www.zdnet.com Open in urlscan Pro
2a04:4e42:3::444  Public Scan

56 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://t.co/cejlFPR8a9 Page URL
2. https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 59

• https://ad.doubleclick.net/ddm/trackimp/N7384.3861580VIACOMCBS/B24946233.286791742;dc_trk_aid=480369388;dc_trk_cid=140485965;ord=578511284;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua= HTTP 302
• https://ad.doubleclick.net/ddm/trackimp/N7384.3861580VIACOMCBS/B24946233.286791742;dc_pre=CJ69z4esme0CFVztuwgdu7EKxQ;dc_trk_aid=480369388;dc_trk_cid=140485965;ord=578511284;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=

Request Chain 164

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 170

• https://www.cbsileads.com/direct/images/doctype/expertGroup_125x100.jpg HTTP 301
• https://static.cbsileads.com/direct/images/doctype/expertGroup_125x100.jpg

Request Chain 179

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 180

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 272

• https://sb.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1606157802809&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20away%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&c9=https%3A%2F%2Ft.co%2FcejlFPR8a9 HTTP 302
• https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1606157802809&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20away%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&c9=https%3A%2F%2Ft.co%2FcejlFPR8a9&cs_ak_ss=1

Request Chain 273

• https://sb.scorecardresearch.com/b?c1=7&c2=34354936&c3=1&ns__t=1606157802809&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20away%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&c9=https%3A%2F%2Ft.co%2FcejlFPR8a9 HTTP 302
• https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1606157802809&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20away%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&c9=https%3A%2F%2Ft.co%2FcejlFPR8a9&cs_ak_ss=1

283 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
17 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	cejlFPR8a9 t.co/	484 B 426 B	155ms 152ms	Document text/html	104.244.42.5 TWITTER
General Check archive.org Show headers Download Go to Full URL https://t.co/cejlFPR8a9 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.5 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_f / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=0 X-Xss-Protection 0 Request headers :method GET :authority t.co :scheme https :path /cejlFPR8a9 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers cache-control private,max-age=300 content-encoding gzip content-length 236 content-type text/html; charset=utf-8 date Mon, 23 Nov 2020 18:56:32 GMT expires Mon, 23 Nov 2020 19:01:32 GMT server tsa_f set-cookie muc=2b964dc1-62e4-4720-9cf0-fc8b11bfac75; Max-Age=63072000; Expires=Wed, 23 Nov 2022 18:56:32 GMT; Domain=t.co; Secure; SameSite=None strict-transport-security max-age=0 vary Origin x-connection-hash a480d623b5c1236758f715966f4e3269 x-response-time 125 x-xss-protection 0
GET H2	200	Primary Request / Show response www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/	529 KB 148 KB	119ms 119ms	Document text/html	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash d7e73d50cf79d01c44008857e1260b4e7813b7c5d788fa333750a654be9dfa5f Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority www.zdnet.com :scheme https :path /article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://t.co/cejlFPR8a9 accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://t.co/cejlFPR8a9 Response headers content-encoding gzip content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-type text/html; charset=UTF-8 expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" last-modified Mon, 23 Nov 2020 18:21:30 GMT referrer-policy no-referrer-when-downgrade x-content-type-options nosniff x-frame-options SAMEORIGIN x-tx-id cc4101d5-d8a4-4576-8bb7-7c330ce1064a x-xss-protection 1; mode=block date Mon, 23 Nov 2020 18:56:32 GMT cache-control max-age=5400, private expires Mon, 23 Nov 2020 19:51:30 GMT set-cookie fly_geo={"countryCode": "de"}; max-age=604800; path=/; domain=.zdnet.com; Secure; fly_device=desktop; max-age=604800; path=/; domain=.zdnet.com; Secure; fly_preferred_edition=eu; path=/; domain=.zdnet.com; Secure; fly_default_edition=eu; path=/; domain=.zdnet.com; Secure; vary Accept-Encoding, User-Agent strict-transport-security max-age=63072000; includeSubDomains; preload accept-ranges bytes content-length 150675
GET H2	200	main-af19460416-rev.css zdnet3.cbsistatic.com/fly/css/core/	352 KB 58 KB	37ms 36ms	Stylesheet text/css	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet3.cbsistatic.com/fly/css/core/main-af19460416-rev.css Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 52828dfa3529d1c9daeed4a0706834537478c13874b064e7a7671185bed9812f Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:32 GMT content-encoding gzip x-content-type-options nosniff age 33505 vary Accept-Encoding, Accept content-length 59542 x-xss-protection 1; mode=block last-modified Mon, 23 Nov 2020 09:37:09 GMT server ContentServer x-frame-options SAMEORIGIN etag "25db43778e7cc1c634f38ef4cb0318ea" strict-transport-security max-age=31536000 content-type text/css access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 30 Nov 2020 09:38:06 GMT
GET H2	200	controls-6870d3c422-rev.css zdnet2.cbsistatic.com/fly/css/video/htmlPlayerControls/	19 KB 4 KB	11ms 11ms	Stylesheet text/css	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet2.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-6870d3c422-rev.css Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash dfeddecaf8089d4325e7579019de8adeff79055f53ae4eb91db12aa6003e4376 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:32 GMT content-encoding gzip x-content-type-options nosniff age 33499 vary Accept-Encoding, Accept content-length 3956 x-xss-protection 1; mode=block last-modified Mon, 23 Nov 2020 09:37:10 GMT server ContentServer x-frame-options SAMEORIGIN etag "2c3cebf7d623a21903ffd142870efa5d" strict-transport-security max-age=31536000 content-type text/css access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 30 Nov 2020 09:38:10 GMT
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	13 KB 4 KB	42ms 38ms	Script application/javascript	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9d0d33ff3cbe6054d46a549c75a09323fc711113b82fde575003df837cb9f4e0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 23 Nov 2020 18:56:32 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 jYDzNb7TDeiVgZ0wAySJVQ== age 3772 vary Accept-Encoding content-length 4134 cf-request-id 0698100d4700000ea72ebcc000000001 x-ms-lease-status unlocked last-modified Mon, 23 Nov 2020 02:33:31 GMT server cloudflare etag 0x8D88F582ACD4707 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id a4b9b703-b01e-004f-1a4c-c11cfe000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 5f6d1c5babb20ea7-FRA
GET H2	200	optanon-v1.1.0.js Show response cmg1.cbsistatic.com/privacy/optanon/	36 KB 36 KB	12ms 11ms	Script text/javascript	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cmg1.cbsistatic.com/privacy/optanon/optanon-v1.1.0.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a0a97a5a7dc2b30e9a76ff211332f36d435293c19ed91ca1ad6a66adc1dc50cd Security Headers Name Value Strict-Transport-Security max-age=900 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:32 GMT referrer-policy no-referrer-when-downgrade last-modified Thu, 05 Nov 2020 17:51:25 GMT server ContentServer age 1558512 etag "46e2aa30cbebb708b5fc468d57d56d8b" x-frame-options SAMEORIGIN content-type text/javascript cache-control public, max-age=604800 x-content-type-options nosniff strict-transport-security max-age=900 accept-ranges bytes content-length 36582 x-xss-protection 1; mode=block expires Thu, 05 Nov 2020 19:01:20 GMT
GET H2	200	catalin-cimpanu.jpg zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/	909 B 1016 B	60ms 5ms	Image image/jpeg	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/catalin-cimpanu.jpg Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 7cd54b3c177c3f63dd51c2dae4ef7ca4e3cd938c1afb60e4b4e9d78df952ac75 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:32 GMT content-encoding gzip x-content-type-options nosniff age 1204887 vary Accept-Encoding, Accept content-length 871 x-xss-protection 1; mode=block last-modified Fri, 21 Aug 2020 16:49:51 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"eea6e0b6dedefcdd0e40680af3f9f5c0" strict-transport-security max-age=31536000 content-type image/jpeg access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 08 Jan 2021 20:15:00 GMT
