55 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:29 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 05 Mar 2020 14:08:10 GMT server sffe vary Accept-Encoding content-type text/javascript status 200 cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 61481 x-xss-protection 0 expires Wed, 18 Mar 2020 06:47:29 GMT
GET H2	200	fetch_frame_2020030501.html ff.doubleclick.net/tag/js/ Frame FFA7	0 0	25ms 5ms	Document text/html	2a00:1450:4001:825::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ff.doubleclick.net/tag/js/fetch_frame_2020030501.html Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/tag/js/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority ff.doubleclick.net :scheme https :path /tag/js/fetch_frame_2020030501.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Response headers status 200 accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html timing-allow-origin * content-length 6527 date Wed, 18 Mar 2020 06:27:17 GMT expires Thu, 18 Mar 2021 06:27:17 GMT last-modified Thu, 05 Mar 2020 14:08:10 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, immutable, max-age=31536000 age 1212 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
GET H2	200	cmpui-popup.js Show response static.quantcast.mgr.consensu.org/v31/	230 KB 61 KB	8ms 7ms	Script text/javascript	2600:9000:214f:7000:9:46dc:4700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.quantcast.mgr.consensu.org/v31/cmpui-popup.js Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/cmp.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:214f:7000:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash fb182fea82c5fe2b1b8e719010edd3a5bf03d79ff97f6c4e7865a9ead22b4be0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:35:10 GMT content-encoding gzip last-modified Tue, 17 Mar 2020 20:57:16 GMT server AmazonS3 age 905 x-amz-server-side-encryption AES256 vary Accept-Encoding x-cache Hit from cloudfront content-type text/javascript;charset=UTF-8 status 200 x-amz-cf-pop FRA53-C1 x-amz-cf-id nJyNrbyfDruRY9dBCksmD5GLBzgviyE6uKyWkN2NeTvyK9XxP6RUHQ== via 1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
GET H2	200	vendorlist.json Show response vendorlist.consensu.org/	95 KB 18 KB	23ms 8ms	XHR application/json	2600:9000:20eb:cc00:1:af78:4c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vendorlist.consensu.org/vendorlist.json Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/cmp.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:20eb:cc00:1:af78:4c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 4b1802dd6a4184fdbda7a469f7f7258190ebe8690cbaa24cfd99a588dde61938 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 12 Mar 2020 16:10:21 GMT content-encoding gzip vary Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method age 484629 x-cache Hit from cloudfront status 200 access-control-allow-origin * last-modified Thu, 12 Mar 2020 16:00:30 GMT server AmazonS3 access-control-max-age 604800 access-control-allow-methods GET x-amz-version-id n.U3GT1Xns.dVTg6BaKcbkdHhBEeTGuK via 1.1 cb33a7a4640adbb55df3e0d143601559.cloudfront.net (CloudFront) cache-control max-age=604800 x-amz-cf-pop FRA2-C1 content-type application/json; charset=utf-8 x-amz-cf-id sqMso6ScCg9p9BQlStSC15RfUMsTsQf9NkKnDfKfcdPlsWG4NoBJlA==
GET H2	200	apstag.js Show response c.amazon-adsystem.com/aax2/	87 KB 25 KB	80ms 35ms	Script application/javascript	13.225.86.250 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/aax2/apstag.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-86-250.fra2.r.cloudfront.net Software Server / Resource Hash ac2a58f9d55c4642121cfb6f7e213cbc882bbdd75ef171ca8a07ed982ef693ce Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Tue, 17 Mar 2020 22:00:54 GMT content-encoding gzip server Server age 31594 etag 1dcfbf3986ee8b9c3abbc67eb808ab43 x-cache Hit from cloudfront content-type application/javascript status 200 cache-control public, max-age=86400 x-amz-cf-pop FRA2-C2 accept-ranges bytes x-amz-cf-id J4eoOe70sr8gVkbmPhcAaQrWRADIBMvO_3XiYpVWgLGz5Ycq_CzJlw== via 1.1 56fad5a50ef67bd961b9722ed0931839.cloudfront.net (CloudFront)
GET H/1.1	200 OK	config.js Show response confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/	91 KB 20 KB	70ms 22ms	Script text/javascript	151.101.13.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/config.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 3c026729e830171400892298ae8fb4d91de83d0c5f7520085d01b28f84d3833a Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Wed, 18 Mar 2020 06:47:29 GMT Content-Encoding gzip Age 845 X-Cache HIT Connection keep-alive Content-Length 19917 x-amz-id-2 A7DHJM3VF8/A4IGIxVkhY+Jy6AiV9VVS5uIaCJ9itTNItxaBgmDuukwNoiyr4j/d5hF4hkFjeak= X-Served-By cache-fra19179-FRA Last-Modified Wed, 18 Mar 2020 06:00:00 GMT Server AmazonS3 X-Timer S1584514050.983794,VS0,VE0 ETag "c81efd266de9e89803b899a4df382385" x-amz-request-id 62A02255FBE5C33E Via 1.1 varnish Cache-Control public, max-age=900, stale-while-revalidate=3600 Accept-Ranges bytes Content-Type text/javascript X-Cache-Hits 8
GET H/1.1	200 OK	v2 Show response d.pub.network/floors/	2 KB 2 KB	302ms 118ms	XHR application/json	35.188.71.214 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://d.pub.network/floors/v2?key=535desktop Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.71.214 , United States, ASN15169 (GOOGLE, US), Reverse DNS 214.71.188.35.bc.googleusercontent.com Software / Resource Hash bda3afd0410bdc8119a29792fe0f81da681ad6feb5137ba58ddff45d8e631dd3 Request headers Accept application/json, text/plain, */* Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Wed, 18 Mar 2020 06:47:30 GMT Access-Control-Allow-Credentials true Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Transfer-Encoding chunked Content-Type application/json
GET H2	404	CookieAccess Show response api.quantcast.mgr.consensu.org/	30 B 598 B	166ms 122ms	XHR application/json	143.204.202.27 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.quantcast.mgr.consensu.org/CookieAccess Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/cmp.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.202.27 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-202-27.fra53.r.cloudfront.net Software / Resource Hash 5a4061ff8312e2ad494bd984b7df966438232be64a3b284ab69f66c6705009a6 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 06:47:30 GMT content-encoding gzip x-amz-cf-pop FRA53-C1 x-amzn-requestid 24cbd65c-b198-4736-9602-47e108d3b9a6 x-cache Error from cloudfront status 404 x-amz-apigw-id JkuQVGaYIAMFmOg= content-length 50 access-control-allow-origin https://www.bleepingcomputer.com x-amzn-trace-id Root=1-5e71c402-48e676bcb922891bf74443dd;Sampled=0 vary Origin access-control-allow-methods GET, POST content-type application/json via 1.1 fc7091924e65025d5bfb92361ec3e660.cloudfront.net (CloudFront) cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true access-control-allow-headers Content-Type x-amz-cf-id DGA6BFDmyVYHmQk7XCc5wTi_BoL2CHK1zZvhDaXMm76VwTd7_Fbe6g==
GET H2	200	layers.ab5cd98fe1b9a38a4a9f.js Show response s7.addthis.com/static/	263 KB 76 KB	28ms 27ms	Script application/javascript	23.210.248.44 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://s7.addthis.com/static/layers.ab5cd98fe1b9a38a4a9f.js Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-248-44.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip last-modified Wed, 18 Sep 2019 14:16:17 GMT server nginx/1.15.8 etag W/"5d823c31-41b9f" vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=86313600 date Wed, 18 Mar 2020 06:47:29 GMT x-host s7.addthis.com timing-allow-origin * content-length 77528
GET H2	200	beacon.js Show response ad-delivery.net/	1 KB 987 B	71ms 21ms	Script application/x-javascript	13.224.194.45 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ad-delivery.net/beacon.js Requested by Host: freestar-io.videoplayerhub.com URL: https://freestar-io.videoplayerhub.com/gallery.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.194.45 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-194-45.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 7e94fbebf526effec4239c82e5435a412d81ffc4bc9bddf13f9aa1170f6d803e Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers x-amz-version-id null content-encoding gzip last-modified Tue, 31 Jan 2017 15:06:54 GMT server AmazonS3 age 2754 date Wed, 18 Mar 2020 06:01:38 GMT vary Accept-Encoding x-cache Hit from cloudfront content-type application/x-javascript status 200 cache-control max-age=3600 x-amz-cf-pop FRA2-C1 x-amz-cf-id pAECmpSOGMMtW7_QbAeh8LQLxVRHfuiY_eGgOD_0Z0oe-sRiiZYrBQ== via 1.1 430fc75cac3bdd04869a39405c45fba2.cloudfront.net (CloudFront)
GET H2	200	aps_csm.js Show response c.amazon-adsystem.com/bao-csm/aps-comm/	6 KB 3 KB	67ms 21ms	XHR application/javascript	13.225.86.250 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-86-250.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 05:04:27 GMT content-encoding gzip vary Origin age 6184 x-cache Hit from cloudfront status 200 access-control-allow-origin * last-modified Thu, 05 Mar 2020 08:28:46 GMT server AmazonS3 access-control-max-age 3000 access-control-allow-methods GET content-type application/javascript via 1.1 edfd22ec6695cdc9d7ac634220af1315.cloudfront.net (CloudFront) cache-control public, max-age=86400 x-amz-cf-pop FRA2-C2 x-amz-cf-id d2h63PeIzWMvS4lUXNZnPY9VE0ApVURj2ctPBilPoaD6D3xWxCIbaw==
GET H/1.1	200 OK	wrap.js Show response confiant-integrations.global.ssl.fastly.net/gpt/202003171135/	92 KB 32 KB	22ms 22ms	Script application/javascript	151.101.13.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/config.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 9417385feb17b55f8177d1892d3aeabbd7407cc3413769179811e4e0e1d6ee80 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Wed, 18 Mar 2020 06:47:30 GMT Content-Encoding gzip Age 350 X-Cache HIT Connection keep-alive Content-Length 32010 x-amz-id-2 o7RGUnWnMcXEcoXIiGC59Y1YVSZmHls/uLvJ+2OrA5K9MTgkRCOW1DW+h84bKFBnXARcsl2royA= X-Served-By cache-fra19179-FRA Last-Modified Tue, 17 Mar 2020 16:09:31 GMT Server AmazonS3 X-Timer S1584514050.028227,VS0,VE0 ETag "a878d9fb9018c33e6c70ea1b30832459" x-amz-request-id 78823CC7720F9E94 Via 1.1 varnish Cache-Control public, max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 X-Cache-Hits 175
GET H/1.1	200 OK	wrap.js Show response confiant-integrations.global.ssl.fastly.net/prebid/202003171135/	32 KB 13 KB	54ms 24ms	Script application/javascript	151.101.13.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/prebid/202003171135/wrap.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/config.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 2a7fc4e3d27f714b2aeafc4d13994249b3305a689749e3aa389ce25c8c58f6a6 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Wed, 18 Mar 2020 06:47:30 GMT Content-Encoding gzip Age 7 X-Cache HIT Connection keep-alive Content-Length 12207 x-amz-id-2 yWFTpRCQ+amSzgHJITgYc3uye8V1cBgq4bBPaywttcPIbu8k4gkYAuElTlqVUK49v5hj661yF1s= X-Served-By cache-fra19179-FRA Last-Modified Tue, 17 Mar 2020 16:09:32 GMT Server AmazonS3 X-Timer S1584514050.058579,VS0,VE0 ETag "6886dd8a2947cf22fa7f2542c3ed17e2" x-amz-request-id FEC7A3EB8A27B119 Via 1.1 varnish Cache-Control public, max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 X-Cache-Hits 26
GET H2	200	bid Show response c.amazon-adsystem.com/e/dtb/	23 B 377 B	72ms 72ms	XHR text/javascript	13.225.86.250 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&pid=qtrtlen5d6bcy&cb=0&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_1%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%22%7D%2C%7B%22sd%22%3A%224%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_320x50_InContent_1%22%7D%2C%7B%22sd%22%3A%225%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-86-250.fra2.r.cloudfront.net Software Server / Resource Hash 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 06:47:30 GMT via 1.1 56fad5a50ef67bd961b9722ed0931839.cloudfront.net (CloudFront) server Server x-amz-cf-pop FRA2-C2 status 200 vary User-Agent x-cache Miss from cloudfront content-type text/javascript;charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true timing-allow-origin * content-length 23 x-amz-cf-id 0qjZs8uFpl9gvZYIFoUZQQz6Ge4B7bPqZITe4UTCrnFD75Nd4lblsw==
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 87562d3773ffab3d0716a70faa73c38b322fde3b8f265c3d646a3cea976ef67e Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	ads googleads.g.doubleclick.net/pagead/ Frame C9E8	0 0	56ms 56ms	Document text/html	2a00:1450:4001:81c::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&adk=1812271804&adf=3025194257&lmt=1584287085&plat=1%3A32776%2C2%3A16809992%2C8%3A134250504%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1584514049511&bpp=4&bdt=302&fdt=283&idt=283&shv=r20200312&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=834x500&nras=1&correlator=596583608777&frm=20&pv=1&ga_vid=2079321426.1584514050&ga_sid=1584514050&ga_hid=511514683&ga_fc=0&iag=0&icsg=565149020725248&dssz=55&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=26835106&oid=3&pvsid=1724307350463099&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=1&uci=a!1&fsb=1&dtd=792 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200312/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority googleads.g.doubleclick.net :scheme https :path /pagead/ads?client=ca-pub-0920899300397823&output=html&adk=1812271804&adf=3025194257&lmt=1584287085&plat=1%3A32776%2C2%3A16809992%2C8%3A134250504%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1584514049511&bpp=4&bdt=302&fdt=283&idt=283&shv=r20200312&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=834x500&nras=1&correlator=596583608777&frm=20&pv=1&ga_vid=2079321426.1584514050&ga_sid=1584514050&ga_hid=511514683&ga_fc=0&iag=0&icsg=565149020725248&dssz=55&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=26835106&oid=3&pvsid=1724307350463099&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=1&uci=a!1&fsb=1&dtd=792 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ accept-encoding gzip, deflate, br accept-language en-US cookie test_cookie=CheckForPermission Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Response headers status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding br date Wed, 18 Mar 2020 06:47:30 GMT server cafe content-length 34 x-xss-protection 0 set-cookie IDE=AHWqTUkTCwSruXMmbSEwJFESV6shbArb_IYU4Zy-9zfNel7SIdS-nBRjDRO7wOBl; expires=Mon, 12-Apr-2021 06:47:30 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 expires Wed, 18 Mar 2020 06:47:30 GMT cache-control private
GET H2	200	/ Show response audit.quantcast.mgr.consensu.org/	80 B 487 B	66ms 22ms	XHR text/html	143.204.202.117 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://audit.quantcast.mgr.consensu.org/?log=;1584514050356;BleepingComputer.com;https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F;;;;;p,off,false,,1,en,31,193,true,false,false;displayConsentUi:mandatory,;GDPR-q2j5uadffoy11n2h9gp5 Requested by Host: static.quantcast.mgr.consensu.org URL: https://static.quantcast.mgr.consensu.org/v31/cmpui-popup.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.202.117 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-202-117.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash 2d0f6b590917e7d27ddeb026b280d62dde9d03bb92f47f56342fc5f68f0c24eb Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 17 Mar 2020 07:07:39 GMT via 1.1 960a66a5b9d832814160983d391e997c.cloudfront.net (CloudFront) vary Origin age 85192 x-cache Hit from cloudfront status 200 content-length 80 last-modified Mon, 11 Jun 2018 22:07:34 GMT server AmazonS3 etag "0614149d8033903db5de46d6c184bbfd" access-control-max-age 3000 access-control-allow-methods GET content-type text/html access-control-allow-origin * x-amz-cf-pop FRA53-C1 accept-ranges bytes x-amz-cf-id 76LaswBjOHiku7-iETr2G6yi73b9VoGriEAkTHP7uyyZRGxIn_7LjA==
GET H/1.1	200 OK	jquery.color-2.1.2.min.js Show response cluster-na.cdnjquery.com/color/	91 B 355 B	431ms 105ms	Script text/javascript	52.2.175.122 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://cluster-na.cdnjquery.com/color/jquery.color-2.1.2.min.js?integrity=btjsonpcallback1584514050410&checksum=%7B%22cbc%22%3A0%2C%22st%22%3A2%2C%22au%22%3A%5B%5D%2C%22hau%22%3A%5B%5D%2C%22ref%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F%22%2C%22aa%22%3A3%2C%22pgid%22%3A%225656ee2d-68e4-11ea-945f-7c4f63a14a97%22%2C%22v%22%3A1%2C%22format%22%3A%22jsonp%22%7D&o=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&csVersion=1.21.46&clearThroughOptions=undefined Requested by Host: freestar-io.videoplayerhub.com URL: https://freestar-io.videoplayerhub.com/gallery.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.2.175.122 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-2-175-122.compute-1.amazonaws.com Software nginx/1.12.1 / Resource Hash b1d9b7c87d5ce5bf98d51b63e117b8df6456725131d7131b2a0f16dc43ae1333 Security Headers Name Value X-Frame-Options DENY Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Wed, 18 Mar 2020 06:47:30 GMT Content-Encoding gzip Server nginx/1.12.1 ETag W/"5b-SWDtpub5CzkWpUisS2hSi5CZbzY" X-Frame-Options DENY Content-Type text/javascript; charset=utf-8 Charset utf8 Connection keep-alive Content-Length 83
GET H2	200	px.gif ad-delivery.net/	43 B 385 B	21ms 21ms	Image image/gif	13.224.194.45 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ad-delivery.net/px.gif?ch=1&e=0.3328854477754535 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.194.45 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-194-45.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers x-amz-version-id null via 1.1 430fc75cac3bdd04869a39405c45fba2.cloudfront.net (CloudFront) last-modified Thu, 27 Jul 2017 18:59:05 GMT server AmazonS3 age 57545 etag "ad4b0f606e0f8465bc4c4c170b37e1a3" x-cache Hit from cloudfront content-type image/gif status 200 date Tue, 17 Mar 2020 14:48:26 GMT x-amz-cf-pop FRA2-C1 accept-ranges bytes content-length 43 x-amz-cf-id BghF63QNKaMP4jgpSjI3kVli9ROrEA9PlnjNzIt1m4KKE7_ONLbM1Q==
GET H2	200	48.008759e9efe1c1b693dd.js Show response s7.addthis.com/static/	281 B 486 B	34ms 34ms	Script application/javascript	23.210.248.44 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://s7.addthis.com/static/48.008759e9efe1c1b693dd.js Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-248-44.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash f8a52990bbe6892abb730d241570fbfbd2ff2fc707fdd3004c7dba6e843bbae3 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip last-modified Wed, 18 Sep 2019 14:16:17 GMT server nginx/1.15.8 etag W/"5d823c31-119" vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=86313600 date Wed, 18 Mar 2020 06:47:30 GMT x-host s7.addthis.com timing-allow-origin * content-length 246
GET H2	200	/ Show response graph.facebook.com/	313 B 425 B	62ms 50ms	Script text/javascript	2a03:2880:f02d:e:face:b00c:0:2 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://graph.facebook.com/?id=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&fields=og_object%7Bengagement%7D&callback=_ate.cbs.rcb_h2080 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 458c1c67fcb9127b64c5f90111b3a35e2b91b4bacef0ae2a3ac0bd922ec24377 Security Headers Name Value Strict-Transport-Security max-age=15552000; preload Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15552000; preload content-encoding br x-app-usage {"call_count":0,"total_cputime":0,"total_time":0} status 200 date Wed, 18 Mar 2020 06:47:30 GMT, Wed, 18 Mar 2020 06:47:30 GMT x-fb-rev 1001855014 alt-svc h3-27=":443"; ma=3600 content-length 222 pragma no-cache x-fb-debug zR/IozxVkELQthM791/JmTU6eA/fIP+FbBE1RMucjbD1qZ3MCFhB3mfdTiaMXVo3vUm3yOmg2J64Ic3d6ADuiw== x-fb-trace-id DB3ZQmIK7QB etag "66202908a6d186cc6c961b899abc9ba8e75d7918" vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * x-fb-request-id ACJjdtZ-7AbL2qU4PvmVxgt cache-control private, no-cache, no-store, must-revalidate facebook-api-version v2.12 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	info.json Show response www.reddit.com/api/	126 B 668 B	7868ms 1254ms	Script application/javascript	151.101.113.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.reddit.com/api/info.json?url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&jsonp=_ate.cbs.rcb_dy2b0 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.113.140 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 9e67f7d76a74f4a1ad68f2b5a2e039c158dfd5da27780b953a0f88e084286d5a Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:38 GMT via 1.1 varnish x-content-type-options nosniff x-cache MISS status 200 x-cache-hits 0 strict-transport-security max-age=15552000; includeSubDomains; preload content-length 126 x-xss-protection 1; mode=block x-served-by cache-hhn4070-HHN x-moose majestic server snooserv x-timer S1584514059.520679,VS0,VE133 x-frame-options SAMEORIGIN content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-expose-headers X-Moose cache-control private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate x-ua-compatible IE=edge accept-ranges bytes expires -1
GET H2	200	/ Show response graph.facebook.com/	153 B 607 B	54ms 43ms	Script text/javascript	2a03:2880:f02d:e:face:b00c:0:2 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://graph.facebook.com/?id=http%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&fields=og_object%7Bengagement%7D&callback=_ate.cbs.rcb_9fnt0 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 3d474a2fff4d33af2de7eec0530b75d9c22557b058d6630f70fd3b791925a7b9 Security Headers Name Value Strict-Transport-Security max-age=15552000; preload Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15552000; preload x-app-usage {"call_count":0,"total_cputime":0,"total_time":0} status 200 date Wed, 18 Mar 2020 06:47:30 GMT, Wed, 18 Mar 2020 06:47:30 GMT x-fb-rev 1001855014 alt-svc h3-27=":443"; ma=3600 content-length 153 pragma no-cache x-fb-debug Ly/snt6FRA9Sn3to2+5rq/5mcAi4OG8C7R8muH9Bm2VyG4AHgzUsJKo4UEvtQD1LQA0E3sdIHXktt5l3gYy3Ew== x-fb-trace-id AdxW1YDBnfC etag "974a7f0f8cf0af2e8d7bbb52e4b728ba5ed8fc1c" content-type text/javascript; charset=UTF-8 access-control-allow-origin * x-fb-request-id A61wiHSfRRH_FJnM2slKLfa cache-control private, no-cache, no-store, must-revalidate facebook-api-version v2.12 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	info.json Show response www.reddit.com/api/	126 B 259 B	7874ms 1261ms	Script application/javascript	151.101.113.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.reddit.com/api/info.json?url=http%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&jsonp=_ate.cbs.rcb_76dc0 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.113.140 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash ec8a37f4a50bdf2185c3b3c808bc6e2bc478b370fd9fd668c3033b3258d1bb80 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:38 GMT via 1.1 varnish x-content-type-options nosniff x-cache MISS status 200 x-cache-hits 0 strict-transport-security max-age=15552000; includeSubDomains; preload content-length 126 x-xss-protection 1; mode=block x-served-by cache-hhn4070-HHN x-moose majestic server snooserv x-timer S1584514059.546239,VS0,VE116 x-frame-options SAMEORIGIN content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-expose-headers X-Moose cache-control private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate x-ua-compatible IE=edge accept-ranges bytes expires -1