GET H2	200	malware-skull.jpg zdnet1.cbsistatic.com/hub/i/2020/11/19/dd6e0927-2ea7-4769-b44c-8a9bc5ab94fa/	15 KB 15 KB	62ms 9ms	Image image/jpeg	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet1.cbsistatic.com/hub/i/2020/11/19/dd6e0927-2ea7-4769-b44c-8a9bc5ab94fa/malware-skull.jpg Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 441a1db23c72a2f88f2fafa329b534822f73b4abca19a0a9241a0708f747fca7 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:32 GMT x-content-type-options nosniff x-goog-meta-imagewidth 1000 age 306618 x-goog-meta-imageheight 530 x-goog-meta-imageformat jpeg vary Accept-Encoding, Accept content-length 15189 x-xss-protection 1; mode=block last-modified Thu, 19 Nov 2020 16:56:25 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"1bb677708eff32499c43b0a5cef9c743" strict-transport-security max-age=31536000 content-type image/jpeg access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 15189 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:45 GMT
GET H2	200	require-2.1.2.js Show response zdnet2.cbsistatic.com/fly/js/libs/	16 KB 6 KB	63ms 10ms	Script application/javascript	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a70d5b9ad136255942779acf94da5cc72316fde5c10c5e7707d6f1888f43dcb8 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:32 GMT content-encoding gzip x-content-type-options nosniff age 27480 vary Accept-Encoding, Accept content-length 6169 x-xss-protection 1; mode=block last-modified Mon, 23 Nov 2020 09:37:07 GMT server ContentServer x-frame-options SAMEORIGIN etag "4109329246fc0f80fed87303509bd457" strict-transport-security max-age=31536000 content-type application/javascript access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 30 Nov 2020 11:18:31 GMT
GET H/1.1	200 OK	YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Show response c.go-mpulse.net/boomerang/ Frame E016	202 KB 51 KB	63ms 12ms	Script application/javascript	2a02:26f0:6c00:192::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:192::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software Akamai Resource Optimizer / Resource Hash 95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:32 GMT Content-Encoding br Last-Modified Tue, 10 Nov 2020 10:15:28 GMT Server Akamai Resource Optimizer Vary Accept-Encoding Content-Type application/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control max-age=604800, s-maxage=604800 Connection keep-alive Timing-Allow-Origin * Content-Length 51580
GET DATA	200 OK	truncated /	31 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f3e2e0f12c5badfe408d69bf6c0fa9ce6247f9a45c849851a53b8647637cfcd0 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	5 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash dfd272053c730cd470302af475eb401d9be41c81f0081c20d7910f6c12732c9d Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 95783bf43b78701a92daf5ec7268db97c7144599c774821126b8cc5396724bfa Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	917 B 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	2 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	2 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	4 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	43 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	mag-white01.png zdnet3.cbsistatic.com/fly/1606124051-asset/bundles/zdnetcss/images/core/	1 KB 1 KB	14ms 9ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet3.cbsistatic.com/fly/1606124051-asset/bundles/zdnetcss/images/core/mag-white01.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/css/core/main-af19460416-rev.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://zdnet3.cbsistatic.com/fly/css/core/main-af19460416-rev.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:32 GMT x-content-type-options nosniff age 33498 vary Accept-Encoding, Accept content-length 1265 x-xss-protection 1; mode=block last-modified Mon, 23 Nov 2020 09:37:18 GMT server ContentServer x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 30 Nov 2020 09:38:06 GMT
GET H2	200	logo.png zdnet1.cbsistatic.com/fly/1606124051-asset/bundles/zdnetcss/images/core/	4 KB 4 KB	6ms 6ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet1.cbsistatic.com/fly/1606124051-asset/bundles/zdnetcss/images/core/logo.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/css/core/main-af19460416-rev.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://zdnet3.cbsistatic.com/fly/css/core/main-af19460416-rev.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:32 GMT x-content-type-options nosniff age 33498 vary Accept-Encoding, Accept content-length 4105 x-xss-protection 1; mode=block last-modified Thu, 19 Nov 2020 18:10:42 GMT server ContentServer x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 30 Nov 2020 09:18:41 GMT
GET H2	200	Semibold.woff2 zdnet3.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/	20 KB 20 KB	29ms 6ms	Font font/woff2	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet3.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/Semibold.woff2 Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/css/core/main-af19460416-rev.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 21c9c7889404394d4e4c780022b56b5fa39e83b19c34eb0508561a115a1dcc6a Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Origin https://www.zdnet.com Referer https://zdnet3.cbsistatic.com/fly/css/core/main-af19460416-rev.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:32 GMT x-content-type-options nosniff age 1389281 vary Accept-Encoding, Accept content-length 20344 x-xss-protection 1; mode=block last-modified Thu, 05 Nov 2020 17:19:14 GMT server ContentServer x-frame-options SAMEORIGIN etag "a96ff4477074c6395b7305d2d98fde8e" strict-transport-security max-age=31536000 content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Sun, 07 Nov 2021 17:00:51 GMT
GET H2	200	Regular.woff2 zdnet3.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/	20 KB 20 KB	30ms 7ms	Font font/woff2	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet3.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/Regular.woff2 Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/css/core/main-af19460416-rev.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 7fa1c7b1686f9f116183456c39f7b3ed9cce063cfb428e575fe4a29ae05c4fa6 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Origin https://www.zdnet.com Referer https://zdnet3.cbsistatic.com/fly/css/core/main-af19460416-rev.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:32 GMT x-content-type-options nosniff age 5168078 vary Accept-Encoding, Accept content-length 20256 x-xss-protection 1; mode=block last-modified Thu, 24 Sep 2020 15:27:12 GMT server ContentServer x-frame-options SAMEORIGIN etag "2d636d9395b2da27ce67040250333ca4" strict-transport-security max-age=31536000 content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Fri, 24 Sep 2021 23:15:07 GMT
GET H2	200	e70f246a-fd9b-4805-9fd4-fcd89020aca5.json Show response cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/	3 KB 1 KB	19ms 17ms	XHR application/x-javascript	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/e70f246a-fd9b-4805-9fd4-fcd89020aca5.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0844bd3c4baeabefa82df5e7dab5789c384a63f93799d25d325923c87941b79b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 23 Nov 2020 18:56:33 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 /OEOyq06PFOqP2wdlgJHyA== age 1244 vary Accept-Encoding content-length 1219 cf-request-id 06981011430000c2ef83b6b000000001 x-ms-lease-status unlocked last-modified Thu, 29 Oct 2020 19:43:56 GMT server cloudflare etag 0x8D87C42F9703542 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id 6713cf80-201e-010a-3869-b6873a000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 5f6d1c620c50c2ef-FRA
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	164 B 356 B	47ms 47ms	Script text/javascript	2606:4700:10::6814:b844 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6814:b844 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e0cc0930a1ab7e9ae754783576228f3c32caa07605236711cf81035f3f45f0ea Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:33 GMT content-encoding gzip server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 5f6d1c626f13d6f1-FRA cf-request-id 06981011850000d6f128b31000000001
GET H2	200	main.default.js Show response zdnet3.cbsistatic.com/fly/e8033f-fly/js/	753 KB 227 KB	8ms 7ms	Script application/javascript	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 727e2cb4c77abe8c29b0e78cdc4413e85a27172a133d44a5e70c756564d7295f Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:33 GMT content-encoding gzip x-content-type-options nosniff age 33506 vary Accept-Encoding, Accept content-length 231709 x-xss-protection 1; mode=block last-modified Mon, 23 Nov 2020 09:37:01 GMT server ContentServer x-frame-options SAMEORIGIN etag "e6e8e2b437d3cea16fce3878347530f9" strict-transport-security max-age=31536000 content-type application/javascript access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 30 Nov 2020 09:38:06 GMT
GET H/1.1	200 OK	config.json Show response c.go-mpulse.net/api/ Frame E016	2 KB 1 KB	26ms 25ms	XHR application/json	2a02:26f0:6c00:192::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5353859&v=1.632.0&if=&sl=0&si=7mlyfig7l1w-qk9ja9&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,LOGN&acao= Requested by Host: c.go-mpulse.net URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:192::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash c37cf2d1322a60ef2e131746adbb52616573c2a9c284483ecd95546ae3181edb Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:33 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/json Access-Control-Allow-Origin * Cache-Control private, max-age=300, stale-while-revalidate=60, stale-if-error=120 Connection keep-alive Timing-Allow-Origin * Content-Length 848