POST H2	204	v1 Show response dmx.districtm.io/b/	0 39 B	78ms 38ms	XHR text/plain	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dmx.districtm.io/b/v1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers date Wed, 18 Mar 2020 06:47:31 GMT cf-cache-status DYNAMIC server cloudflare status 204 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary origin, Accept-Encoding access-control-allow-methods OPTIONS, POST access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 575d00b48c027257-AMS access-control-allow-headers origin, content-type
POST H2	204	v1 Show response dmx.districtm.io/b/	0 447 B	76ms 36ms	XHR text/plain	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dmx.districtm.io/b/v1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers date Wed, 18 Mar 2020 06:47:31 GMT cf-cache-status DYNAMIC server cloudflare status 204 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary origin, Accept-Encoding access-control-allow-methods OPTIONS, POST access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 575d00b48c037257-AMS access-control-allow-headers origin, content-type
GET H2	200	arj Show response freestar-d.openx.net/w/1.0/	175 B 577 B	329ms 289ms	XHR application/json	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=31b69f95-8a03-443a-ae51-dfbe0e7c7cd5%2C65426a2e-d059-46d3-bbe2-0cd74b7ae57e%2C2a2d206e-a818-49fc-bc11-b40abd4a9ba0%2Cb2c12a32-2b44-45ff-ac8e-1d36f825398b%2C96220cba-7663-4e11-998c-e5ff905b3692%2Cc423870c-4026-4c66-8fd3-38c7469446e1&nocache=1584514051241&pubcid=2b385668-42e0-42b5-bba1-c8727229a9dd&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=728x90%2C970x90%2C970x250%7C728x90%2C970x90%2C970x250%7C300x250%2C300x600%7C300x250%2C300x600%7C728x90%7C300x250%2C300x600&divIds=bleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Cbleepingcomputer_300x250_300x600_160x600_Right_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_2%2Cbleepingcomputer_728x90_320x50_InContent_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_3&auid=540959250%2C540959250%2C540959250%2C540959250%2C540959250%2C540959250& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.179.0 / Resource Hash cb369a6592c7872db5430a4821d7cde28373ea25fb0b489bc3bb5c8276050dcc Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT content-encoding gzip server OXGW/16.179.0 status 200 vary Accept, Accept-Encoding p3p CP="CUR ADM OUR NOR STA NID" access-control-allow-origin https://www.bleepingcomputer.com cache-control private, max-age=0, no-cache access-control-allow-credentials true content-type application/json alt-svc clear content-length 165 via 1.1 google expires Mon, 26 Jul 1997 05:00:00 GMT
GET H/1.1	200 OK	cygnus Show response as-sec.casalemedia.com/	25 B 997 B	209ms 156ms	XHR application/json	23.210.249.164 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%221973e27d8d279cc%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2220a0fa736a20684%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2221070483a839c9d%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2222f4e22ca6391f3%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2223eb0ac831d83de%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2224af047561d93c7%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%222559228e3a58228%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%222654d9c945fe923%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22279aedc52e2d097%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22280de50b87a2c1a%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22295a5a4b9aa59d6%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2230b2f4b9ca97a43%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22314d30874b3c02c%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%223294d21ed62cbf4%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-249-164.deploy.static.akamaitechnologies.com Software Apache / Resource Hash dd4cc72ea7feb5bb5c839b656fd88f11373470fc8634de684d0a888073c4a60e Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 06:47:31 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json Content-Length 45 Expires Wed, 18 Mar 2020 06:47:31 GMT
POST H2	200	auction Show response tlx.3lift.com/header/	19 B 605 B	91ms 47ms	XHR application/json	52.28.30.97 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&tmax=1200 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.28.30.97 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-28-30-97.eu-central-1.compute.amazonaws.com Software / Resource Hash 0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT x-auction-status 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12 status 200 content-type application/json; charset=utf-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true content-length 19 x-xss-protection 0 expires Thu, 15 Oct 1992 20:10:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	19 B 719 B	63ms 21ms	XHR application/json	185.33.223.209 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.209 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 314.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 06:47:33 GMT X-Proxy-Origin 82.102.19.132; 82.102.19.132; 314.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.59:80 AN-X-Request-Uuid 9b4fb286-34f8-40e8-983b-0c1469a8625d Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 19 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	728 B 1 KB	76ms 34ms	XHR application/json	185.33.223.209 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.209 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 314.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash c8c832305931b6b21013425479bb64c6f15d4eccc73c355a82ac5fee0ae1e999 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Wed, 18 Mar 2020 06:47:33 GMT Content-Encoding gzip Transfer-Encoding chunked P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Connection keep-alive X-Proxy-Origin 82.102.19.132; 82.102.19.132; 314.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.109:80 X-XSS-Protection 0 Pragma no-cache AN-X-Request-Uuid faf4ebd2-2ac8-4a25-bf15-4a721089711b Server nginx/1.13.4 Vary Accept-Encoding Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=109b15bc6c9d1766;misc=1584514051245 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=109b15bc6c9d1766;misc=1584514051245; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=109b15bc6c9d1766;misc=1584514051245	0 -1 B	659ms 372ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=109b15bc6c9d1766;misc=1584514051245 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=109b15bc6c9d1766;misc=1584514051245 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=109b15bc6c9d1766;misc=1584514051245 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11024408b762e707;misc=1584514051245 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=11024408b762e707;misc=1584514051245; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11024408b762e707;misc=1584514051245	0 -1 B	648ms 360ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11024408b762e707;misc=1584514051245 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11024408b762e707;misc=1584514051245 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11024408b762e707;misc=1584514051245 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11154965b831ab97;misc=1584514051245 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=11154965b831ab97;misc=1584514051245; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11154965b831ab97;misc=1584514051245	0 -1 B	648ms 361ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11154965b831ab97;misc=1584514051245 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11154965b831ab97;misc=1584514051245 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11154965b831ab97;misc=1584514051245 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=112a12525a3e79a5;misc=1584514051245 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=112a12525a3e79a5;misc=1584514051245; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=112a12525a3e79a5;misc=1584514051245	0 -1 B	394ms 107ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=112a12525a3e79a5;misc=1584514051245 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=112a12525a3e79a5;misc=1584514051245 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=112a12525a3e79a5;misc=1584514051245 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11329ac45b83e82d;misc=1584514051246 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=11329ac45b83e82d;misc=1584514051246; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11329ac45b83e82d;misc=1584514051246	0 -1 B	395ms 109ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11329ac45b83e82d;misc=1584514051246 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11329ac45b83e82d;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11329ac45b83e82d;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1147d5bb5eba5237;misc=1584514051246 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1147d5bb5eba5237;misc=1584514051246; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1147d5bb5eba5237;misc=1584514051246	0 -1 B	671ms 384ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1147d5bb5eba5237;misc=1584514051246 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1147d5bb5eba5237;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1147d5bb5eba5237;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=1159e11b195ccd74;misc=1584514051246 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1159e11b195ccd74;misc=1584514051246; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=1159e11b195ccd74;misc=1584514051246	0 -1 B	387ms 101ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=1159e11b195ccd74;misc=1584514051246 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=1159e11b195ccd74;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=1159e11b195ccd74;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11690a506e7dee63;misc=1584514051246 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=11690a506e7dee63;misc=1584514051246; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11690a506e7dee63;misc=1584514051246	0 -1 B	664ms 377ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11690a506e7dee63;misc=1584514051246 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11690a506e7dee63;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11690a506e7dee63;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=117b6648b71a076f;misc=1584514051246 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=117b6648b71a076f;misc=1584514051246; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=117b6648b71a076f;misc=1584514051246	0 -1 B	658ms 372ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=117b6648b71a076f;misc=1584514051246 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=117b6648b71a076f;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=117b6648b71a076f;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=118aa317119e1df8;misc=1584514051246 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=118aa317119e1df8;misc=1584514051246; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=118aa317119e1df8;misc=1584514051246	0 -1 B	388ms 102ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=118aa317119e1df8;misc=1584514051246 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=118aa317119e1df8;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=118aa317119e1df8;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11960ad14f9f1c12;misc=1584514051246 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=11960ad14f9f1c12;misc=1584514051246; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11960ad14f9f1c12;misc=1584514051246	0 -1 B	662ms 376ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11960ad14f9f1c12;misc=1584514051246 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11960ad14f9f1c12;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11960ad14f9f1c12;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=120b0f900f4ca008;misc=1584514051246 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=120b0f900f4ca008;misc=1584514051246; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=120b0f900f4ca008;misc=1584514051246	0 -1 B	666ms 380ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=120b0f900f4ca008;misc=1584514051246 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=120b0f900f4ca008;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=120b0f900f4ca008;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=121d46e3e087484;misc=1584514051246 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=121d46e3e087484;misc=1584514051246; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=121d46e3e087484;misc=1584514051246	0 -1 B	650ms 365ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=121d46e3e087484;misc=1584514051246 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=121d46e3e087484;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=121d46e3e087484;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	66ms 22ms	XHR text/plain	3.124.246.214 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=84b8cf8af38c456&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.124.246.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-124-246-214.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 06:47:31 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	104ms 59ms	XHR text/plain	3.124.246.214 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=bDraMWgeoLM4KHJBzFQ8heMv&bidId=8525153c45a2704&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.124.246.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-124-246-214.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 06:47:31 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	66ms 22ms	XHR text/plain	3.124.246.214 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=867b0191cdb6d33&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.124.246.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-124-246-214.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 06:47:31 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	67ms 22ms	XHR text/plain	3.124.246.214 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=bDraMWgeoLM4KHJBzFQ8heMv&bidId=87417fc63ed6894&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.124.246.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-124-246-214.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 06:47:31 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	67ms 23ms	XHR text/plain	3.124.246.214 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=uo4nuhxJikFrr3o47oeeZPL5&bidId=882a37a82093c5f&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.124.246.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-124-246-214.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 06:47:31 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	66ms 22ms	XHR text/plain	3.124.246.214 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=6f2XVeWT9HhHNo9TDFzKK7JK&bidId=8902f924d362fec&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.124.246.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-124-246-214.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 06:47:31 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	66ms 23ms	XHR text/plain	3.124.246.214 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=uo4nuhxJikFrr3o47oeeZPL5&bidId=9060194491afb8&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.124.246.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-124-246-214.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 06:47:31 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	787ms 743ms	XHR text/plain	3.124.246.214 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=6f2XVeWT9HhHNo9TDFzKK7JK&bidId=9151ee90661d829&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.124.246.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-124-246-214.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 06:47:32 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	67ms 24ms	XHR text/plain	3.124.246.214 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=929adac5565a129&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.124.246.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-124-246-214.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 06:47:31 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	79ms 36ms	XHR text/plain	3.124.246.214 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=6f2XVeWT9HhHNo9TDFzKK7JK&bidId=9455869716207c&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.124.246.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-124-246-214.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 06:47:31 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	263 B 2 KB	186ms 110ms	XHR application/json	69.173.144.142 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=31b69f95-8a03-443a-ae51-dfbe0e7c7cd5&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.6317087137734136 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.142 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash 4f55220113e85759fd7a74babe7af621a0ed666e0110cbee245ae48e8c2ef8e3 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 06:47:31 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=322 Content-Length 263 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	263 B 2 KB	197ms 112ms	XHR application/json	69.173.144.142 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=65426a2e-d059-46d3-bbe2-0cd74b7ae57e&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.1034650130405026 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.142 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash 75a65d1483072cbab951140b2ec2ff320e65da4ead817784b68045682b4b00a4 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 06:47:31 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=143 Content-Length 263 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	261 B 2 KB	202ms 112ms	XHR application/json	69.173.144.142 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=2a2d206e-a818-49fc-bc11-b40abd4a9ba0&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.5111010340567557 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.142 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash 297e12525e58c207950412c9fec77d0372f65ed8144394dc95229250112622f9 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 06:47:31 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=435 Content-Length 261 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	261 B 2 KB	290ms 102ms	XHR application/json	69.173.144.142 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=b2c12a32-2b44-45ff-ac8e-1d36f825398b&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.07798368268023936 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.142 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash 4ea818ab53a84b6bd8d16d38b5d3078e81783c20e0da159d13545d47585515c4 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 06:47:31 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=165 Content-Length 261 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	240 B 2 KB	311ms 109ms	XHR application/json	69.173.144.142 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=96220cba-7663-4e11-998c-e5ff905b3692&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.14706226648683152 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.142 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash c9a2ef85423bd5105b2c3b5e0fca91cbe9b79d1518b52d7135cc60e09538f87a Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 06:47:31 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=311 Content-Length 240 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	261 B 2 KB	312ms 109ms	XHR application/json	69.173.144.142 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=c423870c-4026-4c66-8fd3-38c7469446e1&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.15659142950080263 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.142 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash 979da0eaf58bc1f92b107934980e56af02c6ba013071d1a6e48173cd65d95607 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 06:47:31 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=381 Content-Length 261 Expires Wed, 17 Sep 1975 21:32:10 GMT
POST H/1.1	404 Not Found	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/	678 B 878 B	49ms 13ms	XHR text/plain	2a02:fa8:8806:12::1430 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:fa8:8806:12::1430 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash d3a970101d5c1c13fe97539903a8285d524c87295f551421ab9e40d9c1324e4a Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Wed, 18 Mar 2020 06:47:31 GMT Cache-Control max-age=0, no-store Server nginx Connection keep-alive Content-Length 678 Content-Type text/plain; charset=UTF-8
GET H2	200	pubads_impl_rendering_2020030501.js Show response securepubads.g.doubleclick.net/gpt/	69 KB 25 KB	32ms 31ms	Script text/javascript	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software sffe / Resource Hash ffdc18ac8f47bcd50dd9c33532c334e7073717a62b367d95b9cb1561048547dc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:31 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 05 Mar 2020 14:08:10 GMT server sffe vary Accept-Encoding content-type text/javascript status 200 cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 25689 x-xss-protection 0 expires Wed, 18 Mar 2020 06:47:31 GMT
GET H2	200	container.html tpc.googlesyndication.com/safeframe/1-0-37/html/	0 0	6ms 6ms	Other text/html	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest empty Response headers
GET H2	302	ADTECH;apid=1A5798258e-68e4-11ea-afc3-12ce909f321e;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1159e11b195ccd74;misc=1584514051246 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=1159e11b195ccd74;misc=1584514051246 https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;apid=1A5798258e-68e4-11ea-afc3-12ce909f321e;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1159e11b195ccd74;misc=1...	0 -1 B	348ms 348ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;apid=1A5798258e-68e4-11ea-afc3-12ce909f321e;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1159e11b195ccd74;misc=1584514051246 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;apid=1A5798258e-68e4-11ea-afc3-12ce909f321e;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1159e11b195ccd74;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;apid=1A5798258e-68e4-11ea-afc3-12ce909f321e;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1159e11b195ccd74;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;apid=1A579b1da2-68e4-11ea-9c72-121ea8d7377c;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=118aa317119e1df8;misc=1584514051246 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=118aa317119e1df8;misc=1584514051246 https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;apid=1A579b1da2-68e4-11ea-9c72-121ea8d7377c;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=118aa317119e1df8;misc=1...	0 -1 B	373ms 373ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;apid=1A579b1da2-68e4-11ea-9c72-121ea8d7377c;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=118aa317119e1df8;misc=1584514051246 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;apid=1A579b1da2-68e4-11ea-9c72-121ea8d7377c;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=118aa317119e1df8;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;apid=1A579b1da2-68e4-11ea-9c72-121ea8d7377c;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=118aa317119e1df8;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;apid=1A5772b2c2-68e4-11ea-9917-120f1417a350;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=112a12525a3e79a5;misc=1584514051245 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=112a12525a3e79a5;misc=1584514051245 https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A5772b2c2-68e4-11ea-9917-120f1417a350;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=112a12525a3e79a5;misc=1...	0 -1 B	105ms 105ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A5772b2c2-68e4-11ea-9917-120f1417a350;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=112a12525a3e79a5;misc=1584514051245 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A5772b2c2-68e4-11ea-9917-120f1417a350;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=112a12525a3e79a5;misc=1584514051245 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A5772b2c2-68e4-11ea-9917-120f1417a350;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=112a12525a3e79a5;misc=1584514051245 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;apid=1A57995b84-68e4-11ea-a7cc-12795fd23bd8;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11329ac45b83e82d;misc=1584514051246 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11329ac45b83e82d;misc=1584514051246 https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A57995b84-68e4-11ea-a7cc-12795fd23bd8;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11329ac45b83e82d;misc=1...	0 -1 B	354ms 353ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A57995b84-68e4-11ea-a7cc-12795fd23bd8;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11329ac45b83e82d;misc=1584514051246 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A57995b84-68e4-11ea-a7cc-12795fd23bd8;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11329ac45b83e82d;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A57995b84-68e4-11ea-a7cc-12795fd23bd8;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11329ac45b83e82d;misc=1584514051246 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	193 KB 22 KB	515ms 514ms	XHR text/plain	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1724307350463099&correlator=3999338060914392&output=ldjh&impl=fifs&adsid=NT&eid=21065710%2C21065443&vrg=2020030501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200318&iu_parts=15184186%2Cbleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Cbleepingcomputer_300x250_300x600_160x600_Right_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_2%2Cbleepingcomputer_728x90_320x50_InContent_1%2Cbleepingcomputer_1x1%2Cbleepingcomputer_300x250_300x600_160x600_Right_3&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6%2C%2F0%2F7&prev_iu_szs=728x90%7C970x90%7C970x250%2C728x90%7C970x90%7C970x250%2C300x250%7C300x600%2C300x250%7C300x600%2C728x90%2C1x1%2C300x250%7C300x600&prev_scp=amznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7C%7Camznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie_enabled=1&bc=31&abxe=1&lmt=1584287085&dt=1584514051638&dlt=1584514049209&idt=705&frm=20&biw=1600&bih=1200&oid=3&adxs=436%2C436%2C1082%2C1082%2C268%2C800%2C1082&adys=146%2C5475%2C327%2C1136%2C4044%2C5981%2C1661&adks=960084856%2C976516616%2C771041174%2C2389526111%2C4047242158%2C2635258439%2C523518761&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7&ifi=2&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&dssz=60&icsg=2260596082876416&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1170x120%7C1200x90%7C306x250%7C306x250%7C834x90%7C1600x5981%7C306x250&msz=1170x90%7C1170x90%7C306x250%7C306x250%7C834x90%7C1600x1%7C306x250&ga_vid=2079321426.1584514050&ga_sid=1584514050&ga_hid=511514683&fws=4%2C4%2C4%2C4%2C4%2C4%2C516&ohw=1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash 431a18861ac75b69bed94e252e2082b12255986c42d23f7e7290e5b598ee0652 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 06:47:32 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2,-2,-2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 22320 x-xss-protection 0 google-lineitem-id -1,-2,-2,-1,-1,4893662829,-1 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -1,-2,-2,-1,-1,138254592126,-1 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-expose-headers x-google-amp-ad-validated-version cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ADTECH;apid=1A5772b2c2-68e4-11ea-9917-120f1417a350;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=112a12525a3e79a5;misc=1584514051245 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/	606 B 737 B	426ms 425ms	XHR application/json	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A5772b2c2-68e4-11ea-9917-120f1417a350;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=112a12525a3e79a5;misc=1584514051245 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 047a90db17c72e792acf12c18e518cbaab323553332d75f2980d301a9a270ee8 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 606 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11024408b762e707;misc=1584514051245 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/	605 B 736 B	157ms 157ms	XHR application/json	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11024408b762e707;misc=1584514051245 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 276d07e804fa3fa6a578c4ef09a893bb8edd395a5492a898b0662042e538b018 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 605 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11154965b831ab97;misc=1584514051245 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/	606 B 767 B	154ms 153ms	XHR application/json	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11154965b831ab97;misc=1584514051245 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash f7d90abef3a6c7ec636523bd45e7676e11f5b72bf3a5af242dee65e8adfa2105 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true accept-ranges bytes content-type application/json content-length 606 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=121d46e3e087484;misc=1584514051246 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/	606 B 737 B	156ms 155ms	XHR application/json	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=121d46e3e087484;misc=1584514051246 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 61e54ea0df230695bd6c96e882fdccf414083221375ee64f89d3a31b7ef10dba Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:31 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 606 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=109b15bc6c9d1766;misc=1584514051245 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/	606 B 737 B	161ms 161ms	XHR application/json	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=109b15bc6c9d1766;misc=1584514051245 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 38d9f926e7d22f25c89182f06005bcb91bd5937ece33b4d29b2b19b5d8c0daee Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 606 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=117b6648b71a076f;misc=1584514051246 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/	606 B 737 B	163ms 162ms	XHR application/json	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584514050;v=2;cmd=bid;cors=yes;alias=117b6648b71a076f;misc=1584514051246 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 84ee445a6e9a6794f432a524066c3d15c248280db077bd58bcf7cad71d7e8151 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 606 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11960ad14f9f1c12;misc=1584514051246 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/	606 B 760 B	156ms 156ms	XHR application/json	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11960ad14f9f1c12;misc=1584514051246 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 6157a9e943d7a99dde9791712be123655e3481a99a35f3b383660af7874831cd Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 606 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11690a506e7dee63;misc=1584514051246 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/	606 B 737 B	169ms 169ms	XHR application/json	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11690a506e7dee63;misc=1584514051246 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash c121491df7ea1ec7c9dc3c7e09d823848e2468c5848ae2875de64d734a8ae26e Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 606 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=120b0f900f4ca008;misc=1584514051246 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/	606 B 737 B	158ms 158ms	XHR application/json	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=120b0f900f4ca008;misc=1584514051246 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 0ae207b3700570cd71c336b97ada44974d419aad02ab64cbb9abf1b30f112a77 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 606 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1147d5bb5eba5237;misc=1584514051246 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/	605 B 736 B	153ms 153ms	XHR application/json	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1147d5bb5eba5237;misc=1584514051246 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash ef370c6f7b9f8b3d2714b4c8512020b081ce82747231839a4d5d29044c308dbf Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 605 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;apid=1A5798258e-68e4-11ea-afc3-12ce909f321e;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1159e11b195ccd74;misc=1584514051246 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/	605 B 736 B	145ms 145ms	XHR application/json	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;apid=1A5798258e-68e4-11ea-afc3-12ce909f321e;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1159e11b195ccd74;misc=1584514051246 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 643c413034ad3e63f2e08926715a3861590056275f846905c279b9f6360973e3 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 605 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;apid=1A57995b84-68e4-11ea-a7cc-12795fd23bd8;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11329ac45b83e82d;misc=1584514051246 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/	606 B 737 B	162ms 161ms	XHR application/json	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A57995b84-68e4-11ea-a7cc-12795fd23bd8;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=11329ac45b83e82d;misc=1584514051246 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 8aa77d8825e908e3c918e1c280c5c408499cfdfb81c4a4454702b3c36ced629f Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 606 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;apid=1A579b1da2-68e4-11ea-9c72-121ea8d7377c;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=118aa317119e1df8;misc=1584514051246 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/	605 B 736 B	173ms 170ms	XHR application/json	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;apid=1A579b1da2-68e4-11ea-9c72-121ea8d7377c;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=118aa317119e1df8;misc=1584514051246 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash f0618d488fd6608f6f6c1afc4c37e418c2d84607f0069e844630878848b66ad9 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 605 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003031842100/ Frame 6BC6	200 KB 55 KB	37ms 14ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 41016 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55795 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a96964b23e387b31" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:56 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003031842100/ Frame 6BC6	200 KB 55 KB	28ms 5ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 41016 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55795 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a96964b23e387b31" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:56 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 6BC6	16 KB 6 KB	43ms 21ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-ad-exit-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 43ed58a47eaa7134ec3300ded45afc01af073084130eb90beeb389da9814deec Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 44717 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5727 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 18:22:15 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "73b8fa958135ca02" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 18:22:15 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 6BC6	92 KB 28 KB	40ms 18ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-analytics-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eaad8e5b3abc10a8518e1f8dae5ecea96dc45db3c7461113c9b5f06902e0c50a Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 41017 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 28323 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:55 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "c55fc50a3cb141e2" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:55 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 6BC6	3 KB 1 KB	39ms 17ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-fit-text-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6b3f9cc6b1e1cd02649447c72d77f9cef2fc81cfdea5b47a20f507eed6483a31 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 44722 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1392 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 18:22:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "d4f783c5765ebbae" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 18:22:10 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 6BC6	46 KB 15 KB	37ms 15ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-form-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8ad1368b0463703245ec260353fb66da9b8bef31a2468f8392c8eeea6a55cdda Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 40900 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 14845 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:25:52 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "688737a9eb3f24de" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:25:52 GMT
GET H2	200	css fonts.googleapis.com/ Frame 6BC6	5 KB 776 B	17ms 17ms	Stylesheet text/css	2a00:1450:4001:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto%3A400%2C500 Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 x-xss-protection 0 last-modified Wed, 18 Mar 2020 06:47:32 GMT server ESF date Wed, 18 Mar 2020 06:47:32 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 18 Mar 2020 06:47:32 GMT
GET DATA	200 OK	truncated / Frame 6BC6	213 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 9c8bff360823dc0a99a194efbe4e2babb9d6a8d7c02d6d242ff333b51f11b8d7 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	amp4ads-host-v0.js Show response cdn.ampproject.org/rtv/012003031842100/	20 KB 7 KB	23ms 22ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-host-v0.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7fa58b512176de3de4ee84324c9cb545d4ee79937b6a3518af6ed1a5e61378db Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 21300 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 7159 x-xss-protection 0 server sffe date Wed, 18 Mar 2020 00:52:32 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "8d5b3500a9fa769d" accept-ranges bytes timing-allow-origin * expires Thu, 18 Mar 2021 00:52:32 GMT
GET H2	200	bid Show response c.amazon-adsystem.com/e/dtb/	23 B 377 B	68ms 68ms	XHR text/javascript	13.225.86.250 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&pid=PJjheXRT8Yyyt&cb=1&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-86-250.fra2.r.cloudfront.net Software Server / Resource Hash 89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 06:47:32 GMT via 1.1 56fad5a50ef67bd961b9722ed0931839.cloudfront.net (CloudFront) server Server x-amz-cf-pop FRA2-C2 status 200 vary User-Agent x-cache Miss from cloudfront content-type text/javascript;charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true timing-allow-origin * content-length 23 x-amz-cf-id LUUPXQv1X_wfJWdB5VYc8DYBYaIQr6H6nuy_SH-0ylTAZllh2jBIQQ==
GET H2	200	bid Show response c.amazon-adsystem.com/e/dtb/	23 B 376 B	61ms 61ms	XHR text/javascript	13.225.86.250 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&pid=cFUzPOTuuyeNm&cb=2&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_1%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-86-250.fra2.r.cloudfront.net Software Server / Resource Hash 5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 06:47:32 GMT via 1.1 56fad5a50ef67bd961b9722ed0931839.cloudfront.net (CloudFront) server Server x-amz-cf-pop FRA2-C2 status 200 vary User-Agent x-cache Miss from cloudfront content-type text/javascript;charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true timing-allow-origin * content-length 23 x-amz-cf-id GSN7ldGt_V5Qx9FOnVNKTUHgUi4Pvxqp5Gza6-ESU1K5N70zsOxqcg==
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 6BC6	2 KB 3 KB	7ms 6ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 23:33:48 GMT x-content-type-options nosniff content-type image/png server cafe age 26024 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Wed, 18 Mar 2020 23:33:48 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 6BC6	295 B 425 B	6ms 6ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 21:53:20 GMT x-content-type-options nosniff content-type image/png server cafe age 32052 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Wed, 18 Mar 2020 21:53:20 GMT
GET H2	204	l www.google.com/ads/measurement/ Frame 6BC6	0 0	18ms 14ms	Image text/html	2a00:1450:4001:824::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaSvqVwESR-k862qLtegtCA5cQCI6iZmWjSxQpLt2tBYZAeLPo_ZzdZQLIwn6JFp1dyrzJWyhyq-_xv0SIXZN33qr4KbBA Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame 6BC6	0 0	38ms 34ms	Image text/html	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CDYIYA8RxXq2LLYrNgAeumreoB-uS9sVbhNezoqcHpOfy7ZUCEAEg2tfFOWC56L6A1AGgAa394P0DyAEBqQLvf77263qyPuACAKgDAcgDCqoEtAJP0E_zDj71dzZz3w_JKIpOJUlY9s64CzfFQs5cbdY7mOqY-8bJiWjF0CUbdQmUTvwNU6sJuZ4C68aVw_oQElELyaMpm0PQdcZS5fCjZl1A5LlrpvUcLobDB0-8YSSWIU9xIsYcZ2ReVVlxajTNzhMVf5wAsAkECgSuXC8kf9Hep3VIWGiYs1WAwkf69wFmlyQq07iYZxnqZcjfHkSgvw72dIX3zbz-DYHSX4we7Na_tX-0z9qYPG-W297mmnnvGQa2i3taUbdZrdjK0J4_t1RvQ_kPwoWI3jl81vQpZDFX9xTSQ1O8c0tfOnsBkwKWc4v_0Beck_dTeIdKJM9JMID3E41J8qFaichibn508835MGDz2NEy6wUfQoj8OAu5E7BHNYOUXuoxvJl-vaIjCozA7rHsLMAEs4nC79gB4AQBgAe7gp8CqAeOzhuoB9XJG6gHk9gbqAef2xuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RvYBwHyBwQQnP4C0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi0xNzQyMjQ5NjAzMjg5MDgzgAoDyAsB2BMDiBQC&sigh=AWDnHkaTBuo&tpd=AGWhJmuCU30uUkXSbx7x0U8K8YfVtAKCUV2hpqQKXJik3uGYvw Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003031842100/ Frame C5E6	200 KB 55 KB	10ms 6ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 41016 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55795 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a96964b23e387b31" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:56 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003031842100/ Frame C5E6	200 KB 55 KB	20ms 19ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 41016 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55795 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a96964b23e387b31" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:56 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame C5E6	16 KB 6 KB	27ms 26ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-ad-exit-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 43ed58a47eaa7134ec3300ded45afc01af073084130eb90beeb389da9814deec Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 44717 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5727 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 18:22:15 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "73b8fa958135ca02" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 18:22:15 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame C5E6	92 KB 28 KB	25ms 24ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-analytics-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eaad8e5b3abc10a8518e1f8dae5ecea96dc45db3c7461113c9b5f06902e0c50a Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 41017 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 28323 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:55 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "c55fc50a3cb141e2" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:55 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame C5E6	3 KB 1 KB	24ms 23ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-fit-text-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6b3f9cc6b1e1cd02649447c72d77f9cef2fc81cfdea5b47a20f507eed6483a31 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 44722 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1392 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 18:22:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "d4f783c5765ebbae" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 18:22:10 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame C5E6	46 KB 15 KB	24ms 23ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-form-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8ad1368b0463703245ec260353fb66da9b8bef31a2468f8392c8eeea6a55cdda Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 40900 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 14845 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:25:52 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "688737a9eb3f24de" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:25:52 GMT