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/6.7.0/	338 KB 72 KB	29ms 24ms	Script application/javascript	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.7.0/otBannerSdk.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f1e3d87e5966b1193f8e51bec035a9de6de1c02243deb8f2b9bd280a67715112 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 23 Nov 2020 18:56:33 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 39GJ8QXxSjBaTmaIgt+tLg== age 3748 vary Accept-Encoding content-length 73268 cf-request-id 069810120300000ea7ff21a000000001 x-ms-lease-status unlocked last-modified Fri, 09 Oct 2020 06:35:45 GMT server cloudflare etag 0x8D86C1D8DA49AF8 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id 1bed58e2-101e-0049-4551-b6eb86000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 5f6d1c633ea10ea7-FRA
OPTIONS H2	200	diff at.cbsi.com/lib/api/v1/zdnet/prod/config/ Frame	0 0	588ms 588ms	Other text/html	151.101.1.188 FASTLY
General Check archive.org Show headers Download Go to Full URL https://at.cbsi.com/lib/api/v1/zdnet/prod/config/diff Protocol H2 Server 151.101.1.188 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Google Frontend / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers cat,content-type,variant,version Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Sec-Fetch-Mode cors Response headers content-type text/html; charset=utf-8 x-dns-prefetch-control off x-frame-options SAMEORIGIN x-download-options noopen x-content-type-options nosniff x-xss-protection 1; mode=block access-control-allow-origin https://www.zdnet.com access-control-allow-headers * allow GET,HEAD etag W/"8-ZRAf8oNBS3Bjb/SU2GYZCmbtmXg" x-cloud-trace-context 002b4d5b8667bca0a0137704f168aa26 server Google Frontend accept-ranges bytes date Mon, 23 Nov 2020 18:56:34 GMT via 1.1 varnish x-served-by cache-cdg20746-CDG x-cache MISS x-cache-hits 0 x-timer S1606157794.996484,VS0,VE569 vary Accept-Encoding x-abtest none strict-transport-security max-age=300 content-length 8
GET H/1.1	200 OK	config.js Show response confiant-integrations.global.ssl.fastly.net/6NAGEHPQTIMciZyoLrUIDQZlmus/gpt_and_prebid/	178 KB 40 KB	35ms 35ms	Script text/javascript	151.101.13.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/6NAGEHPQTIMciZyoLrUIDQZlmus/gpt_and_prebid/config.js Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 0b2be6f25da49422c74cd67a843121306ed24185dd09b4803971e83524c50284 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:33 GMT Content-Encoding gzip Age 796 X-Cache HIT Connection keep-alive Content-Length 39962 x-amz-id-2 SdEb1AdoLZVQclufmYosSQsVXGtxNWoyD1bmHr69M4ilV/3GzQ2oAx3+B2AD4Dv5nti5L6gmWoY= X-Served-By cache-fra19129-FRA Last-Modified Mon, 23 Nov 2020 18:10:00 GMT Server AmazonS3 X-Timer S1606157794.937743,VS0,VE0 ETag "cd3f49a4595b005f938e9dca016db662" x-amz-request-id 20A4B93D815FE67D Via 1.1 varnish Cache-Control public, max-age=900, stale-while-revalidate=3600 Accept-Ranges bytes Content-Type text/javascript X-Cache-Hits 40
GET H2	200	diff Show response at.cbsi.com/lib/api/v1/zdnet/prod/config/	17 KB 4 KB	21ms 19ms	Fetch application/json	151.101.1.188 FASTLY
General Check archive.org Show headers Download Go to Full URL https://at.cbsi.com/lib/api/v1/zdnet/prod/config/diff Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.1.188 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Google Frontend / Resource Hash e3689639e8feff607d84663ebcbcf834cdebc11ec9129345587086a28eeb88de Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept application/json cat FaINTTd9d Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ version v2.19.2 variant core User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/json Response headers x-abtest none date Mon, 23 Nov 2020 18:56:34 GMT content-encoding gzip x-content-type-options nosniff age 782 x-dns-prefetch-control off x-cache HIT ttl 900s content-length 3743 x-xss-protection 1; mode=block x-served-by cache-cdg20746-CDG access-control-allow-origin https://www.zdnet.com server Google Frontend x-timer S1606157795.586250,VS0,VE0 x-frame-options SAMEORIGIN etag W/3bfd888ba928bf90a2b6f643b16288bcbbacb75a x-download-options noopen vary Accept-Encoding, Origin strict-transport-security max-age=300 content-type application/json; charset=utf-8 via 1.1 varnish x-cloud-trace-context 85451a2bd696951695cb3d80c8359be7 cache-control max-age=900 accept-ranges bytes access-control-allow-headers * x-cache-hits 2
GET H3-Q050	200	gpt.js Show response securepubads.g.doubleclick.net/tag/js/	54 KB 18 KB	40ms 39ms	Script text/javascript	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/tag/js/gpt.js Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software sffe / Resource Hash b67517e58ec0d3cb2494f23f887fe90af1f8fb538740bb07ae4b9c95af3763f3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:34 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "702 / 198 of 1000 / last-modified: 1606134076" vary Accept-Encoding content-type text/javascript cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 18520 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:34 GMT
GET H2	200	en.json Show response cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/a652efb7-f570-4ba9-a221-2753b7eb30e8/	60 KB 14 KB	15ms 15ms	Fetch application/x-javascript	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/a652efb7-f570-4ba9-a221-2753b7eb30e8/en.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.7.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9ce8d3bfed7339952b7f3a4143df2e3867ab6ea6555d95d3bd44087d4f672bd1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 23 Nov 2020 18:56:34 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 zmR4HzWDnD/K8NKWX2k29A== age 7078 vary Accept-Encoding content-length 14179 cf-request-id 06981013530000c2ef7e8d2000000001 x-ms-lease-status unlocked last-modified Thu, 29 Oct 2020 19:43:59 GMT server cloudflare etag 0x8D87C42FB4B3E93 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id 49f866d8-c01e-0144-5e0a-b442df000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 5f6d1c655a19c2ef-FRA
GET H2	200	urs.js Show response urs.zdnet.com/sdk/	50 KB 50 KB	129ms 129ms	Script application/javascript	34.102.213.242 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://urs.zdnet.com/sdk/urs.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.102.213.242 , United States, ASN15169 (GOOGLE, US), Reverse DNS 242.213.102.34.bc.googleusercontent.com Software / Resource Hash fb7a86f12d2f0ac2f4111c147415ab30f9c7d84c5e15faba3875fce7ce590127 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:34 GMT via 1.1 google last-modified Mon, 13 Apr 2020 17:57:02 GMT etag "5e94a7ee-c803" strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript accept-ranges bytes alt-svc clear content-length 51203
GET H/1.1	200 OK	wrap.js Show response confiant-integrations.global.ssl.fastly.net/gpt/202011171659/	164 KB 53 KB	30ms 29ms	Script application/javascript	151.101.13.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/6NAGEHPQTIMciZyoLrUIDQZlmus/gpt_and_prebid/config.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 565987a1d366f4f97f9fc987a96d6ef3db20bed171589a03968bded4bd38a41a Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:34 GMT Content-Encoding gzip Age 445 X-Cache HIT Connection keep-alive Content-Length 53538 x-amz-id-2 f+VFIpbT0vyzLAsCl6Cq3TudJvb78FwA/+AmxZDp+6KnMPlPQJiIplJ8bRkB/z30vf6bQwOSi8Q= X-Served-By cache-fra19129-FRA Last-Modified Wed, 18 Nov 2020 17:03:05 GMT Server AmazonS3 X-Timer S1606157794.164878,VS0,VE0 ETag "53928e26336f384df2d32f911e88a0da" x-amz-request-id 14CE28B8D447706F Via 1.1 varnish Cache-Control public, max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 X-Cache-Hits 392
GET H/1.1	200 OK	wrap.js Show response confiant-integrations.global.ssl.fastly.net/prebid/202011171659/	68 KB 23 KB	43ms 42ms	Script application/javascript	151.101.13.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/prebid/202011171659/wrap.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/6NAGEHPQTIMciZyoLrUIDQZlmus/gpt_and_prebid/config.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 487c0c467355b47e27c90679fdb5d43d7b90d6ae36b7b95ec0e31f5c3a17f950 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:34 GMT Content-Encoding gzip Age 439 X-Cache HIT Connection keep-alive Content-Length 23314 x-amz-id-2 kKNjpnK2y+bf67VbDe5WkUehSPTe46kzKi6wOpUQPTckgA9u0x/h0vDoENpoSowPwxI39FQZZMs= X-Served-By cache-fra19175-FRA Last-Modified Wed, 18 Nov 2020 17:03:07 GMT Server AmazonS3 X-Timer S1606157794.164991,VS0,VE0 ETag "4d29cae717c1d46d24406f839d5c5fea" x-amz-request-id 768D31CBEF61C7AC Via 1.1 varnish Cache-Control public, max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 X-Cache-Hits 437