GET H2	200	css fonts.googleapis.com/ Frame C5E6	5 KB 730 B	23ms 20ms	Stylesheet text/css	2a00:1450:4001:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 x-xss-protection 0 last-modified Wed, 18 Mar 2020 06:47:32 GMT server ESF date Wed, 18 Mar 2020 06:47:32 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 18 Mar 2020 06:47:32 GMT
GET H2	200	css fonts.googleapis.com/ Frame C5E6	5 KB 730 B	29ms 26ms	Stylesheet text/css	2a00:1450:4001:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&text= Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 x-xss-protection 0 last-modified Wed, 18 Mar 2020 06:47:32 GMT server ESF date Wed, 18 Mar 2020 06:47:32 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 18 Mar 2020 06:47:32 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame C5E6	2 KB 3 KB	7ms 5ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 23:33:48 GMT x-content-type-options nosniff content-type image/png server cafe age 26024 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Wed, 18 Mar 2020 23:33:48 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame C5E6	295 B 362 B	8ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 21:53:20 GMT x-content-type-options nosniff content-type image/png server cafe age 32052 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Wed, 18 Mar 2020 21:53:20 GMT
GET DATA	200 OK	truncated / Frame C5E6	214 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d35d2e35ac467e2101ce9d2992bbe601e01b2da9226a73a96741b75ac6dffae3 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003031842100/ Frame 34C7	200 KB 55 KB	17ms 15ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 41016 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55795 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a96964b23e387b31" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:56 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003031842100/ Frame 34C7	200 KB 55 KB	23ms 21ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 41016 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55795 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a96964b23e387b31" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:56 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 34C7	16 KB 6 KB	19ms 18ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-ad-exit-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 43ed58a47eaa7134ec3300ded45afc01af073084130eb90beeb389da9814deec Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 44717 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5727 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 18:22:15 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "73b8fa958135ca02" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 18:22:15 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 34C7	92 KB 28 KB	18ms 17ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-analytics-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eaad8e5b3abc10a8518e1f8dae5ecea96dc45db3c7461113c9b5f06902e0c50a Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 41017 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 28323 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:55 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "c55fc50a3cb141e2" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:55 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 34C7	3 KB 1 KB	22ms 20ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-fit-text-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6b3f9cc6b1e1cd02649447c72d77f9cef2fc81cfdea5b47a20f507eed6483a31 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 44722 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1392 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 18:22:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "d4f783c5765ebbae" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 18:22:10 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 34C7	46 KB 15 KB	21ms 20ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-form-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8ad1368b0463703245ec260353fb66da9b8bef31a2468f8392c8eeea6a55cdda Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 40900 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 14845 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:25:52 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "688737a9eb3f24de" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:25:52 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 34C7	2 KB 3 KB	8ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 23:33:48 GMT x-content-type-options nosniff content-type image/png server cafe age 26024 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Wed, 18 Mar 2020 23:33:48 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 34C7	295 B 362 B	8ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 21:53:20 GMT x-content-type-options nosniff content-type image/png server cafe age 32052 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Wed, 18 Mar 2020 21:53:20 GMT
GET DATA	200 OK	truncated / Frame 34C7	218 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8619e12f5d78f5861048115f12630b236ad28e704be5804af93b17119210a3c9 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	view securepubads.g.doubleclick.net/pcs/ Frame A400	0 0	46ms 31ms	Fetch image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss1mB8EjhdahlN_pyOLfpjjRd-LJrdUkmQSr8LWYmRHhduNebCmv9UsNi0eHMpDKK0_cNP5CJ7m_20mTgDNcMduihJ7m_J_u6j1L8tddsTfVML5LV9w2AVv73nSTAWl7F-BY28QrKwkEIR9p0KN9GU1LjLBV8iuBAcJ0y1SmDULdTSUgsJPoh0s48gveTwR9-y3JmG_VzbqEqcEJee1_Kzv2NkYjBDux8pYGOHOg9Kp4eZoPI4axDTAamyBzhaxxmkrhZJQUSrpZVBRYWFwt-7FsCFKN7uXZmZz&sig=Cg0ArKJSzJ8vSFz2Ka-eEAE&urlfix=1&adurl= Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest empty Response headers timing-allow-origin * date Wed, 18 Mar 2020 06:47:32 GMT x-content-type-options nosniff server cafe status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Wed, 18 Mar 2020 06:47:32 GMT
GET H2	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame A400	73 KB 28 KB	27ms 13ms	Script text/javascript	2a00:1450:4001:800::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1d7fe0f9bb86a16f6cdbca71a61b250ec61d838cb0cdb2bdd061ee0247783183 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:32 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1584217929168357" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 28078 x-xss-protection 0 expires Wed, 18 Mar 2020 06:47:32 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003031842100/ Frame 09DE	200 KB 55 KB	14ms 2ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 41016 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55795 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a96964b23e387b31" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:56 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003031842100/ Frame 09DE	200 KB 55 KB	16ms 5ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 41016 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55795 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a96964b23e387b31" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:56 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 09DE	16 KB 6 KB	15ms 4ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-ad-exit-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 43ed58a47eaa7134ec3300ded45afc01af073084130eb90beeb389da9814deec Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 44717 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5727 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 18:22:15 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "73b8fa958135ca02" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 18:22:15 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 09DE	92 KB 28 KB	14ms 4ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-analytics-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eaad8e5b3abc10a8518e1f8dae5ecea96dc45db3c7461113c9b5f06902e0c50a Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 41017 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 28323 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:55 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "c55fc50a3cb141e2" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:55 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 09DE	3 KB 1 KB	16ms 6ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-fit-text-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6b3f9cc6b1e1cd02649447c72d77f9cef2fc81cfdea5b47a20f507eed6483a31 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 44722 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1392 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 18:22:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "d4f783c5765ebbae" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 18:22:10 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 09DE	46 KB 15 KB	16ms 6ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-form-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8ad1368b0463703245ec260353fb66da9b8bef31a2468f8392c8eeea6a55cdda Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 40900 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 14845 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:25:52 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "688737a9eb3f24de" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:25:52 GMT
GET H2	200	css fonts.googleapis.com/ Frame 09DE	5 KB 730 B	25ms 15ms	Stylesheet text/css	2a00:1450:4001:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 x-xss-protection 0 last-modified Wed, 18 Mar 2020 06:47:32 GMT server ESF date Wed, 18 Mar 2020 06:47:32 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 18 Mar 2020 06:47:32 GMT
GET H2	200	css fonts.googleapis.com/ Frame 09DE	5 KB 730 B	24ms 14ms	Stylesheet text/css	2a00:1450:4001:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&text= Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 x-xss-protection 0 last-modified Wed, 18 Mar 2020 06:47:32 GMT server ESF date Wed, 18 Mar 2020 06:47:32 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 18 Mar 2020 06:47:32 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 09DE	2 KB 3 KB	17ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 23:33:48 GMT x-content-type-options nosniff content-type image/png server cafe age 26024 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Wed, 18 Mar 2020 23:33:48 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 09DE	295 B 362 B	17ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 21:53:20 GMT x-content-type-options nosniff content-type image/png server cafe age 32052 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Wed, 18 Mar 2020 21:53:20 GMT
GET DATA	200 OK	truncated / Frame 09DE	213 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8aaa58d5011496f6e163f606ea03cd0a9afc6dec645a0d2c6d6f4267d435f52f Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/2225613035339725144/ Frame C5E6	8 KB 8 KB	16ms 8ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/2225613035339725144/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoIrAIQnQEYASABLQAAAD8wrAI4nQFFAACAPw&rs=AOga4qmYL52MHSGOooQmoPq9f4bJbh8U0A Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6614eac161305e6201210710c158426c3b2ea6a4ef2c7da7fde5d236d10d0639 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 25 Feb 2020 06:32:28 GMT x-content-type-options nosniff last-modified Fri, 22 Mar 2019 17:26:36 GMT server sffe age 1901704 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 7783 x-xss-protection 0 expires Wed, 24 Feb 2021 06:32:28 GMT
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/13256797330833292739/ Frame C5E6	8 KB 8 KB	19ms 10ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/13256797330833292739/downsize_200k_v1?sqp=4sqPyQSLAUKIAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-Mg8I2AQQ2AQYASABLQAAAD8&rs=AOga4qmAyS_2N6i6WVRJrhVZWLJKSmNoHw Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 623ba67fdee04abb38857d8cb22124da662ae2d95d1ce5033a4df0ddcd444031 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 30 Jan 2020 08:20:29 GMT x-content-type-options nosniff last-modified Mon, 22 Jul 2019 17:36:44 GMT server sffe age 4141623 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 8473 x-xss-protection 0 expires Fri, 29 Jan 2021 08:20:29 GMT
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame C5E6	0 0	41ms 33ms	Image text/html	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CsvLlA8RxXsiPLYrNgAeumreoB67W1YdazZLfhrAKwaGPlQEQASDa18U5YLnovoDUAaABj5SzlwPIAQbgAgCoAwHIAwqqBLgCT9A7ktmVO2bp13Xgkdsff3Xv4QqyH9AiL9_bCX9NUQjMuBKdP_cwzWl6EbYHMvJaqYJoosiHF_jfFFSqiM8wrVeEvYN-2y432l_QRFEs0ALC0jOtdN5ZsMa1F07uAH22EIWkWfyuHWK7L4iI5OD7oPQ1fod2WeOxqXXa7_3BNSHnvKDdi_yWcM8iH9yh6Sm4zDevDv-VljSeAmDQfxOJ0qv-W-sOER_wNXXdfQae_3iIKbBHlfjcFHPPnHG0oaWTXG762_-2GLdna1ORym7m5CEzl90PppNoR9BVXISXobe4WfPpmR3mEVRg8LITZmB9hYkm_vT6zUteToEtmYFBMa7iLfT4WrFe28vD0pQHQwsgYsyyvadTJkp1Jt-EH-KBbA6NFtsp7Bt1BmbJ4M7_paJrJiTPZfiywAS7ws2htALgBAGgBjeAB9nrzGioB47OG6gH1ckbqAeT2BuoB5_bG6gHugaoB_DZG6gH8tkbqAemvhuoB-zVG9gHAfIHAxCdZ9IICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tMTc0MjI0OTYwMzI4OTA4M4AKA8gLAdgTAogUAw&sigh=niwGVbUB-gQ&template_id=492&tpd=AGWhJmvp0TN_yO0Iz9Mh1aX0dLgxZVinCxDqwGR0nji9fWxNJA Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	204	l www.google.com/ads/measurement/ Frame C5E6	0 0	21ms 13ms	Image text/html	2a00:1450:4001:824::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaQUhnYx6hwKhlej4m5bQQAOQXFNH6W8Gvef3hILYNVFzYbA35ThMIfL5pOPMCQ6jBrN4JUqpZofI9npcwmHnKJPKTJ0Wg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	7157410355915222721 tpc.googlesyndication.com/simgad/ Frame 34C7	58 KB 58 KB	9ms 8ms	Image image/gif	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/7157410355915222721 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5fce856044b90985f1f55e425a3da9d4048106a2d341b08d25b1843bfaa5d211 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 31 Jan 2020 08:55:37 GMT x-content-type-options nosniff age 4053115 x-dns-prefetch-control off status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 59611 x-xss-protection 0 last-modified Thu, 05 Apr 2018 11:07:20 GMT server sffe content-type image/gif access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 30 Jan 2021 08:55:37 GMT
GET H2	204	l www.google.com/ads/measurement/ Frame 34C7	0 0	14ms 13ms	Image text/html	2a00:1450:4001:824::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaTaiwiDlxrMCXEbtrHUfoD9PtJlfUMDes8lV4dnEjsgvYdqAaH4BfhLIgXocWr6-80PSlCnfRyaThjY9kLjHZyTJ9lqkg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame 34C7	0 0	34ms 33ms	Image text/html	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=C3K_zA8RxXq6RLYrNgAeumreoB-vahLRNwMbAsZgJivz8ytkNEAEg2tfFOWC56L6A1AGgAauQ8-wDyAED4AIAqAMByAMIqgS3Ak_QEr4Oit04BDrFUDw5P4IzOXr2ufzByOLFDSShrH_Op6Sp1vqDsONf86Bt1EWPo1rDxNA73hUnJ1rp3BxcPZDHCVRsmQNB-lUsuts24eHD4E6naZu4Pw1jSHkED0MKHYbEJsmdaJldVZv_MfuxgS2SYD2XYdXTUMz9sHbkMsBkvVeH9zwKLWfpwn-3qW8GVqua7cLH-s2JRx_gfjyl7wXdpAEqyVR655HsCzDDOykcoRqi1gFyjDYIUAuNsurt5qKD0uCefBzXlzxowLnR2h3Jtaz-7BIHgA7zqOAo8B1P0h-D1R6qizlpt4S5xCbMfScG0w1CiNIuVZj6IQA6Jz1O7g_hwcjVDWjQ0r2RQe2IlPaIsSXG6BQnE2F1uD3Yn1IblupAK4c7aHfr4nm5AjMQxpGSLNNLwAT_x5m2SOAEAZIFBAgEGAGSBQQIBRgEoAYDgAe974wTqAeOzhuoB9XJG6gHk9gbqAef2xuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RvYBwHyBwQQ5v4C0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi0xNzQyMjQ5NjAzMjg5MDgzgAoDyAsB2BMC&sigh=EGtGpK0IwkY&tpd=AGWhJms0GQVctlqn0ZPAEtvSMdAFSgRy0Cq6bdEju53pxPXJlg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	204	gen_204 pagead2.googlesyndication.com/pagead/	0 58 B	14ms 14ms	Image image/gif	2a00:1450:4001:818::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_sz&pvsid=1724307350463099&r=1x1&w=1&h=1 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 204 cache-control no-cache, must-revalidate timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/2225613035339725144/ Frame 09DE	8 KB 8 KB	6ms 5ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/2225613035339725144/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoIrAIQnQEYASABLQAAAD8wrAI4nQFFAACAPw&rs=AOga4qmYL52MHSGOooQmoPq9f4bJbh8U0A Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6614eac161305e6201210710c158426c3b2ea6a4ef2c7da7fde5d236d10d0639 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 25 Feb 2020 06:32:28 GMT x-content-type-options nosniff last-modified Fri, 22 Mar 2019 17:26:36 GMT server sffe age 1901704 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 7783 x-xss-protection 0 expires Wed, 24 Feb 2021 06:32:28 GMT
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/13256797330833292739/ Frame 09DE	8 KB 8 KB	7ms 6ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/13256797330833292739/downsize_200k_v1?sqp=4sqPyQSLAUKIAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-Mg8I2AQQ2AQYASABLQAAAD8&rs=AOga4qmAyS_2N6i6WVRJrhVZWLJKSmNoHw Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 623ba67fdee04abb38857d8cb22124da662ae2d95d1ce5033a4df0ddcd444031 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 30 Jan 2020 08:20:29 GMT x-content-type-options nosniff last-modified Mon, 22 Jul 2019 17:36:44 GMT server sffe age 4141623 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 8473 x-xss-protection 0 expires Fri, 29 Jan 2021 08:20:29 GMT
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame 09DE	0 0	33ms 33ms	Image text/html	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CtWbBA8RxXrySLYrNgAeumreoB67W1YdazZLfhrAKwaGPlQEQASDa18U5YLnovoDUAaABj5SzlwPIAQbgAgCoAwHIAwqqBLgCT9Cn60mHoXVjR5RJX6kagq05ab84iuLez_idPEwHv4G3CM2br_YW8sNWqxjmaYrYenq9IAbAMKkgTvovpa2B52YBXR5O5A21gVYnCIqVmvfgAdxNi6NLfODa7K44nB1YW45rAMV_etdp2eFMYxrNwiEpY2oe4hJn1kpisBV0n_FpFEkuy28LB7OgPfTjH7dsYmxxKJLktJ4yIQQ82Yi1LNGeleSjjsbPeBcwrqxNmHat8H0ufrxYHC0HMemARc55M8bTxTti9la5p7nlBeiVsnXdL2VQYpzB7Voi2JU24cL8kcPtrNTWok4DKcrmYHWj95NJh6BZA9YLrR3Fjix7xKTohVzMffytsUl_jwfEDTMuHoYJRoChXAgV5nS2fMHi9YRx6T91Ji-23ydUbGn2vOuxufsLeu54wAS7ws2htALgBAGSBQQIBBgBkgUECAUYBKAGN4AH2evMaKgHjs4bqAfVyRuoB5PYG6gHn9sbqAe6BqgH8NkbqAfy2RuoB6a-G6gH7NUb2AcB8gcEEOaWAtIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tMTc0MjI0OTYwMzI4OTA4M4AKA8gLAdgTAogUAw&sigh=xwqMUwlvXuA&template_id=492&tpd=AGWhJmuAANRUEgSh5s0IEY1aBrpxkhsJRLYJsopVwnH1MYnmgQ Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/ Frame 6BC6	11 KB 11 KB	10ms 7ms	Font font/woff2	2a00:1450:4001:815::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto%3A400%2C500 Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:12:39 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 1136093 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11056 x-xss-protection 0 expires Fri, 05 Mar 2021 03:12:39 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/ Frame 6BC6	11 KB 11 KB	9ms 7ms	Font font/woff2	2a00:1450:4001:815::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto%3A400%2C500 Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 08:47:06 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 1720826 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11016 x-xss-protection 0 expires Fri, 26 Feb 2021 08:47:06 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/ Frame C5E6	11 KB 11 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:815::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 08:47:06 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 1720826 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11016 x-xss-protection 0 expires Fri, 26 Feb 2021 08:47:06 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/ Frame C5E6	11 KB 11 KB	7ms 7ms	Font font/woff2	2a00:1450:4001:815::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:12:39 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 1136093 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11056 x-xss-protection 0 expires Fri, 05 Mar 2021 03:12:39 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/ Frame 09DE	11 KB 11 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:815::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 08:47:06 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 1720826 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11016 x-xss-protection 0 expires Fri, 26 Feb 2021 08:47:06 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/ Frame 09DE	11 KB 11 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:815::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:12:39 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 1136093 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11056 x-xss-protection 0 expires Fri, 05 Mar 2021 03:12:39 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	263 B 2 KB	112ms 111ms	XHR application/json	69.173.144.142 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=3de443f9-f495-4193-969f-1b46b2238abe&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.22929346451025556 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.142 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash 5b2905652c60ac97e3b23f7e7709633670cecf459584e73fb041abbb1c8ed569 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 06:47:32 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=468 Content-Length 263 Expires Wed, 17 Sep 1975 21:32:10 GMT
POST H2	200	auction Show response tlx.3lift.com/header/	19 B 333 B	30ms 30ms	XHR application/json	52.28.30.97 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&tmax=1200 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.28.30.97 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-28-30-97.eu-central-1.compute.amazonaws.com Software / Resource Hash 0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT x-auction-status 12, 12, 12, 12 status 200 content-type application/json; charset=utf-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true content-length 19 x-xss-protection 0 expires Thu, 15 Oct 1992 20:10:00 GMT
GET H2	200	arj Show response freestar-d.openx.net/w/1.0/	174 B 367 B	125ms 125ms	XHR application/json	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=3de443f9-f495-4193-969f-1b46b2238abe&nocache=1584514052342&pubcid=bad9f0a9-6e04-493f-879c-e00669b5521a&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=728x90%2C970x90%2C970x250&divIds=bleepingcomputer_728x90_970x90_970x250_320x50_BTF&auid=540959250& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.179.0 / Resource Hash ed642d316347c9c5c67d736168abd520ef9aa73087b3feee3c737a9e662a3a66 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT content-encoding gzip server OXGW/16.179.0 status 200 vary Accept, Accept-Encoding p3p CP="CUR ADM OUR NOR STA NID" access-control-allow-origin https://www.bleepingcomputer.com cache-control private, max-age=0, no-cache access-control-allow-credentials true content-type application/json alt-svc clear content-length 165 via 1.1 google expires Mon, 26 Jul 1997 05:00:00 GMT
GET H/1.1	200 OK	cygnus Show response as-sec.casalemedia.com/	26 B 998 B	117ms 116ms	XHR application/json	23.210.249.164 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%221354a5bc5959e2a4%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22136ec83a44613a6d%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%221371100616fb0a7d%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22138da704c4fe7ef4%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-249-164.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 3354900aa543505660cb3096358bdc4b88fa3f290898ced9d7b2d1689a930d08 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 06:47:32 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json Content-Length 46 Expires Wed, 18 Mar 2020 06:47:32 GMT
POST H2	204	v1 Show response dmx.districtm.io/b/	0 168 B	35ms 35ms	XHR text/plain	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dmx.districtm.io/b/v1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers date Wed, 18 Mar 2020 06:47:32 GMT cf-cache-status DYNAMIC server cloudflare status 204 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary origin, Accept-Encoding access-control-allow-methods OPTIONS, POST access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 575d00bb28047257-AMS access-control-allow-headers origin, content-type
POST H/1.1	404 Not Found	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/	678 B 878 B	13ms 13ms	XHR text/plain	2a02:fa8:8806:12::1430 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:fa8:8806:12::1430 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash d3a970101d5c1c13fe97539903a8285d524c87295f551421ab9e40d9c1324e4a Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Wed, 18 Mar 2020 06:47:32 GMT Cache-Control max-age=0, no-store Server nginx Connection keep-alive Content-Length 678 Content-Type text/plain; charset=UTF-8
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	19 B 720 B	19ms 19ms	XHR application/json	185.33.223.209 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.209 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 314.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 06:47:34 GMT X-Proxy-Origin 82.102.19.132; 82.102.19.132; 314.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.107:80 AN-X-Request-Uuid ddfca319-1873-4966-bf9d-0a1c8f4cc8da Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 19 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584514052;v=2;cmd=bid;cors=yes;alias=1544e112f7ff86eb;misc=1584514052344 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1544e112f7ff86eb;misc=1584514052344; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584514052;v=2;cmd=bid;cors=yes;alias=1544e112f7ff86eb;misc=1584514052344	0 -1 B	107ms 107ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584514052;v=2;cmd=bid;cors=yes;alias=1544e112f7ff86eb;misc=1584514052344 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584514052;v=2;cmd=bid;cors=yes;alias=1544e112f7ff86eb;misc=1584514052344 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584514052;v=2;cmd=bid;cors=yes;alias=1544e112f7ff86eb;misc=1584514052344 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=155e084c7284e57d;misc=1584514052344 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=155e084c7284e57d;misc=1584514052344; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=155e084c7284e57d;misc=1584514052344	0 -1 B	105ms 104ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=155e084c7284e57d;misc=1584514052344 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=155e084c7284e57d;misc=1584514052344 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=155e084c7284e57d;misc=1584514052344 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584514052;v=2;cmd=bid;cors=yes;alias=156bf86f222269a;misc=1584514052344 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=156bf86f222269a;misc=1584514052344; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514052;v=2;cmd=bid;cors=yes;alias=156bf86f222269a;misc=1584514052344	0 -1 B	102ms 102ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514052;v=2;cmd=bid;cors=yes;alias=156bf86f222269a;misc=1584514052344 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514052;v=2;cmd=bid;cors=yes;alias=156bf86f222269a;misc=1584514052344 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514052;v=2;cmd=bid;cors=yes;alias=156bf86f222269a;misc=1584514052344 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	22ms 22ms	XHR text/plain	3.124.246.214 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=1509dbcafbf33e99&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.124.246.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-124-246-214.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 06:47:32 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	23ms 22ms	XHR text/plain	3.124.246.214 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=bDraMWgeoLM4KHJBzFQ8heMv&bidId=151563d5755b20ec&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.124.246.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-124-246-214.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 06:47:32 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	19 B 720 B	19ms 19ms	XHR application/json	185.33.223.209 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.209 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 314.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 06:47:34 GMT X-Proxy-Origin 82.102.19.132; 82.102.19.132; 314.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.165:80 AN-X-Request-Uuid bf5d332e-7d0d-49e5-a916-8588f6b049bb Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 19 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame 6BC6 Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	40ms 39ms	Image text/html	2a00:1450:4001:81c::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers date Wed, 18 Mar 2020 06:47:32 GMT x-content-type-options nosniff server safe location https://googleads.g.doubleclick.net/pagead/drt/si content-type text/html; charset=UTF-8 status 302 cache-control private alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 246 x-xss-protection 0
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame 34C7 Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	39ms 39ms	Image text/html	2a00:1450:4001:81c::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers date Wed, 18 Mar 2020 06:47:32 GMT x-content-type-options nosniff server safe location https://googleads.g.doubleclick.net/pagead/drt/si content-type text/html; charset=UTF-8 status 302 cache-control private alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 246 x-xss-protection 0
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame C5E6 Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	39ms 39ms	Image text/html	2a00:1450:4001:81c::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers date Wed, 18 Mar 2020 06:47:32 GMT x-content-type-options nosniff server safe location https://googleads.g.doubleclick.net/pagead/drt/si content-type text/html; charset=UTF-8 status 302 cache-control private alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 246 x-xss-protection 0
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame 09DE Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	38ms 38ms	Image text/html	2a00:1450:4001:81c::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers date Wed, 18 Mar 2020 06:47:32 GMT x-content-type-options nosniff server safe location https://googleads.g.doubleclick.net/pagead/drt/si content-type text/html; charset=UTF-8 status 302 cache-control private alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 246 x-xss-protection 0
GET H2	302	ADTECH;apid=1A57ee7178-68e4-11ea-85ef-12f0dd10f918;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=156bf86f222269a;misc=1584514052344 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584514052;v=2;cmd=bid;cors=yes;alias=156bf86f222269a;misc=1584514052344 https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A57ee7178-68e4-11ea-85ef-12f0dd10f918;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=156bf86f222269a;misc=15...	0 -1 B	106ms 106ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A57ee7178-68e4-11ea-85ef-12f0dd10f918;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=156bf86f222269a;misc=1584514052344 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A57ee7178-68e4-11ea-85ef-12f0dd10f918;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=156bf86f222269a;misc=1584514052344 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A57ee7178-68e4-11ea-85ef-12f0dd10f918;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=156bf86f222269a;misc=1584514052344 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;apid=1A57ee7e16-68e4-11ea-8ee9-12a867928a20;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=155e084c7284e57d;misc=1584514052344 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=155e084c7284e57d;misc=1584514052344 https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A57ee7e16-68e4-11ea-8ee9-12a867928a20;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=155e084c7284e57d;misc=1...	0 -1 B	104ms 104ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A57ee7e16-68e4-11ea-8ee9-12a867928a20;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=155e084c7284e57d;misc=1584514052344 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A57ee7e16-68e4-11ea-8ee9-12a867928a20;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=155e084c7284e57d;misc=1584514052344 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A57ee7e16-68e4-11ea-8ee9-12a867928a20;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=155e084c7284e57d;misc=1584514052344 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;apid=1A57eed8a2-68e4-11ea-9af2-12bd5c3e34a0;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1544e112f7ff86eb;misc=1584514052344 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584514052;v=2;cmd=bid;cors=yes;alias=1544e112f7ff86eb;misc=1584514052344 https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A57eed8a2-68e4-11ea-9af2-12bd5c3e34a0;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1544e112f7ff86eb;misc=1...	0 -1 B	108ms 108ms	XHR	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A57eed8a2-68e4-11ea-9af2-12bd5c3e34a0;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1544e112f7ff86eb;misc=1584514052344 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A57eed8a2-68e4-11ea-9af2-12bd5c3e34a0;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1544e112f7ff86eb;misc=1584514052344 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A57eed8a2-68e4-11ea-9af2-12bd5c3e34a0;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1544e112f7ff86eb;misc=1584514052344 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/2225613035339725144/ Frame C5E6	8 KB 8 KB	6ms 6ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/2225613035339725144/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoIrAIQnQEYASABLQAAAD8wrAI4nQFFAACAPw&rs=AOga4qmYL52MHSGOooQmoPq9f4bJbh8U0A Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6614eac161305e6201210710c158426c3b2ea6a4ef2c7da7fde5d236d10d0639 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 25 Feb 2020 06:32:28 GMT x-content-type-options nosniff last-modified Fri, 22 Mar 2019 17:26:36 GMT server sffe age 1901704 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 7783 x-xss-protection 0 expires Wed, 24 Feb 2021 06:32:28 GMT
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/13256797330833292739/ Frame C5E6	8 KB 8 KB	7ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/13256797330833292739/downsize_200k_v1?sqp=4sqPyQSLAUKIAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-Mg8I2AQQ2AQYASABLQAAAD8&rs=AOga4qmAyS_2N6i6WVRJrhVZWLJKSmNoHw Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 623ba67fdee04abb38857d8cb22124da662ae2d95d1ce5033a4df0ddcd444031 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 30 Jan 2020 08:20:29 GMT x-content-type-options nosniff last-modified Mon, 22 Jul 2019 17:36:44 GMT server sffe age 4141623 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 8473 x-xss-protection 0 expires Fri, 29 Jan 2021 08:20:29 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame C5E6	2 KB 3 KB	7ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 23:33:48 GMT x-content-type-options nosniff content-type image/png server cafe age 26024 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Wed, 18 Mar 2020 23:33:48 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame C5E6	295 B 363 B	7ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 21:53:20 GMT x-content-type-options nosniff content-type image/png server cafe age 32052 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Wed, 18 Mar 2020 21:53:20 GMT
GET H2	200	7157410355915222721 tpc.googlesyndication.com/simgad/ Frame 34C7	58 KB 58 KB	12ms 11ms	Image image/gif	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/7157410355915222721 Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5fce856044b90985f1f55e425a3da9d4048106a2d341b08d25b1843bfaa5d211 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 31 Jan 2020 08:55:37 GMT x-content-type-options nosniff age 4053115 x-dns-prefetch-control off status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 59611 x-xss-protection 0 last-modified Thu, 05 Apr 2018 11:07:20 GMT server sffe content-type image/gif access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 30 Jan 2021 08:55:37 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 34C7	2 KB 3 KB	7ms 6ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 23:33:48 GMT x-content-type-options nosniff content-type image/png server cafe age 26024 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Wed, 18 Mar 2020 23:33:48 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 34C7	295 B 363 B	6ms 6ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 21:53:20 GMT x-content-type-options nosniff content-type image/png server cafe age 32052 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Wed, 18 Mar 2020 21:53:20 GMT
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/2225613035339725144/ Frame 09DE	8 KB 8 KB	11ms 10ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/2225613035339725144/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoIrAIQnQEYASABLQAAAD8wrAI4nQFFAACAPw&rs=AOga4qmYL52MHSGOooQmoPq9f4bJbh8U0A Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6614eac161305e6201210710c158426c3b2ea6a4ef2c7da7fde5d236d10d0639 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 25 Feb 2020 06:32:28 GMT x-content-type-options nosniff last-modified Fri, 22 Mar 2019 17:26:36 GMT server sffe age 1901704 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 7783 x-xss-protection 0 expires Wed, 24 Feb 2021 06:32:28 GMT
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/13256797330833292739/ Frame 09DE	8 KB 8 KB	10ms 10ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/13256797330833292739/downsize_200k_v1?sqp=4sqPyQSLAUKIAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-Mg8I2AQQ2AQYASABLQAAAD8&rs=AOga4qmAyS_2N6i6WVRJrhVZWLJKSmNoHw Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 623ba67fdee04abb38857d8cb22124da662ae2d95d1ce5033a4df0ddcd444031 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 30 Jan 2020 08:20:29 GMT x-content-type-options nosniff last-modified Mon, 22 Jul 2019 17:36:44 GMT server sffe age 4141623 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 8473 x-xss-protection 0 expires Fri, 29 Jan 2021 08:20:29 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 09DE	2 KB 3 KB	10ms 10ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 23:33:48 GMT x-content-type-options nosniff content-type image/png server cafe age 26024 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Wed, 18 Mar 2020 23:33:48 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 09DE	295 B 363 B	10ms 9ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 21:53:20 GMT x-content-type-options nosniff content-type image/png server cafe age 32052 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Wed, 18 Mar 2020 21:53:20 GMT
GET H2	200	ADTECH;apid=1A57ee7e16-68e4-11ea-8ee9-12a867928a20;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=155e084c7284e57d;misc=1584514052344 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/	47 B 80 B	186ms 185ms	XHR application/json	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A57ee7e16-68e4-11ea-8ee9-12a867928a20;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=155e084c7284e57d;misc=1584514052344 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 212e293228c1ca5183c2ed94d01a800028a4ac43ced24f60b892b1805abfdb04 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 47 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;apid=1A57ee7178-68e4-11ea-85ef-12f0dd10f918;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=156bf86f222269a;misc=1584514052344 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/	606 B 737 B	155ms 155ms	XHR application/json	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A57ee7178-68e4-11ea-85ef-12f0dd10f918;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=156bf86f222269a;misc=1584514052344 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash cb8cd4ec81dcebf9c8a45a125cfde52c3938437a2917cda449b5c80d6c9b5e6b Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 606 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;apid=1A57eed8a2-68e4-11ea-9af2-12bd5c3e34a0;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1544e112f7ff86eb;misc=1584514052344 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/	605 B 736 B	159ms 159ms	XHR application/json	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A57eed8a2-68e4-11ea-9af2-12bd5c3e34a0;cfp=1;rndc=1584514051;v=2;cmd=bid;cors=yes;alias=1544e112f7ff86eb;misc=1584514052344 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash ee09776711cf1976aed0a40aad4e7115be364e5e1bb007849f93c3229a311f5a Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 605 expires Mon, 15 Jun 1998 00:00:00 GMT
POST H/1.1	200 OK	c Show response c.pub.network/	0 267 B	484ms 118ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Wed, 18 Mar 2020 06:47:33 GMT Access-Control-Allow-Credentials true Content-Length 0 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers
GET H2	200	pls Show response core.connatix.com/ Frame E6FA	7 KB 3 KB	328ms 113ms	Script text/plain	54.88.18.195 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://core.connatix.com/pls?callback=jQuery321047775004301637813_1584514049558&token=83c6e833-8c07-474c-b10f-079d46320a80&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&c_v=1911_1_0_0_0&page_guid=ac071e9fe1acf9d681041584514052662&spp=1&_=1584514049559 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.88.18.195 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-88-18-195.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash 77c83c654fbba10f9131d4f651b0eadb0078ea129d85bb95c0d000831f280dfa Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers status 200 date Wed, 18 Mar 2020 06:47:32 GMT content-encoding gzip server nginx/1.15.9 (Ubuntu) access-control-allow-origin *
GET H2	200	arj Show response freestar-d.openx.net/w/1.0/	174 B 367 B	97ms 96ms	XHR application/json	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=24a6c0bf-3656-410d-b690-78e09495887b&nocache=1584514052747&pubcid=bad9f0a9-6e04-493f-879c-e00669b5521a&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=300x250%2C300x600&divIds=bleepingcomputer_300x250_300x600_160x600_Right_1&auid=540959250& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.179.0 / Resource Hash 082840b5ddc5a22abe853f8c6c7427b9787140f63e1ff1c4cd305472d837d592 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT content-encoding gzip server OXGW/16.179.0 status 200 vary Accept, Accept-Encoding p3p CP="CUR ADM OUR NOR STA NID" access-control-allow-origin https://www.bleepingcomputer.com cache-control private, max-age=0, no-cache access-control-allow-credentials true content-type application/json alt-svc clear content-length 165 via 1.1 google expires Mon, 26 Jul 1997 05:00:00 GMT
GET H/1.1	200 OK	cygnus Show response as-sec.casalemedia.com/	25 B 989 B	121ms 120ms	XHR application/json	23.210.249.164 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%2216321958328122d%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2216442b40740cfc7c%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22165466cba4a9a1f4%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-249-164.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 4fdc0f8d219529eb7a3e1a62a094fbf7816717f8ef92890ccb32373f14c0981b Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 06:47:32 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json Content-Length 45 Expires Wed, 18 Mar 2020 06:47:32 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	261 B 1 KB	208ms 208ms	XHR application/json	69.173.144.142 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=24a6c0bf-3656-410d-b690-78e09495887b&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.9836581869378087 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.142 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash 426b954a2397aaa8c230b890919f41203a7a573ffec0947d271f1d0f0b07d99a Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 06:47:32 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=402 Content-Length 261 Expires Wed, 17 Sep 1975 21:32:10 GMT