GET H2	200	mpulse-1.0.2.js Show response zdnet1.cbsistatic.com/fly/js/libs/	61 KB 12 KB	7ms 6ms	Script application/javascript	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ea7373d7059ab32d4304249b48a91311f91d2dce5e1ebf10450f33f9a8c5f5ec Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:34 GMT content-encoding gzip x-content-type-options nosniff age 292615 vary Accept-Encoding, Accept content-length 12449 x-xss-protection 1; mode=block last-modified Thu, 19 Nov 2020 18:10:31 GMT server ContentServer x-frame-options SAMEORIGIN etag "466cc1a6673c4cdbd42589de01cfe450" strict-transport-security max-age=31536000 content-type application/javascript access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 27 Nov 2020 09:39:38 GMT
GET H3-Q050	200	pubads_impl_2020111701.js Show response securepubads.g.doubleclick.net/gpt/	277 KB 98 KB	41ms 41ms	Script text/javascript	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software sffe / Resource Hash 68963209b16bd2a387c310495d51021d2fc57e5df9cb87ac98a0505c0daeca43 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:34 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 17 Nov 2020 09:43:24 GMT server sffe vary Accept-Encoding content-type text/javascript cache-control private, immutable, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 99766 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:34 GMT
GET H2	200	otFlat.json Show response cdn.cookielaw.org/scripttemplates/6.7.0/assets/	12 KB 3 KB	21ms 21ms	Fetch application/json	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.7.0/assets/otFlat.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.7.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 06b10167b8d0ac41c1b681a2cce2977f08c4bb49f3261d7ff2fce60b0e59f7c0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 23 Nov 2020 18:56:34 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 6g5s6eICehvPXWb9nycIcQ== age 6936 vary Accept-Encoding content-length 3328 cf-request-id 06981014170000c2efc817e000000001 x-ms-lease-status unlocked last-modified Fri, 09 Oct 2020 06:35:38 GMT server cloudflare etag 0x8D86C1D890DBAF3 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/json access-control-allow-origin * x-ms-request-id 6f0ee0a3-601e-0046-6d17-b30670000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 5f6d1c668c34c2ef-FRA
GET H2	200	otPcPanel.json Show response cdn.cookielaw.org/scripttemplates/6.7.0/assets/v2/	45 KB 11 KB	21ms 18ms	Fetch application/json	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.7.0/assets/v2/otPcPanel.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.7.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c269c820bb1f57a535cbc2b61ddbd902ef33364e5fd1f827ecaccbd1831c1d42 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 23 Nov 2020 18:56:34 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 VdPW9mUL+ZgJ7oO59gDKyw== age 2517 vary Accept-Encoding content-length 11094 cf-request-id 069810141b0000c2ef5ca99000000001 x-ms-lease-status unlocked last-modified Fri, 09 Oct 2020 06:35:40 GMT server cloudflare etag 0x8D86C1D8A75F320 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/json access-control-allow-origin * x-ms-request-id 743ef2b2-401e-0037-71d4-b47449000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 5f6d1c669c40c2ef-FRA
GET H/1.1	200 OK	config.json Show response c.go-mpulse.net/api/v2/	2 KB 1 KB	25ms 24ms	XHR application/json	2a02:26f0:6c00:192::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1606157794411&s=16b04ebbf7136d07afc0f2d9618fb4a319b194a5709056a722e0e185d99b4c60 Requested by Host: zdnet1.cbsistatic.com URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:192::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash da44f1f4687a734224e191b995260e5d2d95b23561cf0913daeeb7be83e5d58f Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:34 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin * Cache-Control private, max-age=300, stale-while-revalidate=60, stale-if-error=120 Connection keep-alive Timing-Allow-Origin * Content-Length 791
GET H2	200	article-ea6d078f02-rev.js Show response zdnet4.cbsistatic.com/fly/js/pages/	145 KB 38 KB	7ms 6ms	Script application/javascript	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet4.cbsistatic.com/fly/js/pages/article-ea6d078f02-rev.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash e6e583553cbb5a7bdf3446558cdf29802cda247ce1d63693633b3d74eb749d8e Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:34 GMT content-encoding gzip x-content-type-options nosniff age 519720 vary Accept-Encoding, Accept content-length 39119 x-xss-protection 1; mode=block last-modified Mon, 16 Nov 2020 17:08:33 GMT server ContentServer x-frame-options SAMEORIGIN etag "25a4da7bfdd253db9556ff2c6030da84" strict-transport-security max-age=31536000 content-type application/javascript access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 24 Nov 2020 18:34:34 GMT
GET H/1.1	200 OK	widgets.js Show response platform.twitter.com/	95 KB 29 KB	8ms 7ms	Script application/javascript	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/widgets.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.7.0/otBannerSdk.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (fcn/40FD) / Resource Hash 2b418a10ba4680c77fa07fb0e736eec6306cba0dbbbc8deac94a25e679178e15 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:34 GMT Content-Encoding gzip Vary Accept-Encoding Age 799 X-Cache HIT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Content-Length 28698 x-tw-cdn VZ Last-Modified Thu, 01 Oct 2020 21:52:09 GMT Server ECS (fcn/40FD) Etag "a671d4d584ef50954e5cebb21da17065+gzip" Access-Control-Max-Age 3000 Access-Control-Allow-Methods GET Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control public, max-age=1800
GET H2	200	;ord=1606157794591 ad.doubleclick.net/ddm/ad/uz/baoomhujs/hpunib/lswthujkudv/pyfredsq/	43 B 325 B	793ms 789ms	Image image/gif	216.58.210.6 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ad.doubleclick.net/ddm/ad/uz/baoomhujs/hpunib/lswthujkudv/pyfredsq/;ord=1606157794591? Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.210.6 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s07-in-f6.1e100.net Software cafe / Resource Hash 9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:34 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 43 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	moatheader.js Show response z.moatads.com/cbsprebidheader506831276743/	227 KB 78 KB	253ms 252ms	Script application/x-javascript	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/cbsprebidheader506831276743/moatheader.js Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 602fab312dd82ffb14508d0e186e809e1e27c55a6e62adf5769a9318dc84ce2f Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:35 GMT content-encoding gzip last-modified Mon, 09 Nov 2020 21:33:52 GMT server AmazonS3 x-amz-request-id A116A0BCFEB1ED44 etag "6854e8f5c7ee7172d6d2fe20d9d27f10" vary Accept-Encoding content-type application/x-javascript cache-control max-age=39107 accept-ranges bytes content-length 79827 x-amz-id-2 LrxYof5YTsukS1I7ly5TdwlPH99cfVt8CYvHzVznL7pj2PV98+XZEE53Pk1mD0xi4vrfs+IGyw4=
GET H2	200	integrator.js Show response adservice.google.fr/adsid/	109 B 169 B	15ms 15ms	Script application/javascript	2a00:1450:4001:808::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.fr/adsid/integrator.js?domain=www.zdnet.com Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:35 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 104 x-xss-protection 0
GET H2	200	integrator.js Show response adservice.google.com/adsid/	109 B 169 B	26ms 26ms	Script application/javascript	2a00:1450:4001:806::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:35 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 104 x-xss-protection 0
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	201 KB 38 KB	1271ms 1270ms	XHR text/plain	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=743995740963303&correlator=1971893929439501&output=ldjh&impl=fifs&eid=21068418%2C21068812&vrg=2020111701&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201123&iu_parts=8264%2Caw-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=5x5%2C728x90%7C970x250%7C970x66%2C300x250%7C300x600%7C300x1050%2C300x250%2C371x771%2C300x250%2C320x50%7C11x11%2C728x90%7C970x250%7C970x66&fluid=0%2C0%2C0%2C0%2C0%2C0%2Cheight%2C0&prev_scp=pos%3Dnav%26sl%3Dnav-ad%253FT-1000%7Cpos%3Dtop%26sl%3Dleader-plus-top%253FT-1000%7Cpos%3Dtop%26sl%3Dmpu-plus-top%253FT-1000%7Cpos%3Dmiddle%26sl%3Dmpu-middle%253FT-1000%7Cpos%3Dtop%26sl%3Ddynamic-showcase-top%253FT-1000%7Cpos%3Dbottom%26sl%3Dmpu-bottom%253FT-1000%7Cpos%3Dtop%26strnativekey%3D8ec3a4f3%26sl%3Dsharethrough-top%253FT-1000%7Cpos%3Dbottom%26sl%3Dleader-plus-bottom%253FT-1000&eri=1&cust_params=buyingcycle%3Ddiscover%26topic%3Dsecurity%252Cnetworking%26tag%3Dransomware%252Cmalware%252Ctarget%26mfr%3Dsophos-inc%26prodtype%3Dcomputers%252Ccomputer%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%252Csocial_user%26type%3Dgpt%26region%3Daw%26subses%3D4%26session%3Dd%26pv%3D1%26vguid%3Deb673923-32a8-443b-9c02-0d2653d01dd5&cookie_enabled=1&bc=31&abxe=1&lmt=1606155690&dt=1606157795623&dlt=1606157792502&idt=2267&frm=20&biw=1600&bih=1200&oid=3&adxs=0%2C-20%2C1050%2C1050%2C1015%2C1050%2C215%2C436&adys=0%2C365%2C485%2C2504%2C1703%2C3386%2C2146%2C7774&adks=301620764%2C3718565486%2C2729011605%2C98901274%2C1613073059%2C1799513408%2C2975533918%2C2382923186&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&ref=https%3A%2F%2Ft.co%2FcejlFPR8a9&dssz=36&icsg=2147492480&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x8234%7C1600x90%7C370x250%7C370x250%7C370x771%7C370x250%7C770x11%7C1210x90&msz=1600x5%7C1600x90%7C370x250%7C370x250%7C370x771%7C370x250%7C770x11%7C1210x90&ga_vid=183045475.1606157796&ga_sid=1606157796&ga_hid=2050800954&fws=4%2C4%2C4%2C4%2C4%2C4%2C4%2C4&ohw=1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash 17efd797ecc8e75c70c4f2145aba2facfd4b09011fb24924d11b7af14db1d211 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:36 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2,-2,-2,-2,-2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 38526 x-xss-protection 0 google-lineitem-id 5536907755,-1,5526751081,-1,4825966980,-1,316148409,5467211422 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id 138330866815,-1,138329746587,-1,138247024569,-1,101222456769,138322013913 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.zdnet.com access-control-expose-headers x-google-amp-ad-validated-version cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	container.html d7eccfc7c27fcfa83ee2bd4d764b4797.safeframe.googlesyndication.com/safeframe/1-0-37/html/	0 0	64ms 42ms	Other text/html	2a00:1450:4001:80b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://d7eccfc7c27fcfa83ee2bd4d764b4797.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H/1.1	204 No Content	/ Show response 684dd309.akstat.io/	0 354 B	69ms 40ms	XHR image/gif	2a02:26f0:6c00:287::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://684dd309.akstat.io/?h.pg=article&when=1606157794893&cdim.Site_View=desktop&t_other=custom4%7C202&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=d278728a81582105321beb8c0d8d2c12107db3ec&h.t=1606157794432&http.initiator=api&rt.start=api&rt.si=80e1ebbc-763c-405e-84ce-522b557a47e0&rt.ss=1606157796492&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1 Requested by Host: zdnet1.cbsistatic.com URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:287::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Mon, 23 Nov 2020 18:56:35 GMT Content-Type image/gif Access-Control-Allow-Origin https://www.zdnet.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Timing-Allow-Origin * X-XSS-Protection 0 Expires Mon, 23 Nov 2020 18:56:35 GMT
GET H2	200	CBSI-PLAYER.js Show response vidtech.cbsinteractive.com/uvpjs/0.42.297/	1 MB 280 KB	7ms 7ms	Script application/javascript	2a04:4e42:1b::645 FASTLY
General Check archive.org Show headers Download Go to Full URL https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::645 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:35 GMT via 1.1 varnish, 1.1 varnish age 2804440 x-cache HIT, HIT content-encoding gzip content-length 286838 x-amz-id-2 n53ElNB5hVnkR9qh4cUlg2SOjOhm/ieDwTiWMKEbKvjjvzF40ZAJ27jUeh6G5dcSTKOWVVqV9Rw= x-served-by cache-dca17777-DCA, cache-hhn4074-HHN last-modified Fri, 01 Feb 2019 18:20:56 GMT server AmazonS3 x-timer S1606157796.887931,VS0,VE0 etag "eb5dd4ed3dcb7641ebbcb604d7ddb038" vary Accept-Encoding x-amz-request-id 798034E8713D8B8D cache-control public, max-age=2592000 accept-ranges bytes content-type application/javascript x-cache-hits 1, 2
GET H/1.1	200 OK	widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html platform.twitter.com/widgets/ Frame 8499	0 0	12ms 6ms	Document text/html	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/widgets/widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html?origin=https%3A%2F%2Fwww.zdnet.com Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (fcn/40E6) / Resource Hash Request headers Host platform.twitter.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest iframe Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Response headers Content-Encoding gzip Access-Control-Allow-Methods GET Access-Control-Allow-Origin * Age 182807 Cache-Control public, max-age=315360000 Content-Type text/html; charset=utf-8 Date Mon, 23 Nov 2020 18:56:35 GMT Etag "9fa476ae827f556d5b037fe43632370d+gzip" Last-Modified Thu, 01 Oct 2020 21:50:01 GMT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server ECS (fcn/40E6) Vary Accept-Encoding X-Cache HIT x-tw-cdn VZ Content-Length 5825
GET H/1.1	200 OK	horizon_tweet.716ef7f4c155526f8ec8e60dbd2fbf56.js Show response platform.twitter.com/js/	6 KB 3 KB	8ms 7ms	Script application/javascript	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/js/horizon_tweet.716ef7f4c155526f8ec8e60dbd2fbf56.js Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (fcn/4188) / Resource Hash b8e8fe9b8ca280dc3c982691064e62ba97c8f2c192a17dfe74430c7cf73cb4de Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:36 GMT Content-Encoding gzip Last-Modified Thu, 01 Oct 2020 21:49:51 GMT Server ECS (fcn/4188) Age 421706 Etag "15d6bf68a8d65b293e52ddc833724ed4+gzip" Vary Accept-Encoding x-tw-cdn VZ P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin * Cache-Control public, max-age=315360000 X-Cache HIT Access-Control-Allow-Methods GET Content-Type application/javascript; charset=utf-8 Content-Length 2195
GET H2	200	v2 Show response mb.moatads.com/yi/	292 B 466 B	42ms 41ms	Script text/html	99.80.114.7 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://mb.moatads.com/yi/v2?qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&callback=MoatNadoAllJsonpRequest_56871405 Requested by Host: z.moatads.com URL: https://z.moatads.com/cbsprebidheader506831276743/moatheader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.80.114.7 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-99-80-114-7.eu-west-1.compute.amazonaws.com Software TornadoServer/4.5.3 / Resource Hash 9ece2094f56cc5e81c29eb702d49c7e694f65178b763e30785f4c07522db68fc Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:36 GMT cache-control max-age=900 server TornadoServer/4.5.3 timing-allow-origin * etag "39550ed5aaa1ec772ae7967a16abd6fdfbfef5d9" content-length 292 content-type text/html; charset=UTF-8
GET H2	200	n.js Show response geo.moatads.com/	125 B 299 B	47ms 46ms	Script text/html	99.80.114.7 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://geo.moatads.com/n.js?e=35&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&i=CBS_PREBID_HEADER1&hp=1&wf=1&vb=8&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=11&f=0&j=https%3A%2F%2Ft.co&t=1606157796238&de=777736683303&rx=820943480488&m=0&ar=a63e245-clean&iw=b2c8261&q=1&cb=0&cu=1606157796238&ll=2&lm=0&ln=0&em=0&en=0&d=undefined%3Aundefined%3Aundefined%3Aundefined&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&bo=undefined&bd=undefined&gw=cbsprebidheader506831276743&fd=1&ac=1&it=500&pe=1%3A887%3A887%3A0%3A953&fs=186589&na=822491638&cs=0&callback=DOMlessLLDcallback_56871405 Requested by Host: z.moatads.com URL: https://z.moatads.com/cbsprebidheader506831276743/moatheader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.80.114.7 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-99-80-114-7.eu-west-1.compute.amazonaws.com Software TornadoServer/4.5.3 / Resource Hash d914051889f4f5841e15b8be10363cb492d9780aa5ae8534396caf31fe1188d3 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:36 GMT cache-control max-age=900 server TornadoServer/4.5.3 timing-allow-origin * etag "044b15c56fb877f6c8fbaef03512f986b2c862f2" content-length 125 content-type text/html; charset=UTF-8
GET H2	200	n.js Show response geo.moatads.com/	126 B 300 B	46ms 45ms	Script text/html	99.80.114.7 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://geo.moatads.com/n.js?e=35&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&i=CBS_PREBID_HEADER1&hp=1&wf=1&vb=8&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=11&f=0&j=https%3A%2F%2Ft.co&t=1606157796238&de=777736683303&rx=820943480488&m=0&ar=a63e245-clean&iw=b2c8261&q=2&cb=0&cu=1606157796238&ll=2&lm=0&ln=0&em=0&en=0&d=undefined%3Aundefined%3Aundefined%3Aundefined&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&bo=undefined&bd=undefined&gw=cbsprebidheader506831276743&fd=1&ac=1&it=500&pe=1%3A887%3A887%3A0%3A953&fs=186589&na=2007566807&cs=0&callback=MoatDataJsonpRequest_56871405 Requested by Host: z.moatads.com URL: https://z.moatads.com/cbsprebidheader506831276743/moatheader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.80.114.7 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-99-80-114-7.eu-west-1.compute.amazonaws.com Software TornadoServer/4.5.3 / Resource Hash 0b9642b516d1b0823a6ac270ddc27568133fac5be663a902b5bed7ab5434ddd3 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:36 GMT cache-control max-age=900 server TornadoServer/4.5.3 timing-allow-origin * etag "759dc5cba5102c773bf5f1e5add932cde3145b99" content-length 126 content-type text/html; charset=UTF-8