POST H2	200	auction Show response tlx.3lift.com/header/	19 B 333 B	22ms 22ms	XHR application/json	52.28.30.97 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&tmax=1200 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.28.30.97 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-28-30-97.eu-central-1.compute.amazonaws.com Software / Resource Hash 0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT x-auction-status 12, 12, 12, 12 status 200 content-type application/json; charset=utf-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true content-length 19 x-xss-protection 0 expires Thu, 15 Oct 1992 20:10:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	146 B 1 KB	37ms 37ms	XHR application/json	185.33.223.209 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.209 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 314.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 1cf2ad0e2257b4151004fedc0d4f8ec6ce7ea7c2a9d7526674330933d8a7ce3d Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 06:47:34 GMT X-Proxy-Origin 82.102.19.132; 82.102.19.132; 314.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.137:80 AN-X-Request-Uuid ca9d0c23-1494-40fc-a8bf-6389ecfed3bd Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 146 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	22ms 22ms	XHR text/plain	3.124.246.214 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=6f2XVeWT9HhHNo9TDFzKK7JK&bidId=1775658d7d103f2a&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.124.246.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-124-246-214.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 06:47:32 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	146 B 1 KB	25ms 25ms	XHR application/json	185.33.223.209 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.209 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 314.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 2901250a12f65717eef1743ae4ef7ed50568a0e21ed2b7699414bf45b2906e51 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 06:47:34 GMT X-Proxy-Origin 82.102.19.132; 82.102.19.132; 314.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.49:80 AN-X-Request-Uuid e629727c-06f0-4036-ac1b-800300af3f2b Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 146 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	ADTECH;v=2;cmd=bid;cors=yes;alias=18737073eae05ca5;misc=1584514052751; Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/	606 B 737 B	145ms 145ms	XHR application/json	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=18737073eae05ca5;misc=1584514052751; Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash a89662462764e34ac63c4a1dc820017f3e2dda689f31c70ab3707b3d87f8fe35 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 606 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;v=2;cmd=bid;cors=yes;alias=188b8bacce8d923f;misc=1584514052751; Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/	604 B 735 B	162ms 162ms	XHR application/json	152.199.22.24 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=188b8bacce8d923f;misc=1584514052751; Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.22.24 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 86dab447ac515a09cb7c162fb00c05b1aa499fbc49c063306f2682dbfcf2f5ce Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:32 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 604 expires Mon, 15 Jun 1998 00:00:00 GMT
POST H/1.1	404 Not Found	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/	678 B 878 B	13ms 13ms	XHR text/plain	2a02:fa8:8806:12::1430 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:fa8:8806:12::1430 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash d3a970101d5c1c13fe97539903a8285d524c87295f551421ab9e40d9c1324e4a Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Wed, 18 Mar 2020 06:47:32 GMT Cache-Control max-age=0, no-store Server nginx Connection keep-alive Content-Length 678 Content-Type text/plain; charset=UTF-8
POST H2	204	v1 Show response dmx.districtm.io/b/	0 39 B	35ms 35ms	XHR text/plain	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dmx.districtm.io/b/v1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers date Wed, 18 Mar 2020 06:47:32 GMT cf-cache-status DYNAMIC server cloudflare status 204 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary origin, Accept-Encoding access-control-allow-methods OPTIONS, POST access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 575d00bdb9567257-AMS access-control-allow-headers origin, content-type
GET DATA	200 OK	truncated /	175 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	715 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	g Show response rtb.connatix.com/	148 B 328 B	479ms 155ms	Script text/plain	52.45.66.51 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://rtb.connatix.com/g?c_pw=834&c_ph=469&c_tk=C018218D-4AD0-4E01-8158-045425E65946&c_bu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&c_ivt=0&connatix_sess=6kv-l3x2CWN2b3Rax5LntgQxfBNXsDB5v2Cco1laq2IWPArQZS2GBOviPB9-UkeIQ2kBBw5WRO5MoCmkS9uFVISvA-a60RutrVuKkLkvuxMU4e9xrKc6nfYeZWjaIYRGB0jNrT0U8n5dmTsIFyVg0DZNP-aIMNnpzMrXqvTHoAELEyXBTMvkpL22Ko1c8ziO&notServed=false&xplr=true&c_s=false&c_pl=VPtY1rbzjEPj0Hg3IbKX0zOzZU8SxsJoXU_ZBX2fefl_YMv4OhWQC60qz7BgSFGi-3dQpDF6TR0IRy3ssYuMZuA1kkOqOxQlJLV_zj4hDx-l3gS-6NCaBurp2fcathknHyeuTxThoisXqC1tBgFDc1Yhd6cV4wTopTVxTaVnlBD7Myt5lIr1Yi3-yfUjkpsPjsoza6fO_l0J7OR7y05LexbXI9KUUE8RBWole5QtDdGuooIaiBJaZwmmCtWXBM1ODM2B8peg_D3zTuJzA_gXAg&gdpr=1&is_ccpa_b=false&med_id=639404&req_no=0&v=1&c_pt=1&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-c&c_v=1911_1_0_0_0&spp=1&callback=cnxJSONP_6be2ee2fee59a755488a1584514053045 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.45.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-45-66-51.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash 3400ce826c01c9fb6b9ab1f9ad60a4055b4d33a475529d984dd1177e99300e61 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Access-Control-Allow-Origin * Date Wed, 18 Mar 2020 06:47:33 GMT Content-Encoding gzip Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 140
GET H2	200	420.jpg i.connatix.com/s3/connatix-uploads/af391ba1-47b0-4ff1-87cb-08a6df11845f/	34 KB 34 KB	67ms 65ms	Image image/jpeg	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/af391ba1-47b0-4ff1-87cb-08a6df11845f/420.jpg?mode=stretch&connatiximg=true&scale=both&height=469&width=834 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 20bb547ce6333c2668884536b83226d8812f02ab1173e13002f4eb86b182e702 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:33 GMT via 1.1 varnish, 1.1 varnish age 14746 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 1, 1 accept-ranges bytes x-timer S1584514053.054542,VS0,VE1 access-control-allow-origin * content-length 34814 x-served-by cache-sjc10044-SJC, cache-hhn4060-HHN
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/01d7ff40-9839-46be-bcf6-c785d715cf58/	42 KB 43 KB	23ms 21ms	Image image/jpeg	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/01d7ff40-9839-46be-bcf6-c785d715cf58/1.jpg?mode=crop&width=1001&height=563 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash ce6b3baf09cef6a609616e704f9cf2ceb470c8b0d3b214756c2150af972e7e41 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:33 GMT via 1.1 varnish, 1.1 varnish age 14745 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 3, 1 accept-ranges bytes x-timer S1584514053.054054,VS0,VE1 access-control-allow-origin * content-length 43346 x-served-by cache-sjc10022-SJC, cache-hhn4060-HHN
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/162da786-637c-4dce-abd7-22985fd8d99e/	32 KB 32 KB	55ms 53ms	Image image/jpeg	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/162da786-637c-4dce-abd7-22985fd8d99e/1.jpg?mode=crop&width=1001&height=563 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash bc345d990d44b20fe3e327a41d7138bb63efb176a97f47dc7306a788b8205bce Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:33 GMT via 1.1 varnish, 1.1 varnish age 14746 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 1, 1 accept-ranges bytes x-timer S1584514053.054538,VS0,VE1 access-control-allow-origin * content-length 32465 x-served-by cache-sjc10039-SJC, cache-hhn4060-HHN
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/7a39d4eb-993f-466e-8ee5-9a934996c204/	43 KB 43 KB	54ms 53ms	Image image/jpeg	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/7a39d4eb-993f-466e-8ee5-9a934996c204/1.jpg?mode=crop&width=1001&height=563 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash acaddabd3451c2e00db440eb34c7d6fd086cc96ce939c369728e7d67643fc5d5 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:33 GMT via 1.1 varnish, 1.1 varnish age 14746 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 2, 1 accept-ranges bytes x-timer S1584514053.054530,VS0,VE1 access-control-allow-origin * content-length 43665 x-served-by cache-sjc10037-SJC, cache-hhn4060-HHN
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/38b3b97a-0d39-4978-934a-614a3f42b75d/	64 KB 64 KB	54ms 53ms	Image image/jpeg	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/38b3b97a-0d39-4978-934a-614a3f42b75d/1.jpg?mode=crop&width=1001&height=563 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash e488ff69d195e17b6081719b7c4b17998d00d7802382b0ef8a5ef550e30e2283 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:33 GMT via 1.1 varnish, 1.1 varnish age 14746 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 1, 1 accept-ranges bytes x-timer S1584514053.054502,VS0,VE1 access-control-allow-origin * content-length 65648 x-served-by cache-sjc10049-SJC, cache-hhn4060-HHN
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/3045fa17-76c8-4e2c-84ca-756b9bf67048/	45 KB 45 KB	47ms 46ms	Image image/jpeg	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/3045fa17-76c8-4e2c-84ca-756b9bf67048/1.jpg?mode=crop&width=1001&height=563 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash f791648f043a2acef9cc1d97148b07637884c8a543b67d0cc450f37fb2477639 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:33 GMT via 1.1 varnish, 1.1 varnish age 14746 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 1, 1 accept-ranges bytes x-timer S1584514053.054533,VS0,VE0 access-control-allow-origin * content-length 45793 x-served-by cache-sjc10033-SJC, cache-hhn4060-HHN
GET H2	200	bleeping-computerlogo-lg.png www.bleepstatic.com/logos/	7 KB 7 KB	35ms 35ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/logos/bleeping-computerlogo-lg.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8a56e644a617b2d1e4e7d808dfc334a7ea8622979f22999dc9eccd21c61958b3 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:33 GMT cf-cache-status HIT age 476636 cf-polished origFmt=png, origSize=15281 status 200 content-disposition inline; filename="bleeping-computerlogo-lg.webp" cf-bgj imgq:85 content-length 7156 last-modified Wed, 07 Jan 2015 22:52:15 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d00bf9b7cee2b-CDG expires Sat, 11 Apr 2020 18:23:37 GMT
GET H2	200	0_th_1.jpg i.connatix.com/s3/connatix-videos/af391ba1-47b0-4ff1-87cb-08a6df11845f/ Frame E6FA	23 KB 23 KB	34ms 34ms	Image image/jpeg	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-videos/af391ba1-47b0-4ff1-87cb-08a6df11845f/0_th_1.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash c3034d0370c5faa09e7a8d7b0c48925afa0371cf17e4827dde23059f56019dae Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 06:47:33 GMT via 1.1 varnish, 1.1 varnish age 17564272 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 1, 1 accept-ranges bytes x-timer S1584514053.094359,VS0,VE1 access-control-allow-origin * content-length 23507 x-served-by cache-sjc3139-SJC, cache-hhn4060-HHN
GET H2	200	tag Show response slckg-phfiv.ads.tremorhub.com/ad/ Frame E6FA	119 B 462 B	452ms 251ms	XHR text/xml	2600:1f18:612b:4200:d055:51f2:df44:ebc AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://slckg-phfiv.ads.tremorhub.com/ad/tag?adCode=slckg-nac38&playerWidth=834&playerHeight=469&playerPosition=1&mediaTitle=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&mediaDesc=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&mediaId=639404&mediaUrl=&srcPageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&contentLength=30&gdpr=1&gdpr_consent=&schain=1.0,1!connatix.com,102734,1,,,, Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:1f18:612b:4200:d055:51f2:df44:ebc Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Apache-Coyote/1.1 / Resource Hash 5616a6e1823b43919f7d1a33817cccfa1d9f30c9f10f2deb00d9c3671f91d5f0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:33 GMT content-encoding gzip server Apache-Coyote/1.1 status 200 vary accept-encoding p3p CP='This is not a P3P policy. See https://telaria.com/privacy-policy/' access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true x-tremorvideo-status NO_AD content-type text/xml;charset=UTF-8
GET H/1.1	200 OK	r trk.connatix.com/ Frame E6FA	0 162 B	431ms 106ms	Image text/plain	3.213.93.144 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://trk.connatix.com/r?connatix_sess=6kv-l3x2CWN2b3Rax5LntgQxfBNXsDB5v2Cco1laq2IWPArQZS2GBOviPB9-UkeIQ2kBBw5WRO5MoCmkS9uFVISvA-a60RutrVuKkLkvuxMU4e9xrKc6nfYeZWjaIYRGB0jNrT0U8n5dmTsIFyVg0DZNP-aIMNnpzMrXqvTHoAELEyXBTMvkpL22Ko1c8ziO&videoID=639404&c_pl=VPtY1rbzjEPj0Hg3IbKX0zOzZU8SxsJoXU_ZBX2fefl_YMv4OhWQC60qz7BgSFGi-3dQpDF6TR0IRy3ssYuMZuA1kkOqOxQlJLV_zj4hDx-l3gS-6NCaBurp2fcathknHyeuTxThoisXqC1tBgFDc1Yhd6cV4wTopTVxTaVnlBD7Myt5lIr1Yi3-yfUjkpsPjsoza6fO_l0J7OR7y05LexbXI9KUUE8RBWole5QtDdGuooIaiBJaZwmmCtWXBM1ODM2B8peg_D3zTuJzA_gXAg&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-c&c_v=1911_1_0_0_0&spp=1 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.93.144 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-93-144.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Access-Control-Allow-Origin * Date Wed, 18 Mar 2020 06:47:33 GMT Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 0
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	52 KB 11 KB	402ms 401ms	XHR text/plain	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1724307350463099&correlator=3999338060914392&output=ldjh&impl=fifs&adsid=NT&eid=21065710%2C21065443&vrg=2020030501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200318&iu_parts=15184186%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C970x90%7C970x250&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie=ID%3D5fcbd8c32f8d73a3%3AT%3D1584514051%3AS%3DALNI_MbPBU6LPaNx5pMyhvlwlv_VyWEUNQ&cookie_enabled=1&bc=31&abxe=1&lmt=1584287085&dt=1584514053282&dlt=1584514049209&idt=705&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=6034&adks=976516616&ucis=8&ifi=3&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&dssz=57&icsg=571746222612480&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1200x90&msz=1170x90&psts=ABP-KfQ1F_EDpwqiqFh3txAOEJa3%2CABP-KfQVRdntN77wdI_DRhD4Cf5lU09FXpyY-6nibgccbwXgvFWXC48Zvfm_-8EGP7ayVFK7Fewh0B6tBxp1&ga_vid=2079321426.1584514050&ga_sid=1584514050&ga_hid=511514683&fws=4&ohw=1600 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash 7aa35bc1f7592ded361361e41622701c7ca7126b0cdbc623e8cd260f8d99048b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 06:47:33 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 11508 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe google-creative-id -1 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-expose-headers x-google-amp-ad-validated-version cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame 6BC6	0 0	33ms 32ms	Image text/html	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CnPqQA8RxXq2LLYrNgAeumreoB-uS9sVbhNezoqcHpOfy7ZUCEAEg2tfFOWC56L6A1AGgAa394P0DyAEBqQLvf77263qyPuACAKgDAaoEtAJP0E_zDj71dzZz3w_JKIpOJUlY9s64CzfFQs5cbdY7mOqY-8bJiWjF0CUbdQmUTvwNU6sJuZ4C68aVw_oQElELyaMpm0PQdcZS5fCjZl1A5LlrpvUcLobDB0-8YSSWIU9xIsYcZ2ReVVlxajTNzhMVf5wAsAkECgSuXC8kf9Hep3VIWGiYs1WAwkf69wFmlyQq07iYZxnqZcjfHkSgvw72dIX3zbz-DYHSX4we7Na_tX-0z9qYPG-W297mmnnvGQa2i3taUbdZrdjK0J4_t1RvQ_kPwoWI3jl81vQpZDFX9xTSQ1O8c0tfOnsBkwKWc4v_0Beck_dTeIdKJM9JMID3E41J8qFaichibn508835MGDz2NEy6wUfQoj8OAu5E7BHNYOUXuoxvJl-vaIjCozA7rHsLMAEs4nC79gB4AQBgAe7gp8CqAeOzhuoB9XJG6gHk9gbqAef2xuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RvYBwHyBwQQnP4C0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi0xNzQyMjQ5NjAzMjg5MDgzgAoDyAsB2BMDiBQC&sigh=j8bXw9fmG4s&vt=1 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	activeview pagead2.googlesyndication.com/pcs/ Frame 6BC6	42 B 110 B	39ms 38ms	Image image/gif	2a00:1450:4001:818::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuvLuMv1FLLejaBY0lu4tdn990Ww4xa0bheaspJkym6dQEG47Jz7arikDb5hm7LWB4VT9RiyksD-w1rRt2_7rYZ3Mes4-LVsWPz2-zSdiCdnZt9k4QPMaS5xtjeJw&sai=AMfl-YQeJFmDcPOoK2Ah8PFBtMr0OAFDV32ga3pxKGmOlrHR4B3ic33LXwM1MCQMnT6-2UNmMH3gEcRft52tw8d4ksf0zge8W3uSD8TqSAsSh9qetKH0IFEV1Hi2vuA&sig=Cg0ArKJSzM2YOZK8L-wCEAE&cid=CAASF-RoI31e3YIV9K5_SVMMxzEoKk758vVC&id=ampim&o=436,146&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1013&mtos=0,0,1013,1013,1013&tos=0,0,1013,0,0&tfs=160&tls=1173&g=100&h=100&tt=1173&r=v&adk=960084856&avms=ampa Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:33 GMT x-content-type-options nosniff content-type image/gif server cafe access-control-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, must-revalidate timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	tag Show response slckg-phfiv.ads.tremorhub.com/ad/ Frame E6FA	119 B 462 B	185ms 185ms	XHR text/xml	2600:1f18:612b:4200:d055:51f2:df44:ebc AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://slckg-phfiv.ads.tremorhub.com/ad/tag?adCode=slckg-wc2tk&playerWidth=834&playerHeight=470&playerPosition=1&mediaTitle=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&mediaDesc=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&mediaId=639404&mediaUrl=&srcPageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&contentLength=30&gdpr=1&gdpr_consent=&schain=1.0,1!connatix.com,102734,1,,,, Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:1f18:612b:4200:d055:51f2:df44:ebc Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Apache-Coyote/1.1 / Resource Hash 5616a6e1823b43919f7d1a33817cccfa1d9f30c9f10f2deb00d9c3671f91d5f0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:33 GMT content-encoding gzip server Apache-Coyote/1.1 status 200 vary accept-encoding p3p CP='This is not a P3P policy. See https://telaria.com/privacy-policy/' access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true x-tremorvideo-status NO_AD content-type text/xml;charset=UTF-8
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003031842100/ Frame 5344	200 KB 55 KB	8ms 6ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 41017 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55795 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a96964b23e387b31" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:56 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003031842100/ Frame 5344	200 KB 55 KB	7ms 5ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 41017 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55795 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a96964b23e387b31" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:56 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 5344	16 KB 6 KB	11ms 9ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-ad-exit-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 43ed58a47eaa7134ec3300ded45afc01af073084130eb90beeb389da9814deec Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 44718 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5727 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 18:22:15 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "73b8fa958135ca02" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 18:22:15 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 5344	92 KB 28 KB	8ms 7ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-analytics-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eaad8e5b3abc10a8518e1f8dae5ecea96dc45db3c7461113c9b5f06902e0c50a Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 41018 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 28323 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:55 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "c55fc50a3cb141e2" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:55 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 5344	3 KB 1 KB	12ms 10ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-fit-text-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6b3f9cc6b1e1cd02649447c72d77f9cef2fc81cfdea5b47a20f507eed6483a31 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 44723 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1392 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 18:22:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "d4f783c5765ebbae" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 18:22:10 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 5344	46 KB 15 KB	11ms 9ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-form-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8ad1368b0463703245ec260353fb66da9b8bef31a2468f8392c8eeea6a55cdda Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 40901 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 14845 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:25:52 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "688737a9eb3f24de" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:25:52 GMT
GET H2	200	css fonts.googleapis.com/ Frame 5344	5 KB 776 B	16ms 15ms	Stylesheet text/css	2a00:1450:4001:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 x-xss-protection 0 last-modified Wed, 18 Mar 2020 06:47:33 GMT server ESF date Wed, 18 Mar 2020 06:47:33 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 18 Mar 2020 06:47:33 GMT
GET H2	200	css fonts.googleapis.com/ Frame 5344	5 KB 730 B	16ms 16ms	Stylesheet text/css	2a00:1450:4001:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&text= Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 x-xss-protection 0 last-modified Wed, 18 Mar 2020 06:47:33 GMT server ESF date Wed, 18 Mar 2020 06:47:33 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 18 Mar 2020 06:47:33 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 5344	2 KB 3 KB	6ms 6ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 23:33:48 GMT x-content-type-options nosniff content-type image/png server cafe age 26025 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Wed, 18 Mar 2020 23:33:48 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 5344	295 B 368 B	6ms 6ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 21:53:20 GMT x-content-type-options nosniff content-type image/png server cafe age 32053 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Wed, 18 Mar 2020 21:53:20 GMT
GET DATA	200 OK	truncated / Frame 5344	213 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 61cf1492deb8c37577ec617d4bd1f87f2fd018e89b6b3684f16b7d56701d348c Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	5456563843432075399 tpc.googlesyndication.com/daca_images/simgad/ Frame 5344	42 KB 43 KB	15ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/daca_images/simgad/5456563843432075399?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoI2gMQ-AEYASABLQAAAD8w2gM4-AFFAACAPw&rs=AOga4qlR6w6UmV4UOADHDiLgwsu9H416uQ Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b65c9a0b331a69b1f859a5ac23e5a83180867d12dda9ebf1e0290dbd701034c0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 13:03:00 GMT x-content-type-options nosniff last-modified Tue, 09 Jan 2018 19:11:13 GMT server sffe age 63873 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=604800 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 43402 x-xss-protection 0 expires Tue, 24 Mar 2020 13:03:00 GMT