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	34ms 33ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&t=1606157796238&de=437627164344&d=CBS_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=a63e245-clean&iw=b2c8261&zMoatRendered=0&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=0&zMoatPageDataTargetingSet=0&zMoatSafetyTargetingSet=0&zMoatEmptySlot=0&zMoatNadoDataLoadTime=Not%20Loaded&zMoatAllDataLoadTime=Not%20Loaded&bo=zdnet.com&bd=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&ac=1&bq=11&f=0&na=419609652&cs=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:36 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:36 GMT
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 56D8	0 0	52ms 50ms	Fetch image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv1CkLB8FDaKEJRgYwTB3sqqpI0Ju0dOhF3AdYWhabqPVzoyNbkSzU2ezwUFbQRGioIrVOxJ4fwkXyG47jw1NqIZGHHY_VixGHRXDkdpnMyPQfGDxW61lH_IdjfDpcSZZ5xrmWs4F1iHEZtp0OaNQksbzTfmtDzHsejPdHPcqUtSBIGhtx7jgKFeDU7WpxnKdCgp014QJy7Lir9utbWsGljx_iXgHOO5hHx5LNUfqCE01YWrciEUCVd1u_G71NTS3cmIvaKcg2eOBPbJw&sig=Cg0ArKJSzAxlx5U7orUFEAE&urlfix=1&adurl= Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:37 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:37 GMT
GET H2	200	ad.js Show response clipcentric-a.akamaihd.net/ad/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/ Frame 56D8	135 KB 37 KB	40ms 32ms	Script text/javascript	2.16.177.50 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://clipcentric-a.akamaihd.net/ad/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/ad.js?q=1604705524 Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.177.50 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS a2-16-177-50.deploy.static.akamaitechnologies.com Software Apache/2.2.34 / Resource Hash 6f61194871255096b51c078ecffd02a93699b2cda3bc71c8c48cea2a5511a5b2 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:37 GMT content-encoding br last-modified Thu Jan 1 00:00:00 1970 server Apache/2.2.34 cache-control max-age=3600 content-length 37902 content-type text/javascript
GET H3-Q050	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame 56D8	75 KB 29 KB	16ms 14ms	Script text/javascript	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5e72a6053c72fd8b75a2723a35b054605a26ed93fe36fa40c5cb1ace71322129 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:37 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1605702985553312" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 29194 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:37 GMT
GET H2	200	moatad.js Show response z.moatads.com/cbsdfp5832910442/ Frame 56D8	320 KB 107 KB	37ms 35ms	Script application/x-javascript	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/cbsdfp5832910442/moatad.js Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 9291d9d87d61a0608d3a6b508cb92fa452e2ad612696a66716201dffdf968927 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:37 GMT content-encoding gzip last-modified Mon, 09 Nov 2020 21:24:39 GMT server AmazonS3 x-amz-request-id A1A0B3F940F1DAC9 etag "6a6dcf414007d90f491fd34c0ded6f44" vary Accept-Encoding content-type application/x-javascript cache-control max-age=38965 accept-ranges bytes content-length 108768 x-amz-id-2 UR43//usmS5qM1+drhO+VGGwyXg2cnXCFBwLWVAMph1p2VgbAm2TDGDUM47RWoyL9kOfX+yVfbU=
GET H3-Q050	200	B24946233.286791742;dc_pre=CJ69z4esme0CFVztuwgdu7EKxQ;dc_trk_aid=480369388;dc_trk_cid=140485965;ord=578511284;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua= ad.doubleclick.net/ddm/trackimp/N7384.3861580VIACOMCBS/ Frame 56D8 Redirect Chain https://ad.doubleclick.net/ddm/trackimp/N7384.3861580VIACOMCBS/B24946233.286791742;dc_trk_aid=480369388;dc_trk_cid=140485965;ord=578511284;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=? https://ad.doubleclick.net/ddm/trackimp/N7384.3861580VIACOMCBS/B24946233.286791742;dc_pre=CJ69z4esme0CFVztuwgdu7EKxQ;dc_trk_aid=480369388;dc_trk_cid=140485965;ord=578511284;dc_lat=;dc_rdid=;tag_for...	42 B 65 B	73ms 72ms	Image image/gif	216.58.210.6 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ad.doubleclick.net/ddm/trackimp/N7384.3861580VIACOMCBS/B24946233.286791742;dc_pre=CJ69z4esme0CFVztuwgdu7EKxQ;dc_trk_aid=480369388;dc_trk_cid=140485965;ord=578511284;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=? Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.210.6 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s07-in-f6.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:37 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Mon, 23 Nov 2020 18:56:37 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" content-type text/html; charset=UTF-8 location https://ad.doubleclick.net/ddm/trackimp/N7384.3861580VIACOMCBS/B24946233.286791742;dc_pre=CJ69z4esme0CFVztuwgdu7EKxQ;dc_trk_aid=480369388;dc_trk_cid=140485965;ord=578511284;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=? cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin follow-only-when-prerender-shown 1 timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	osd.js Show response www.googletagservices.com/activeview/js/current/	73 KB 28 KB	29ms 21ms	Script text/javascript	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d56ee6a2ba915ad87e2dc9b49d9199563f3b35f9e048938e84d1a033e5c2b1c5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:37 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1605702985553312" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 28207 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:37 GMT
GET H/1.1	200 OK	index.html platform.twitter.com/embed/ Frame DEB0	0 0	54ms 18ms	Document text/html	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/embed/index.html?creatorScreenName=ZDNet&dnt=false&embedId=twitter-widget-0&frame=false&hideCard=false&hideThread=false&id=1327309590736883712&lang=en&origin=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&siteScreenName=ZDNet&theme=light&widgetsVersion=ed20a2b%3A1601588405575&width=550px Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (fcn/40FD) / Resource Hash Request headers Host platform.twitter.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest iframe Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Response headers Accept-Ranges bytes Access-Control-Allow-Methods GET Access-Control-Allow-Origin * Age 829 Cache-Control public, max-age=1800 Content-Type text/html; charset=utf-8 Date Mon, 23 Nov 2020 18:56:37 GMT Etag "18c1cbad7a89225239c4963d441ca471" Last-Modified Wed, 18 Nov 2020 21:46:10 GMT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server ECS (fcn/40FD) X-Cache HIT x-tw-cdn VZ Content-Length 577
GET H/1.1	200 OK	index.html platform.twitter.com/embed/ Frame 8C56	0 0	54ms 23ms	Document text/html	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/embed/index.html?creatorScreenName=ZDNet&dnt=false&embedId=twitter-widget-1&frame=false&hideCard=false&hideThread=false&id=1270245608452788224&lang=en&origin=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&siteScreenName=ZDNet&theme=light&widgetsVersion=ed20a2b%3A1601588405575&width=550px Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (fcn/40D0) / Resource Hash Request headers Host platform.twitter.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest iframe Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Response headers Accept-Ranges bytes Access-Control-Allow-Methods GET Access-Control-Allow-Origin * Age 1496 Cache-Control public, max-age=1800 Content-Type text/html; charset=utf-8 Date Mon, 23 Nov 2020 18:56:37 GMT Etag "18c1cbad7a89225239c4963d441ca471" Last-Modified Wed, 18 Nov 2020 21:46:10 GMT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server ECS (fcn/40D0) X-Cache HIT x-tw-cdn VZ Content-Length 577
GET H3-Q050	204	gen_204 pagead2.googlesyndication.com/pagead/	0 23 B	15ms 14ms	Image image/gif	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_sz&pvsid=743995740963303&r=371x771&w=371&h=771&a=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:37 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	amp4ads-v0.mjs Show response cdn.ampproject.org/rtv/012010270040000/ Frame 1AE6	180 KB 50 KB	12ms 7ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b2ab9ac436910017b9a2ca7db0e981bad3638db97f576d713eaa9b302e06c094 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 121524 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 51478 x-xss-protection 0 server sffe date Sun, 22 Nov 2020 09:11:13 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "0305d7d21a7fe4a1" accept-ranges bytes timing-allow-origin * expires Mon, 22 Nov 2021 09:11:13 GMT
GET H2	200	amp-ad-exit-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 1AE6	13 KB 5 KB	29ms 25ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-ad-exit-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ebab910fdc7c7e9e079caa9f7321177b135b2e1542f86ce36937ceb41865086d Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 189604 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4850 x-xss-protection 0 server sffe date Sat, 21 Nov 2020 14:16:33 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "77bd676d834aaa8d" accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 14:16:33 GMT
GET H2	200	amp-analytics-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 1AE6	90 KB 27 KB	20ms 16ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-analytics-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 477549a4d5fb644cda6bf64af01631b8411022d88e608bbd8e5a06e327b391cb Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 189604 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 27668 x-xss-protection 0 server sffe date Sat, 21 Nov 2020 14:16:33 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "1304c1c0caf7ca3c" accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 14:16:33 GMT
GET H2	200	amp-fit-text-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 1AE6	3 KB 1 KB	19ms 15ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-fit-text-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a86753d4effe5e607d4eaf03fe37eccb8cac743a528f874f736f4d7f35e094b1 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 121167 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1350 x-xss-protection 0 server sffe date Sun, 22 Nov 2020 09:17:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "12c034eb739190af" accept-ranges bytes timing-allow-origin * expires Mon, 22 Nov 2021 09:17:10 GMT
GET H2	200	amp-form-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 1AE6	41 KB 13 KB	13ms 9ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-form-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b61eb57ae77f31b91b04781da33023ecd897fda21f6c817e6c27623204046f42 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 189603 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13075 x-xss-protection 0 server sffe date Sat, 21 Nov 2020 14:16:34 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "1e8a1dae72af56cd" accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 14:16:34 GMT
GET H3-Q050	200	css fonts.googleapis.com/ Frame 1AE6	6 KB 746 B	29ms 26ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=fr Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 56e4953af5c01ed820d5e5dc430e77234a87e8d019c38fda46f9f3593cd05e0f Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff last-modified Mon, 23 Nov 2020 18:56:37 GMT server ESF link <https://fonts.gstatic.com>; rel=preconnect; crossorigin date Mon, 23 Nov 2020 18:56:37 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:37 GMT
GET H3-Q050	200	css fonts.googleapis.com/ Frame 1AE6	4 KB 650 B	26ms 25ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&text= Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2190c16423c2557bcb20ccba2edc176fbeb16e6a3de2b2af297f650aae85a43e Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff last-modified Mon, 23 Nov 2020 18:16:56 GMT server ESF link <https://fonts.gstatic.com>; rel=preconnect; crossorigin date Mon, 23 Nov 2020 18:56:37 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:37 GMT
GET DATA	200 OK	truncated / Frame 1AE6	213 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 17137e149e791c744e243162202f516fadfb90a316524345cf0d0cb165168d95 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame A62D	0 0	79ms 77ms	Fetch image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvkZF13ozMwWjmNMDAwsFcc6eiGGktHrI_Se9eppdAleH8qfc-xIZT51WkWPbHS3jNHkCSyr_MnC54HSWkxCOSz2nqP726ujNsFY0dcIPq9yb_aIbskWfxYd7cadziowJg6EmjJ3ztYixyS2j4AGFfbqYrsFWkbP97YV3_D0dBGlKZjh_LzNhfNNm70h1sj7_RrihLBQbNijoZPCqStESJ57WY4xTM2Lv2WqMRmjKJoHp3PfFnr1dri15rwJxJL8dIIXPGScqm-E8WxZQ&sig=Cg0ArKJSzAg4iKZtE-QIEAE&urlfix=1&adurl= Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:37 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H3-Q050	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame A62D	75 KB 29 KB	21ms 20ms	Script text/javascript	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5e72a6053c72fd8b75a2723a35b054605a26ed93fe36fa40c5cb1ace71322129 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:37 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1605702985553312" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 29194 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:37 GMT
GET H2	200	moatad.js Show response z.moatads.com/cbsdfp5832910442/ Frame A62D	320 KB 107 KB	35ms 34ms	Script application/x-javascript	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/cbsdfp5832910442/moatad.js Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 9291d9d87d61a0608d3a6b508cb92fa452e2ad612696a66716201dffdf968927 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:37 GMT content-encoding gzip last-modified Mon, 09 Nov 2020 21:24:39 GMT server AmazonS3 x-amz-request-id A1A0B3F940F1DAC9 etag "6a6dcf414007d90f491fd34c0ded6f44" vary Accept-Encoding content-type application/x-javascript cache-control max-age=38965 accept-ranges bytes content-length 108768 x-amz-id-2 UR43//usmS5qM1+drhO+VGGwyXg2cnXCFBwLWVAMph1p2VgbAm2TDGDUM47RWoyL9kOfX+yVfbU=
GET H3-Q050	200	amp4ads-v0.mjs Show response cdn.ampproject.org/rtv/012010270040000/ Frame 898F	180 KB 50 KB	18ms 6ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b2ab9ac436910017b9a2ca7db0e981bad3638db97f576d713eaa9b302e06c094 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 121524 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 51478 x-xss-protection 0 server sffe date Sun, 22 Nov 2020 09:11:13 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "0305d7d21a7fe4a1" accept-ranges bytes timing-allow-origin * expires Mon, 22 Nov 2021 09:11:13 GMT
GET H3-Q050	200	amp-ad-exit-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 898F	13 KB 5 KB	62ms 50ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-ad-exit-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ebab910fdc7c7e9e079caa9f7321177b135b2e1542f86ce36937ceb41865086d Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 189604 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4850 x-xss-protection 0 server sffe date Sat, 21 Nov 2020 14:16:33 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "77bd676d834aaa8d" accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 14:16:33 GMT
GET H3-Q050	200	amp-analytics-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 898F	90 KB 27 KB	63ms 51ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-analytics-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 477549a4d5fb644cda6bf64af01631b8411022d88e608bbd8e5a06e327b391cb Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 189604 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 27668 x-xss-protection 0 server sffe date Sat, 21 Nov 2020 14:16:33 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "1304c1c0caf7ca3c" accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 14:16:33 GMT
GET H3-Q050	200	amp-fit-text-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 898F	3 KB 1 KB	57ms 51ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-fit-text-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a86753d4effe5e607d4eaf03fe37eccb8cac743a528f874f736f4d7f35e094b1 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 121167 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1350 x-xss-protection 0 server sffe date Sun, 22 Nov 2020 09:17:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "12c034eb739190af" accept-ranges bytes timing-allow-origin * expires Mon, 22 Nov 2021 09:17:10 GMT
GET H3-Q050	200	amp-form-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 898F	41 KB 13 KB	57ms 52ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-form-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b61eb57ae77f31b91b04781da33023ecd897fda21f6c817e6c27623204046f42 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 189603 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13075 x-xss-protection 0 server sffe date Sat, 21 Nov 2020 14:16:34 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "1e8a1dae72af56cd" accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 14:16:34 GMT
GET DATA	200 OK	truncated / Frame 898F	222 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 45e5eac1b634a8e80dcfb53e37b4500d7ccfdd4cccce0a815f3c371f0584f5d7 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 0821	0 0	138ms 68ms	Fetch image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvMPLGnPdVEzl-FrGZKOqPt3tQR-QTHTZOEud9Jid-FmEQG5aEdHkWKZ5cIsYwInXXtXaiD9xn3Kz5TONeXu3MP1esRUhQnhn5aNTxEMO-3-BzGt44cvDKiO-adtTHQaQnrszqoVwrnGs6xwZv0xT7GNWNuNVQmA_Na95pEIHOQIfnSOX7g8Iwnurzz9fkh83I9GSlJVYsLUkg8CrsYGy4x7tY7tFjZbiPLRZN2Dvg3Q8Oukp5ekvz0jAmu_jfeXhfG1vYWKUFJ&sig=Cg0ArKJSzLSaIi2bB6zsEAE&urlfix=1&adurl= Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:37 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H2	200	adKit.min.js Show response rev.cbsi.com/common/js/ Frame 0821	6 KB 2 KB	306ms 198ms	Script application/javascript	2a04:4e42:31::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://rev.cbsi.com/common/js/adKit.min.js?1923904169 Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:31::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:37 GMT content-encoding gzip vary Accept-Encoding age 0 x-cache MISS content-length 2149 x-served-by cache-ewr18162-EWR access-control-allow-origin * last-modified Thu, 16 Apr 2020 15:02:48 GMT server AmazonS3 x-timer S1606157798.523234,VS0,VE114 etag "e524dc608d5c7c30eef57b6ed95dc6a8" strict-transport-security max-age=300 content-type application/javascript via 1.1 varnish accept-ranges bytes x-cache-hits 0