GET H2	200	8876284802763518016 tpc.googlesyndication.com/daca_images/simgad/ Frame 5344	14 KB 14 KB	14ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/daca_images/simgad/8876284802763518016?sqp=4sqPyQR5QncIABIUDc3MzD4VAAAAQB0AAAAAJQAAAAAYACIKDQAAgD8VAACAPypPCFoQAR0AALRCIAEoATAGOANAgMLXL0gAUABYAGBacAJ4AIABAIgBAJABAJ0BAACAP6ABAKgBALABgK3iBLgB____________AcUBLbKdPg&rs=AOga4qk9i9oM_eIVbXD5ecfvavZfN-ZbRg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 39c8f023209074b67900cb411311fd7c77c4195bf5e08974c2d988d14c69ca49 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 12 Mar 2020 05:29:19 GMT x-content-type-options nosniff last-modified Sat, 25 Nov 2017 00:04:46 GMT server sffe age 523094 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=604800 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 14107 x-xss-protection 0 expires Thu, 19 Mar 2020 05:29:19 GMT
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame 5344	0 0	40ms 33ms	Image text/html	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CkFItBcRxXr7VFdbUgAem3JLoDq2cqrRWncb16bkGt_zz_QgQASDa18U5YLnovoDUAaAB1oCM_gPIAQbgAgCoAwHIAwqqBMYCT9DY2v0qkxRUnWU8kYs-wg0EpCyBI7Z4RaxuJso1HOQiWiaeL-4WkHjjYxORtSvn3SCSe2zNKSfews8AEwHjcyaJJqLeMwnwn3zIgGm-JjfnvmVPfg81y2nl-v8bhnGhEsPNaEcOI4i8an4em90fPuOYKjKeYojb-EwAS9B2UlC7QbdM40fErH_LTgKv9QdFbZGXNbufNYXiD4gb-DNHWgzmCymEuip6KipOUhiQDjnn9I_37caubSwLqoJFkdmF9Unjx4CSGXwNV5x6qp2Y2jrjlo7QRZWJPmhmzOpRhJCKH8Q9-2IO48RP1ePO7MKePf2HkCDG8JQKktXeK3xt9aMjgXDi0_jRUD7LdGc7l9VxRl62PAHE5d2ZFQMptx2uvFUfKC4_ZvU3aIBq8OLlwadt11rG8AoLzV8cB1LCbzV2kmDQNq7ABMrt8fnHAeAEAZIFBAgEGAGSBQQIBRgEoAY3gAeS__MBqAeOzhuoB9XJG6gHk9gbqAef2xuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RvYBwHyBwQQiP0C0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi0xNzQyMjQ5NjAzMjg5MDgzgAoDyAsB2BMCiBQB&sigh=4XmnmDqlh30&template_id=492&tpd=AGWhJmsWKZOMI8lKgoStJa4EDfnizkUkrkjmilDE9UQ_bjQZjw Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/ Frame 5344	11 KB 11 KB	6ms 5ms	Font font/woff2	2a00:1450:4001:815::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 08:47:06 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 1720827 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11016 x-xss-protection 0 expires Fri, 26 Feb 2021 08:47:06 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/ Frame 5344	11 KB 11 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:815::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:12:39 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 1136094 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11056 x-xss-protection 0 expires Fri, 05 Mar 2021 03:12:39 GMT
GET H2	200	tag Show response slckg-phfiv.ads.tremorhub.com/ad/ Frame E6FA	119 B 462 B	173ms 173ms	XHR text/xml	2600:1f18:612b:4200:d055:51f2:df44:ebc AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://slckg-phfiv.ads.tremorhub.com/ad/tag?adCode=slckg-bwjaw&playerWidth=834&playerHeight=470&playerPosition=1&mediaTitle=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&mediaDesc=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&mediaId=639404&mediaUrl=&srcPageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&contentLength=30&gdpr=1&gdpr_consent=&schain=1.0,1!connatix.com,102734,1,,,, Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:1f18:612b:4200:d055:51f2:df44:ebc Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Apache-Coyote/1.1 / Resource Hash 5616a6e1823b43919f7d1a33817cccfa1d9f30c9f10f2deb00d9c3671f91d5f0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:33 GMT content-encoding gzip server Apache-Coyote/1.1 status 200 vary accept-encoding p3p CP='This is not a P3P policy. See https://telaria.com/privacy-policy/' access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true x-tremorvideo-status NO_AD content-type text/xml;charset=UTF-8
GET H2	200	5456563843432075399 tpc.googlesyndication.com/daca_images/simgad/ Frame 5344	42 KB 42 KB	6ms 6ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/daca_images/simgad/5456563843432075399?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoI2gMQ-AEYASABLQAAAD8w2gM4-AFFAACAPw&rs=AOga4qlR6w6UmV4UOADHDiLgwsu9H416uQ Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b65c9a0b331a69b1f859a5ac23e5a83180867d12dda9ebf1e0290dbd701034c0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 13:03:00 GMT x-content-type-options nosniff last-modified Tue, 09 Jan 2018 19:11:13 GMT server sffe age 63873 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=604800 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 43402 x-xss-protection 0 expires Tue, 24 Mar 2020 13:03:00 GMT
GET H2	200	8876284802763518016 tpc.googlesyndication.com/daca_images/simgad/ Frame 5344	14 KB 14 KB	8ms 8ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/daca_images/simgad/8876284802763518016?sqp=4sqPyQR5QncIABIUDc3MzD4VAAAAQB0AAAAAJQAAAAAYACIKDQAAgD8VAACAPypPCFoQAR0AALRCIAEoATAGOANAgMLXL0gAUABYAGBacAJ4AIABAIgBAJABAJ0BAACAP6ABAKgBALABgK3iBLgB____________AcUBLbKdPg&rs=AOga4qk9i9oM_eIVbXD5ecfvavZfN-ZbRg Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 39c8f023209074b67900cb411311fd7c77c4195bf5e08974c2d988d14c69ca49 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 12 Mar 2020 05:29:19 GMT x-content-type-options nosniff last-modified Sat, 25 Nov 2017 00:04:46 GMT server sffe age 523094 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=604800 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 14107 x-xss-protection 0 expires Thu, 19 Mar 2020 05:29:19 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 5344	2 KB 3 KB	8ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 23:33:48 GMT x-content-type-options nosniff content-type image/png server cafe age 26025 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Wed, 18 Mar 2020 23:33:48 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 5344	295 B 363 B	7ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 21:53:20 GMT x-content-type-options nosniff content-type image/png server cafe age 32053 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Wed, 18 Mar 2020 21:53:20 GMT
GET H/1.1	200 OK	514171 Show response vid.springserve.com/vast/ Frame E6FA	2 KB 2 KB	152ms 39ms	XHR application/xml	34.250.114.134 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain= Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.250.114.134 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-250-114-134.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash f81b8c9fe7a4cb3a2aee38875f090afc018160fd6dbf47c03bb52a3a7e803c39 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 18 Mar 2020 06:47:34 GMT Content-Encoding gzip Server nginx Content-Type application/xml;charset=UTF-8 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Length 901
GET H2	200	vpaid_029b7bdf.js Show response vpaid.springserve.com/production/ Frame EB83	448 KB 98 KB	133ms 42ms	Script application/javascript	69.16.175.42 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://vpaid.springserve.com/production/vpaid_029b7bdf.js Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 69.16.175.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US), Reverse DNS hwcdn.net Software AmazonS3 / Resource Hash 015bfce79477b14313fe8b5cfb94c2786af83ec5be508e134973d6203eb439a8 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:34 GMT content-encoding gzip last-modified Tue, 10 Mar 2020 16:23:34 GMT server AmazonS3 x-amz-request-id 8DEF5E227B8BBD32 etag "14a7eef185ed247664c008dbbb503421" x-hw 1584514054.dop011.wa1.t,1584514054.cds010.wa1.hn,1584514054.cds009.wa1.c content-type application/javascript status 200 cache-control max-age=1973200 accept-ranges bytes access-control-allow-origin * content-length 100182 x-amz-id-2 6AblH8nkVE+rqM9XZVfCsSPhEB1dFdTc36wTGyyPGwoX4hk9reFspz8cYoTJN0036G3+olv/6p4=
POST H/1.1	200 OK	c Show response c.pub.network/	0 267 B	125ms 125ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Wed, 18 Mar 2020 06:47:34 GMT Access-Control-Allow-Credentials true Content-Length 0 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers
GET H2	200	oath-viewability-sdk.js Show response cdn-ssl.vidible.tv/prod/client-utils/js/ Frame EB83	29 KB 8 KB	74ms 18ms	Script application/javascript	2a00:1288:f03d:1fa::4000 YAHOO-1
General Check archive.org Show headers Download Go to Full URL https://cdn-ssl.vidible.tv/prod/client-utils/js/oath-viewability-sdk.js Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_029b7bdf.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US), Reverse DNS Software ATS / Resource Hash ee927c0f8febd54d8dc95a7f74b6aafc749477b15872f5b303162dc477269e34 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers ats-carp-promotion 1 date Thu, 05 Mar 2020 23:55:23 GMT content-encoding gzip x-content-type-options nosniff age 1061532 status 200 strict-transport-security max-age=15552000 content-length 7868 x-amz-id-2 UnqWFxx8IFZcKqzfIjsxjbL/TX7z4PirDYPJh14tLtxdanOtlPCpXw6i91XCr8oeWA1FSzOv2/M= referrer-policy no-referrer-when-downgrade last-modified Tue, 23 Jan 2018 04:39:44 GMT server ATS etag "f89c71522a28b573b7e8c681892779ce-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Accept-Encoding access-control-allow-methods GET x-amz-request-id A8CD411BD43C2B41 access-control-allow-origin * x-xss-protection 1; mode=block cache-control max-age=1209600 x-amz-version-id MuMCHfak_fz.RiQjb8ttinJCtw0a9HGU accept-ranges bytes content-type application/javascript
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame EB83	160 B 1017 B	21ms 21ms	XHR application/json	185.33.223.209 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_029b7bdf.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.209 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 314.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 5f9c83e7793f021be851b9a22b509eab097703652fe6fe1ba27f5f8b1c8429d5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 06:47:36 GMT X-Proxy-Origin 82.102.19.132; 82.102.19.132; 314.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.235:80 AN-X-Request-Uuid 82866f48-584f-4130-bb61-ff8219fd3850 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame EB83	160 B 1017 B	18ms 18ms	XHR application/json	185.33.223.209 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_029b7bdf.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.209 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 314.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash f226534b2e09bc1089016b6fb9b1205cbec02b1dc25441aa413b0328cbdf9c8f Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 06:47:36 GMT X-Proxy-Origin 82.102.19.132; 82.102.19.132; 314.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.155:80 AN-X-Request-Uuid 21a5905d-eede-41a5-a809-6e80482dfbc7 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H/1.1	404 Not Found	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/ Frame EB83	678 B 878 B	13ms 13ms	XHR text/plain	2a02:fa8:8806:12::1430 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_029b7bdf.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:fa8:8806:12::1430 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash d3a970101d5c1c13fe97539903a8285d524c87295f551421ab9e40d9c1324e4a Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Wed, 18 Mar 2020 06:47:34 GMT Cache-Control max-age=0, no-store Server nginx Connection keep-alive Content-Length 678 Content-Type text/plain; charset=UTF-8
GET H/1.1	200 OK	trinity.json Show response apex.go.sonobi.com/ Frame EB83	44 B 671 B	113ms 56ms	XHR application/json	178.162.133.150 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Full URL https://apex.go.sonobi.com/trinity.json?key_maker={%221a0051ae%22:%225923ef4d1eab65890133|640x480|f=4%22}&ref=https%3A%2F%2Fbleepingcomputer.com%2F&s=1a0051ae-d301-4c94-aed0-447115a9a810&pv=1a0051ae-d301-4c94-aed0-447115a9a810&vp=tablet&lib_name=prebid&lib_v=pbjs_lite_v1.25.0&us=0 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_029b7bdf.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS ams-1-apex.go.sonobi.com Software sonobi-go / Resource Hash 1e9f9feaea102529d2c730b4b69ba88e93782828cbf2b1ba8e359248124095f3 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 06:47:34 GMT Content-Encoding gzip Server sonobi-go Vary negotiate,Accept-Encoding X-Go-Server apex-ams-1-6-129 P3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, private Access-Control-Allow-Credentials true Tcn Choice Content-Type application/json Content-Length 72 X-Xss-Protection 0 Expires Sat, 26 Jul 1997 05:00:00 GMT
GET H/1.1	200 OK	bc2 Show response bc-rtb-dub.springserve.com/ Frame EB83	20 B 320 B	246ms 112ms	XHR application/json	52.18.86.70 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bc-rtb-dub.springserve.com/bc2?r=1a0051ae-d301-4c94-aed0-447115a9a810-s.514171-d.528021-dc.73340&aid=962&det_d=www.bleepingcomputer.com&det_w=834 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_029b7bdf.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.18.86.70 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-18-86-70.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash b6bdeec47f3b08de017d399bca661bc9c08745f752079597a7e9f3abcf749dad Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Wed, 18 Mar 2020 06:47:34 GMT Server nginx Access-Control-Allow-Methods GET, POST, OPTIONS Content-Type application/json Access-Control-Allow-Origin https://www.bleepingcomputer.com Access-Control-Allow-Credentials true Connection keep-alive Content-Length 20
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	40 KB 10 KB	375ms 375ms	XHR text/plain	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1724307350463099&correlator=3999338060914392&output=ldjh&impl=fifs&adsid=NT&eid=21065710%2C21065443&vrg=2020030501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200318&iu_parts=15184186%2Cbleepingcomputer_300x250_300x600_160x600_Right_1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C300x600&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie=ID%3D5fcbd8c32f8d73a3%3AT%3D1584514051%3AS%3DALNI_MbPBU6LPaNx5pMyhvlwlv_VyWEUNQ&cookie_enabled=1&bc=31&abxe=1&lmt=1584287085&dt=1584514054452&dlt=1584514049209&idt=705&frm=20&biw=1600&bih=1200&oid=3&adxs=1082&adys=327&adks=771041174&ucis=9&ifi=4&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&dssz=55&icsg=571746222612480&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=306x250&msz=306x250&psts=ABP-KfQVRdntN77wdI_DRhD4Cf5lU09FXpyY-6nibgccbwXgvFWXC48Zvfm_-8EGP7ayVFK7Fewh0B6tBxp1&ga_vid=2079321426.1584514050&ga_sid=1584514050&ga_hid=511514683&fws=4&ohw=1600 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash 6cc3f964c1a96d8f482d94755388b183e0373ebd0f5abe441ae2c1afa0dc1ef5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 06:47:34 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 10214 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe google-creative-id -1 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-expose-headers x-google-amp-ad-validated-version cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
POST H/1.1	200 OK	i Show response vid-io.springserve.com/vd/ Frame EB83	0 217 B	153ms 38ms	XHR text/plain	34.248.21.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid-io.springserve.com/vd/i?suuid=1a0051ae&ps_id=514171&batch=1 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_029b7bdf.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.248.21.38 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-248-21-38.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Wed, 18 Mar 2020 06:47:34 GMT Access-Control-Allow-Credentials true Server nginx Connection keep-alive Content-Length 0
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003031842100/ Frame E4D1	200 KB 55 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 41018 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55795 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a96964b23e387b31" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:56 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003031842100/ Frame E4D1	200 KB 55 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 41018 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55795 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a96964b23e387b31" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:56 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame E4D1	16 KB 6 KB	14ms 13ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-ad-exit-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 43ed58a47eaa7134ec3300ded45afc01af073084130eb90beeb389da9814deec Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 44719 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5727 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 18:22:15 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "73b8fa958135ca02" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 18:22:15 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame E4D1	92 KB 28 KB	13ms 12ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-analytics-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eaad8e5b3abc10a8518e1f8dae5ecea96dc45db3c7461113c9b5f06902e0c50a Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 41019 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 28323 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:55 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "c55fc50a3cb141e2" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:55 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame E4D1	3 KB 1 KB	11ms 10ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-fit-text-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6b3f9cc6b1e1cd02649447c72d77f9cef2fc81cfdea5b47a20f507eed6483a31 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 44724 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1392 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 18:22:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "d4f783c5765ebbae" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 18:22:10 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame E4D1	46 KB 15 KB	9ms 9ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-form-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8ad1368b0463703245ec260353fb66da9b8bef31a2468f8392c8eeea6a55cdda Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 40902 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 14845 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:25:52 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "688737a9eb3f24de" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:25:52 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame E4D1	2 KB 3 KB	7ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 23:33:48 GMT x-content-type-options nosniff content-type image/png server cafe age 26026 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Wed, 18 Mar 2020 23:33:48 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame E4D1	295 B 368 B	7ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 21:53:20 GMT x-content-type-options nosniff content-type image/png server cafe age 32054 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Wed, 18 Mar 2020 21:53:20 GMT
GET DATA	200 OK	truncated / Frame E4D1	216 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d28dfa60ebe103fff85ee55266c271e5ab3a9d55339c50857f7acb4b78682f6f Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	13721723812632313485 tpc.googlesyndication.com/simgad/ Frame E4D1	67 KB 67 KB	10ms 9ms	Image image/gif	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/13721723812632313485 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0f9a0a1e156f835a74a70bf8e11d739e19fe84afc1553a201882b7f0705f39a9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 04:31:00 GMT x-content-type-options nosniff age 1044994 x-dns-prefetch-control off status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 68538 x-xss-protection 0 last-modified Thu, 05 Apr 2018 11:07:28 GMT server sffe content-type image/gif access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 04:31:00 GMT
GET H2	204	l www.google.com/ads/measurement/ Frame E4D1	0 0	16ms 15ms	Image text/html	2a00:1450:4001:824::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaTlTnq-7WUC8kijONVW7NAIF8D6Oh6w2TcvgTLXSlFjMzp0udyHvz5svMinh5nqZTxb18XonGdGw-YqBpYnz8yucxF_4Q Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame E4D1	0 0	33ms 33ms	Image text/html	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CWJYmBsRxXsuzHtCE-gbr54XoB-vahLRNoMXAsZgJivz8ytkNEAEgx4P8AWC56L6A1AGgAauQ8-wDyAED4AIAqAMByAMIqgTHAk_QGdCihge5EJYZXOy1yNB1L5qm4oeSE6C4vNMbZggBx4w-VjWDj9KPmHAjb6amsgGQTrOM2DqfWesLOGf4PxgInTAA2Iew81DJpf1F_B-eV4WP3dZfnXDgP-T9YWkrN2aMEVaAJ8WZdD9iKysQarix3atMMR797lPBnVGKw57tsUlJskWMhQpnth1JJ_1QGjnUhE84yORRCsw6QoxyBTER6gUFHnZGjIiounxvdkd9XtpE2SVhh_2u78XDXlzCZOVEeAYcdbRNvkDg7_H_oPCCJScGojvPbXy2bQoxQ8nIFDOnYPZoGKawPN-qYsJ6l0O4yMtjuoS_jh9-Y-VAWZCOqmTBpKA-Np2pZtCUOwMmRSDvkMCmnZyKnR8vnFaTHJ8yn4103EfVXqbxYbbvkpM0vb555dIgjWcxaU4XKasjfuEyVY17p8AE_8eZtkjgBAGSBQQIBBgBkgUECAUYBKAGA4AHve-ME6gHjs4bqAfVyRuoB5PYG6gHn9sbqAe6BqgH8NkbqAfy2RuoB6a-G6gH7NUb2AcB8gcEEJSrCNIICQiA4YAQEAEYHYAKAcgLAdgTAg&sigh=u5gra6UahBA&tpd=AGWhJmt1s0b0ROn6VL5bsV454dgVdYBnoEPEshYx4otq-EgDCA Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	13721723812632313485 tpc.googlesyndication.com/simgad/ Frame E4D1	67 KB 67 KB	6ms 6ms	Image image/gif	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/13721723812632313485 Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0f9a0a1e156f835a74a70bf8e11d739e19fe84afc1553a201882b7f0705f39a9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 04:31:00 GMT x-content-type-options nosniff age 1044994 x-dns-prefetch-control off status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 68538 x-xss-protection 0 last-modified Thu, 05 Apr 2018 11:07:28 GMT server sffe content-type image/gif access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 04:31:00 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame E4D1	2 KB 3 KB	8ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 23:33:48 GMT x-content-type-options nosniff content-type image/png server cafe age 26026 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Wed, 18 Mar 2020 23:33:48 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame E4D1	295 B 363 B	7ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 21:53:20 GMT x-content-type-options nosniff content-type image/png server cafe age 32054 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Wed, 18 Mar 2020 21:53:20 GMT
POST H/1.1	200 OK	c Show response c.pub.network/	0 267 B	118ms 118ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Wed, 18 Mar 2020 06:47:35 GMT Access-Control-Allow-Credentials true Content-Length 0 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers
GET H2	200	activeview pagead2.googlesyndication.com/pcs/ Frame E4D1	42 B 110 B	42ms 42ms	Image image/gif	2a00:1450:4001:818::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvhCHkEmRHvcFkYvmIjUXOweQviNAH335VDocOaMtxEu4EcjR4gUceby2omdOBzb4Lso4gFPhp9R-1stQjEoW1QayXTjJMhrYSZLQvPGYPEmwoF0XZkEPPQAYrCmQ&sai=AMfl-YR2sCoTRf3toEIhQBc_-EInX1lhdkw2D1GVEendAZsJOZ1Jcbkn1T5CTcBJTWbCtU9EsCYzTjrNqAB55lsCc-d84uCoXxCliPYksV__nn_u5O808q6b_Dr2Iqw&sig=Cg0ArKJSzBrFxKc16cDlEAE&cid=CAASF-RoiNIA4UeJpclYNr7f7mbRRDwiUT9c&id=ampim&o=1082,327&d=300,250&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&tfs=106&tls=1107&g=100&h=100&tt=1107&r=v&adk=771041174&avms=ampa Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:36 GMT x-content-type-options nosniff content-type image/gif server cafe access-control-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, must-revalidate timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	tracking.png trk.connatix.com/ Frame E6FA	0 162 B	108ms 107ms	Image text/plain	3.213.93.144 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://trk.connatix.com/tracking.png?c_rpobidMeta=[{id:15447,c_wt:747,c_mt:%22application%2Fjavascript%22,c_rs:%222_%2522NO_FILL%2522_undefined%22}]&cb=e82c9c7500cb976ba55e1584514056043&c_pl=VPtY1rbzjEPj0Hg3IbKX0zOzZU8SxsJoXU_ZBX2fefl_YMv4OhWQC60qz7BgSFGi-3dQpDF6TR0IRy3ssYuMZuA1kkOqOxQlJLV_zj4hDx-l3gS-6NCaBurp2fcathknHyeuTxThoisXqC1tBgFDc1Yhd6cV4wTopTVxTaVnlBD7Myt5lIr1Yi3-yfUjkpsPjsoza6fO_l0J7OR7y05LexbXI9KUUE8RBWole5QtDdGuooIaiBJaZwmmCtWXBM1ODM2B8peg_D3zTuJzA_gXAg&c_v=1911_1_0_0_0&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-c&xplt=false&spp=1 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.93.144 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-93-144.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Access-Control-Allow-Origin * Date Wed, 18 Mar 2020 06:47:36 GMT Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 0
GET H/1.1	200 OK	async_usersync.html acdn.adnxs.com/ib/static/usersync/v3/ Frame 2A1E	0 0	69ms 23ms	Document text/html	151.101.13.108 FASTLY
General Check archive.org Show headers Download Go to Full URL https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software nginx/1.9.13 / Resource Hash Request headers Host acdn.adnxs.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Response headers Server nginx/1.9.13 Content-Type text/html Last-Modified Fri, 20 May 2016 02:07:09 GMT ETag W/"573e714d-3e3" Expires Sun, 06 Aug 2017 09:41:59 GMT Cache-Control max-age=31536000 Access-Control-Allow-Origin * Content-Encoding gzip Via 1.1 varnish 1.1 varnish Content-Length 506 Accept-Ranges bytes Date Wed, 18 Mar 2020 06:47:38 GMT Age 19429543 Connection keep-alive X-Served-By cache-jfk8138-JFK, cache-fra19133-FRA X-Cache HIT, HIT X-Cache-Hits 391291, 1276198 X-Timer S1584514059.650481,VS0,VE0 Vary Accept-Encoding
GET H/1.1	200 OK	async_usersync.html acdn.adnxs.com/ib/static/usersync/v3/ Frame 3A17	0 0	67ms 22ms	Document text/html	151.101.13.108 FASTLY
General Check archive.org Show headers Download Go to Full URL https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software nginx/1.9.13 / Resource Hash Request headers Host acdn.adnxs.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Response headers Server nginx/1.9.13 Content-Type text/html Last-Modified Fri, 20 May 2016 02:07:09 GMT ETag W/"573e714d-3e3" Expires Sun, 06 Aug 2017 09:41:59 GMT Cache-Control max-age=31536000 Access-Control-Allow-Origin * Content-Encoding gzip Via 1.1 varnish 1.1 varnish Content-Length 506 Accept-Ranges bytes Date Wed, 18 Mar 2020 06:47:38 GMT Age 19429543 Connection keep-alive X-Served-By cache-jfk8138-JFK, cache-fra19130-FRA X-Cache HIT, HIT X-Cache-Hits 391291, 1132511 X-Timer S1584514059.650607,VS0,VE0 Vary Accept-Encoding
GET H/1.1	200 OK	usync.html eus.rubiconproject.com/ Frame 590D	0 0	73ms 24ms	Document text/html	23.37.55.184 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://eus.rubiconproject.com/usync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-37-55-184.deploy.static.akamaitechnologies.com Software Apache/2.2.15 (CentOS) / PHP/5.3.3 Resource Hash Request headers Host eus.rubiconproject.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Response headers Server Apache/2.2.15 (CentOS) X-Powered-By PHP/5.3.3 p3p CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT" Last-Modified Wed, 04 Mar 2020 22:48:14 GMT Content-Encoding gzip Content-Length 7619 Content-Type text/html; charset=UTF-8 Cache-Control max-age=69406 Expires Thu, 19 Mar 2020 02:04:24 GMT Date Wed, 18 Mar 2020 06:47:38 GMT Connection keep-alive Vary Accept-Encoding
GET H2	200	index.html cdn.districtm.io/ids/ Frame C932	0 0	132ms 131ms	Document text/html	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.districtm.io/ids/index.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers :method GET :authority cdn.districtm.io :scheme https :path /ids/index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Response headers status 200 date Wed, 18 Mar 2020 06:47:38 GMT content-type text/html set-cookie __cfduid=dbfc6163d198198ace52f3ef1123bbb271584514058; expires=Fri, 17-Apr-20 06:47:38 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax cf-ray 575d00e249647257-AMS cache-control s-maxage=1209600, max-age=14400 last-modified Thu, 10 Jan 2019 16:50:48 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding server cloudflare content-encoding br
GET H2	200	sync eb2.3lift.com/ Frame 428A Redirect Chain https://eb2.3lift.com/sync? https://eb2.3lift.com/sync?&ld=1	0 0	31ms 21ms	Document text/html	35.157.121.171 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eb2.3lift.com/sync?&ld=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.121.171 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-121-171.eu-central-1.compute.amazonaws.com Software / Resource Hash Request headers :method GET :authority eb2.3lift.com :scheme https :path /sync?&ld=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ accept-encoding gzip, deflate, br accept-language en-US cookie tluid=4982662721799276398 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Response headers status 200 date Wed, 18 Mar 2020 06:47:38 GMT content-type text/html; charset=utf-8 content-length 493 set-cookie sync=CgoIgQIQvJOX444uCgoI4gEQvJOX444uCgoI5gEQvJOX444uCgkICRC8k5fjji4KCgipARC8k5fjji4KCQg5ELyTl-OOLgoJCDoQvJOX444uCgkICxC8k5fjji4KCgjOARC8k5fjji4KCQgfELyTl-OOLg==; Max-Age=7776000; Expires=Tue, 16 Jun 2020 06:47:38 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=4982662721799276398; Max-Age=7776000; Expires=Tue, 16 Jun 2020 06:47:38 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure content-encoding gzip p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" cache-control no-cache, no-store, must-revalidate Redirect headers status 302 date Wed, 18 Mar 2020 06:47:38 GMT content-length 0 set-cookie tluid=234547259826715739; Max-Age=7776000; Expires=Tue, 16 Jun 2020 06:47:38 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure location /sync?&ld=1 cache-control no-cache, no-store, must-revalidate p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H2	200	pd eu-u.openx.net/w/1.0/ Frame 173B Redirect Chain https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1	0 0	28ms 28ms	Document text/html	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.179.0 / Resource Hash Request headers :method GET :authority eu-u.openx.net :scheme https :path /w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ accept-encoding gzip, deflate, br accept-language en-US cookie i=83fb1adf-64f6-0097-346b-71633355da8e|1584514058 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Response headers status 200 vary Accept, Accept-Encoding set-cookie i=83fb1adf-64f6-0097-346b-71633355da8e|1584514058; Version=1; Expires=Thu, 18-Mar-2021 06:47:38 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1584514058|mOsLgqgikin0fcmWiygu; Version=1; Expires=Thu, 02-Apr-2020 06:47:38 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.179.0 p3p CP="CUR ADM OUR NOR STA NID" date Wed, 18 Mar 2020 06:47:38 GMT content-type text/html content-length 483 content-encoding gzip via 1.1 google alt-svc clear Redirect headers status 302 set-cookie i=83fb1adf-64f6-0097-346b-71633355da8e|1584514058; Version=1; Expires=Thu, 18-Mar-2021 06:47:38 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.179.0 p3p CP="CUR ADM OUR NOR STA NID" location https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 date Wed, 18 Mar 2020 06:47:38 GMT content-length 0 via 1.1 google alt-svc clear
GET H2	200	index.html cdn.districtm.io/ids/ Frame E15C	0 0	112ms 112ms	Document text/html	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.districtm.io/ids/index.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers :method GET :authority cdn.districtm.io :scheme https :path /ids/index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Response headers status 200 date Wed, 18 Mar 2020 06:47:38 GMT content-type text/html set-cookie __cfduid=dbfc6163d198198ace52f3ef1123bbb271584514058; expires=Fri, 17-Apr-20 06:47:38 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax cf-ray 575d00e2496b7257-AMS cache-control s-maxage=1209600, max-age=14400 last-modified Thu, 10 Jan 2019 16:50:48 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding server cloudflare content-encoding br
GET H/1.1	200 OK	async_usersync.html acdn.adnxs.com/ib/static/usersync/v3/ Frame 8E36	0 0	66ms 22ms	Document text/html	151.101.13.108 FASTLY
General Check archive.org Show headers Download Go to Full URL https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software nginx/1.9.13 / Resource Hash Request headers Host acdn.adnxs.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Response headers Server nginx/1.9.13 Content-Type text/html Last-Modified Fri, 20 May 2016 02:07:09 GMT ETag W/"573e714d-3e3" Expires Sun, 06 Aug 2017 09:41:59 GMT Cache-Control max-age=31536000 Access-Control-Allow-Origin * Content-Encoding gzip Via 1.1 varnish 1.1 varnish Content-Length 506 Accept-Ranges bytes Date Wed, 18 Mar 2020 06:47:38 GMT Age 19429543 Connection keep-alive X-Served-By cache-jfk8138-JFK, cache-fra19151-FRA X-Cache HIT, HIT X-Cache-Hits 391291, 2454453 X-Timer S1584514059.655184,VS0,VE0 Vary Accept-Encoding
GET H2	200	sync eb2.3lift.com/ Frame 1DF9 Redirect Chain https://eb2.3lift.com/sync? https://eb2.3lift.com/sync?&ld=1	0 0	31ms 21ms	Document text/html	35.157.121.171 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eb2.3lift.com/sync?&ld=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.121.171 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-121-171.eu-central-1.compute.amazonaws.com Software / Resource Hash Request headers :method GET :authority eb2.3lift.com :scheme https :path /sync?&ld=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ accept-encoding gzip, deflate, br accept-language en-US cookie tluid=4982662721799276398 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Response headers status 200 date Wed, 18 Mar 2020 06:47:38 GMT content-type text/html; charset=utf-8 content-length 493 set-cookie sync=CgoIgQIQvZOX444uCgoI4gEQvZOX444uCgoI5gEQvZOX444uCgkICRC9k5fjji4KCgipARC9k5fjji4KCQg5EL2Tl-OOLgoJCDoQvZOX444uCgkICxC9k5fjji4KCgjOARC9k5fjji4KCQgfEL2Tl-OOLg==; Max-Age=7776000; Expires=Tue, 16 Jun 2020 06:47:38 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=4982662721799276398; Max-Age=7776000; Expires=Tue, 16 Jun 2020 06:47:38 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure content-encoding gzip p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" cache-control no-cache, no-store, must-revalidate Redirect headers status 302 date Wed, 18 Mar 2020 06:47:38 GMT content-length 0 set-cookie tluid=4982662721799276398; Max-Age=7776000; Expires=Tue, 16 Jun 2020 06:47:38 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure location /sync?&ld=1 cache-control no-cache, no-store, must-revalidate p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H2	200	pd eu-u.openx.net/w/1.0/ Frame B26B Redirect Chain https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1	0 0	32ms 32ms	Document text/html	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.179.0 / Resource Hash Request headers :method GET :authority eu-u.openx.net :scheme https :path /w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ accept-encoding gzip, deflate, br accept-language en-US cookie i=5bd18c10-9a61-01eb-37f3-8ea67c3c2c70|1584514058 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Response headers status 200 vary Accept, Accept-Encoding set-cookie i=5bd18c10-9a61-01eb-37f3-8ea67c3c2c70|1584514058; Version=1; Expires=Thu, 18-Mar-2021 06:47:38 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1584514058|mOsLgqgikin0fcmWiygu; Version=1; Expires=Thu, 02-Apr-2020 06:47:38 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.179.0 p3p CP="CUR ADM OUR NOR STA NID" date Wed, 18 Mar 2020 06:47:38 GMT content-type text/html content-length 481 content-encoding gzip via 1.1 google alt-svc clear Redirect headers status 302 set-cookie i=5bd18c10-9a61-01eb-37f3-8ea67c3c2c70|1584514058; Version=1; Expires=Thu, 18-Mar-2021 06:47:38 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.179.0 p3p CP="CUR ADM OUR NOR STA NID" location https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 date Wed, 18 Mar 2020 06:47:38 GMT content-length 0 via 1.1 google alt-svc clear
GET H2	200	sync eb2.3lift.com/ Frame 8554 Redirect Chain https://eb2.3lift.com/sync? https://eb2.3lift.com/sync?&ld=1	0 0	31ms 21ms	Document text/html	35.157.121.171 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eb2.3lift.com/sync?&ld=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.121.171 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-121-171.eu-central-1.compute.amazonaws.com Software / Resource Hash Request headers :method GET :authority eb2.3lift.com :scheme https :path /sync?&ld=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ accept-encoding gzip, deflate, br accept-language en-US cookie tluid=4982662721799276398 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Response headers status 200 date Wed, 18 Mar 2020 06:47:38 GMT content-type text/html; charset=utf-8 content-length 493 set-cookie sync=CgoIgQIQvZOX444uCgoI4gEQvZOX444uCgoI5gEQvZOX444uCgkICRC9k5fjji4KCgipARC9k5fjji4KCQg5EL2Tl-OOLgoJCDoQvZOX444uCgkICxC9k5fjji4KCgjOARC9k5fjji4KCQgfEL2Tl-OOLg==; Max-Age=7776000; Expires=Tue, 16 Jun 2020 06:47:38 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=4982662721799276398; Max-Age=7776000; Expires=Tue, 16 Jun 2020 06:47:38 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure content-encoding gzip p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" cache-control no-cache, no-store, must-revalidate Redirect headers status 302 date Wed, 18 Mar 2020 06:47:38 GMT content-length 0 set-cookie tluid=4879658309976654494; Max-Age=7776000; Expires=Tue, 16 Jun 2020 06:47:38 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure location /sync?&ld=1 cache-control no-cache, no-store, must-revalidate p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H2	200	index.html cdn.districtm.io/ids/ Frame 8DA8	0 0	124ms 124ms	Document text/html	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.districtm.io/ids/index.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers :method GET :authority cdn.districtm.io :scheme https :path /ids/index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Response headers status 200 date Wed, 18 Mar 2020 06:47:38 GMT content-type text/html set-cookie __cfduid=dbfc6163d198198ace52f3ef1123bbb271584514058; expires=Fri, 17-Apr-20 06:47:38 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax cf-ray 575d00e259787257-AMS cache-control s-maxage=1209600, max-age=14400 last-modified Thu, 10 Jan 2019 16:50:48 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding server cloudflare content-encoding br
GET H2	200	pd eu-u.openx.net/w/1.0/ Frame B128 Redirect Chain https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1	0 0	28ms 28ms	Document text/html	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.179.0 / Resource Hash Request headers :method GET :authority eu-u.openx.net :scheme https :path /w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ accept-encoding gzip, deflate, br accept-language en-US cookie i=29f4bc8e-21bb-0e49-1697-03bc255149e3|1584514058 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Response headers status 200 vary Accept, Accept-Encoding set-cookie i=29f4bc8e-21bb-0e49-1697-03bc255149e3|1584514058; Version=1; Expires=Thu, 18-Mar-2021 06:47:38 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1584514058|mOsLgqgikin0fcmWiygu; Version=1; Expires=Thu, 02-Apr-2020 06:47:38 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.179.0 p3p CP="CUR ADM OUR NOR STA NID" date Wed, 18 Mar 2020 06:47:38 GMT content-type text/html content-length 483 content-encoding gzip via 1.1 google alt-svc clear Redirect headers status 302 set-cookie i=29f4bc8e-21bb-0e49-1697-03bc255149e3|1584514058; Version=1; Expires=Thu, 18-Mar-2021 06:47:38 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.179.0 p3p CP="CUR ADM OUR NOR STA NID" location https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 date Wed, 18 Mar 2020 06:47:38 GMT content-length 0 via 1.1 google alt-svc clear
GET H2	200	sodar Show response pagead2.googlesyndication.com/getconfig/	7 KB 5 KB	23ms 23ms	XHR application/json	2a00:1450:4001:818::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200312&st=env Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200312/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 8e48ab292f2b3f0639a3f87a099fb6f0a7ff0c4978c6ea0a2d805bc17560fa4a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers timing-allow-origin * date Wed, 18 Mar 2020 06:47:42 GMT content-encoding gzip x-content-type-options nosniff server cafe status 200 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5251 x-xss-protection 0
POST H/1.1	200 OK	c Show response c.pub.network/	0 267 B	118ms 118ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Wed, 18 Mar 2020 06:47:42 GMT Access-Control-Allow-Credentials true Content-Length 0 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers
GET H2	200	sodar2.js Show response tpc.googlesyndication.com/sodar/	14 KB 5 KB	13ms 13ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200312/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 06:47:42 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1582746470043195" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5456 x-xss-protection 0 expires Wed, 18 Mar 2020 06:47:42 GMT
GET H2	200	runner.html tpc.googlesyndication.com/sodar/sodar2/209/ Frame 8F69	0 0	6ms 5ms	Document text/html	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /sodar/sodar2/209/runner.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ Response headers status 200 accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html content-length 5727 date Wed, 18 Mar 2020 06:22:45 GMT expires Thu, 18 Mar 2021 06:22:45 GMT last-modified Tue, 25 Feb 2020 17:32:01 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 1497 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
GET H2	204	gen_204 pagead2.googlesyndication.com/pagead/	0 58 B	14ms 14ms	Image image/gif	2a00:1450:4001:818::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gda_r20200312&jk=1724307350463099&bg=!dHeld29Ye1RtbClwRK4CAAAAMFIAAAAJmQFkZewfDoqmxtGR1PrQo4zibgsrb1a4siAqRlg-10z68naX1cy-2eqIS3lq7MeEdcnpGkMeF5OeDztTyLQHokoO4mQo9caaxqY90j54Yszy3VDvyTLe-CNVNtYmBUECisM5xERQx2lDPOM6nxkXQgATi9Q2pUmTsQ3om2wW22-ctc62_VZYE-XjXZf-8drNZA-UL6lxLOVwUnfJu7dT8LA4YZRd-WRuMcnUlFOxNjfevey2zAdv5t-OdP8-5H-Mv9H3jX2tlLfy8BRhLGc7j3vs8u7q2IFBReIRS4FRbB39Ys2uVfEsCF79gvzji0c1zFrh1HeshzKQqoTTymW4GwSIKagMh7NAHixw58qBjfUnnyzOdjhcU1264bjYHovw1PJwH99u_38iKeyRL1xAoOmTbSLIbIaKlotemTMFLlSY-4Nb7Qe869JdGC2YvlPHhXe2X80lD1BHmLG-rVMrDPFqInR47FU Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers pragma no-cache date Wed, 18 Mar 2020 06:47:42 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 204 cache-control no-cache, must-revalidate timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	g Show response rtb.connatix.com/	113 B 303 B	249ms 248ms	Script text/plain	52.45.66.51 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://rtb.connatix.com/g?c_pw=834&c_ph=470&c_tk=C018218D-4AD0-4E01-8158-045425E65946&c_bu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&c_ivt=0&connatix_sess=6kv-l3x2CWN2b3Rax5LntgQxfBNXsDB5v2Cco1laq2IWPArQZS2GBOviPB9-UkeIQ2kBBw5WRO5MoCmkS9uFVISvA-a60RutrVuKkLkvuxMU4e9xrKc6nfYeZWjaIYRGB0jNrT0U8n5dmTsIFyVg0DZNP-aIMNnpzMrXqvTHoAELEyXBTMvkpL22Ko1c8ziO&notServed=false&xplr=true&c_s=false&c_pl=VPtY1rbzjEPj0Hg3IbKX0zOzZU8SxsJoXU_ZBX2fefl_YMv4OhWQC60qz7BgSFGi-3dQpDF6TR0IRy3ssYuMZuA1kkOqOxQlJLV_zj4hDx-l3gS-6NCaBurp2fcathknHyeuTxThoisXqC1tBgFDc1Yhd6cV4wTopTVxTaVnlBD7Myt5lIr1Yi3-yfUjkpsPjsoza6fO_l0J7OR7y05LexbXI9KUUE8RBWole5QtDdGuooIaiBJaZwmmCtWXBM1ODM2B8peg_D3zTuJzA_gXAg&gdpr=1&is_ccpa_b=false&med_id=639404&req_no=1&v=1&c_pt=1&c_f=[{id:14547,r:4,i:0,f:3.3},{id:16156,r:1,i:0}]&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-c&c_v=1911_1_0_0_0&spp=1&callback=cnxJSONP_36979887bf9f05a2e4451584514063140 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.45.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-45-66-51.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash 40b22a49299001b8c9746949285bd7da6941b3b917c21533cf9a36f9240f3d6c Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Access-Control-Allow-Origin * Date Wed, 18 Mar 2020 06:47:43 GMT Content-Encoding gzip Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 115
GET H/1.1	200 OK	g Show response rtb.connatix.com/	95 B 299 B	122ms 121ms	Script text/plain	52.45.66.51 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://rtb.connatix.com/g?c_pw=834&c_ph=470&c_tk=C018218D-4AD0-4E01-8158-045425E65946&c_bu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-communication%2F&c_ivt=0&connatix_sess=6kv-l3x2CWN2b3Rax5LntgQxfBNXsDB5v2Cco1laq2IWPArQZS2GBOviPB9-UkeIQ2kBBw5WRO5MoCmkS9uFVISvA-a60RutrVuKkLkvuxMU4e9xrKc6nfYeZWjaIYRGB0jNrT0U8n5dmTsIFyVg0DZNP-aIMNnpzMrXqvTHoAELEyXBTMvkpL22Ko1c8ziO&notServed=false&xplr=true&c_s=false&c_pl=VPtY1rbzjEPj0Hg3IbKX0zOzZU8SxsJoXU_ZBX2fefl_YMv4OhWQC60qz7BgSFGi-3dQpDF6TR0IRy3ssYuMZuA1kkOqOxQlJLV_zj4hDx-l3gS-6NCaBurp2fcathknHyeuTxThoisXqC1tBgFDc1Yhd6cV4wTopTVxTaVnlBD7Myt5lIr1Yi3-yfUjkpsPjsoza6fO_l0J7OR7y05LexbXI9KUUE8RBWole5QtDdGuooIaiBJaZwmmCtWXBM1ODM2B8peg_D3zTuJzA_gXAg&gdpr=1&is_ccpa_b=false&med_id=639404&req_no=2&v=1&c_pt=1&c_f=[{id:14547,r:7,i:0,f:3.3},{id:16156,r:2,i:0}]&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fblackwater-malware-abuses-cloudflare-workers-for-c2-c&c_v=1911_1_0_0_0&spp=1&callback=cnxJSONP_70fcab8a39ba6ed408921584514078170 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.45.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-45-66-51.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash 2ecfd4125ca8302645d4d6d213fc9236773e9a6f21d68cd09d5874f233f1b44a Request headers Referer https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Access-Control-Allow-Origin * Date Wed, 18 Mar 2020 06:47:58 GMT Content-Encoding gzip Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 111

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=uo4nuhxJikFrr3o47oeeZPL5&bidId=93444c031ef0672&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=uo4nuhxJikFrr3o47oeeZPL5&bidId=176b65fd59a943f8&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&