GET H3-Q050	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame 0821	75 KB 29 KB	100ms 31ms	Script text/javascript	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5e72a6053c72fd8b75a2723a35b054605a26ed93fe36fa40c5cb1ace71322129 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:37 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1605702985553312" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 29194 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:37 GMT
GET H2	200	moatad.js Show response z.moatads.com/cbsdfp5832910442/ Frame 0821	320 KB 107 KB	89ms 24ms	Script application/x-javascript	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/cbsdfp5832910442/moatad.js Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 9291d9d87d61a0608d3a6b508cb92fa452e2ad612696a66716201dffdf968927 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:37 GMT content-encoding gzip last-modified Mon, 09 Nov 2020 21:24:39 GMT server AmazonS3 x-amz-request-id A1A0B3F940F1DAC9 etag "6a6dcf414007d90f491fd34c0ded6f44" vary Accept-Encoding content-type application/x-javascript cache-control max-age=38965 accept-ranges bytes content-length 108768 x-amz-id-2 UR43//usmS5qM1+drhO+VGGwyXg2cnXCFBwLWVAMph1p2VgbAm2TDGDUM47RWoyL9kOfX+yVfbU=
GET H3-Q050	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/11253319325380860251/ Frame 1AE6	31 KB 31 KB	97ms 33ms	Image image/jpeg	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/11253319325380860251/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoI2gMQ-AEYASABLQAAAD8w2gM4-AFFAACAPw&rs=AOga4qngw5zs6rQKmhlqcFQxkZZ0oJOwfg Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2b88380497b9347aff99bca5742fdcd5572e021a59b4f3f9c3477caaf76de35b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 13:15:45 GMT x-content-type-options nosniff last-modified Fri, 11 Sep 2020 10:24:32 GMT server sffe age 538852 content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31511 x-xss-protection 0 expires Wed, 17 Nov 2021 13:15:45 GMT
GET H3-Q050	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/10247368670396149040/ Frame 1AE6	20 KB 20 KB	101ms 37ms	Image image/jpeg	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/10247368670396149040/downsize_200k_v1?sqp=4sqPyQSLAUKIAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-Mg8I2AQQ2AQYASABLQAAAD8&rs=AOga4qlPY2iaUapHNAvGzMrRT9878iFZCg Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9e879f510057a9402ebcd35912a42e45b3387f7a2a1c053a4b9794a512b2feca Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 19 Nov 2020 07:10:52 GMT x-content-type-options nosniff last-modified Wed, 26 Aug 2020 06:41:17 GMT server sffe age 387945 content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20480 x-xss-protection 0 expires Fri, 19 Nov 2021 07:10:52 GMT
GET H3-Q050	200	adview securepubads.g.doubleclick.net/pagead/ Frame 1AE6	0 0	132ms 68ms	Image text/html	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CUZzV4wW8X7ylL4eM3gPlsoX4CLqrvtBfgqy-0tYL2_zqggEQASDMka4iYPuBgICICqAB55HA1APIAQapAtgst_aI97M-4AIAqAMByAMKqgS6Ak_QhK4bXTTVB5HaNgMFwKY6PfwVmuaRpFh817slk6_w5q4qcf53WG01ufDFifUX2y3gxzWjHXVJbroUMA3jLuZy9bNVIuWazHRwzI5mbablUei9SXmnEfl2ymb3FxTsVKsUr8HqywJxPbBeE0KCqT0NWUz9hPIGpbl-05btuUE3Sdr99M2gfec76EuzskL-f6FUoibHOQnOtXLvXe-rlQsGIlp1BJolhcrzbh-IwDFRkwdqOo73LQCH7Yfd2oubIrQJ4sUZDtZwY-r7ZjuMNTE57xh1TLxVKm4QRe9sw47dsIllrxexvVdk9hnEiPKQYHy-WXYG-_8AL8DlsMQLxyacMdQsrdAodR1LGgZrq52x9EsdRsOHngqbwhDdrKwRJZm5uR1-s4hH3iZdZvdNzC8cdS2IVg8B9PWowAS83vWTmwPgBAGSBQQIBBgBkgUECAUYBKAGN4AHjLOsjgGoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwQQr5AZ0ggJCIDhgBAQARgdgAoDyAsB2BMCiBQEshcaChgIARIUcHViLTE5OTE2Nzk2MjQzMzEzNjk&sigh=rhRW6hoovww&template_id=492&tpd=AGWhJmvLs7Rr8AOerMTcX07rm3poOcWIfpRsxGIblJRwAR1Xgw Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H2	204	l www.google.com/ads/measurement/ Frame 1AE6	0 0	112ms 9ms	Image text/html	2a00:1450:4001:802::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaTpCh9PtBg5Bt3xiv2Qq2UQsEZMRWAru8Nwe4huIzoMb-aPfn6v6BavO81e8lcU6F_9A0sEv5RZQdBjITog6nFn_dLoaQ Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H3-Q050	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 1AE6	2 KB 2 KB	100ms 36ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 11:08:58 GMT x-content-type-options nosniff server cafe age 28059 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2502 x-xss-protection 0 expires Tue, 24 Nov 2020 11:08:58 GMT
GET H3-Q050	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 1AE6	295 B 325 B	117ms 38ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Sun, 22 Nov 2020 22:32:01 GMT x-content-type-options nosniff server cafe age 73476 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Mon, 23 Nov 2020 22:32:01 GMT
GET H3-Q050	200	14655958281695633732 tpc.googlesyndication.com/simgad/ Frame A62D	22 KB 22 KB	117ms 27ms	Image image/jpeg	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/14655958281695633732? Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 230babd80f98a4c948536c8cc393e120493e14c1aa4ca05d73f9d903108ddff7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 18 Nov 2020 11:28:11 GMT x-content-type-options nosniff age 458906 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 22864 x-xss-protection 0 last-modified Mon, 09 Nov 2020 11:05:18 GMT server sffe content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 18 Nov 2021 11:28:11 GMT
GET H3-Q050	200	9093566140434273067 tpc.googlesyndication.com/simgad/ Frame 898F	57 KB 57 KB	129ms 44ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/9093566140434273067?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qletDXFK28fwiVfUwtVSVKA46BBJA Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7d4d7989b416200fba8a0da88650d706810dc6eb34ae3908eaede5ed564cb975 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 10:11:28 GMT x-content-type-options nosniff last-modified Thu, 24 Sep 2020 05:15:35 GMT server sffe age 31509 content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 58612 x-xss-protection 0 expires Tue, 23 Nov 2021 10:11:28 GMT
GET H3-Q050	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 898F	2 KB 2 KB	92ms 36ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 11:08:58 GMT x-content-type-options nosniff server cafe age 28059 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2502 x-xss-protection 0 expires Tue, 24 Nov 2020 11:08:58 GMT
GET H3-Q050	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 898F	295 B 320 B	108ms 30ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Sun, 22 Nov 2020 22:32:01 GMT x-content-type-options nosniff server cafe age 73476 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Mon, 23 Nov 2020 22:32:01 GMT
GET H2	204	l www.google.com/ads/measurement/ Frame 898F	0 0	141ms 16ms	Image text/html	2a00:1450:4001:802::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaSxI2JxqUVmVKLznK3QVpZ737AQVgUigLcMj3Mqyq_X5igTbRozCWkyGDvwYagGaLyzpcrNGDfCHv4tq13SSLjYtWVi1w Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H3-Q050	200	adview securepubads.g.doubleclick.net/pagead/ Frame 898F	0 0	141ms 50ms	Image text/html	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CHvrN4wW8X76lL4eM3gPlsoX4COyTwf1fnoyl_bMM2tkeEAEgzJGuImD7gYCAiAqgAcfm5coCyAEC4AIAqAMByAMIqgTGAk_QvSMleQehTB6LNCKkhUfF33VMZm3AGbkb4hNmYDOK3Ysxac5Mv5JauItETkjeLxaGzvZ8L5VrSvNGKrnq2ZLZgchDE9QylmJEBs2T4H6c_VlFTTSdaySWjXNLVtp_x5iiG7AIh5VUZX84kTR_MaYKIiEhJIwu5oo1eG-HxwLJSn9grX_-cGUX_28EgNu-xR44XwxQEkglrkMPtfdZfldYumSROrANL17Rv0mcqf9ubHcVnpUL_-U-UbDw6BQV4ndTt7OawOGNYwgVetp3d7bn0jbQkTd-hCDoffMCPKP6U93k9OFqUSJQTp3U00cYmSNyancX4g_HhleyrXBoI6WtF6-WOoaIQtbaP9vwbQlMK7RNn44ZGB24caxu_ZeoyGmOo4tUqavod_RWmlyUEpPN4B_N65mZkErwLDsq53Y-muCKKYmzwATv8OStkQPgBAGSBQQIBBgBkgUECAUYBKAGAoAHoZmatQGoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwQQ6bAD0ggJCIDhgBAQARgdgAoDyAsB2BMMshcaChgIARIUcHViLTE5OTE2Nzk2MjQzMzEzNjk&sigh=By95-FaLqSY&tpd=AGWhJmvdWZ6mNJ_3xns8z_ZGnB3zl4M7yHwvv3Y9bjMowQzbEw Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	93ms 31ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=CBS_PREBID_HEADER1&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=11&f=0&j=https%3A%2F%2Ft.co&t=1606157796238&de=135777613503&rx=820943480488&m=0&ar=a63e245-clean&iw=b2c8261&q=3&cb=0&cu=1606157796238&ll=2&lm=0&ln=0&em=0&en=0&d=25365849%3A465723849%3A4676441751%3A138290752599&zMoatAType=content_article&zMoatTest=zdnet&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&bo=aw-zdnet&bd=security&gw=cbsprebidheader506831276743&fd=1&ac=1&it=500&pe=1%3A887%3A887%3A0%3A953&fs=186589&na=744233128&cs=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:37 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:37 GMT
GET H3-Q050	200	amp4ads-v0.mjs Show response cdn.ampproject.org/rtv/012010270040000/ Frame AF3B	180 KB 50 KB	24ms 7ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b2ab9ac436910017b9a2ca7db0e981bad3638db97f576d713eaa9b302e06c094 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 121524 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 51478 x-xss-protection 0 server sffe date Sun, 22 Nov 2020 09:11:13 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "0305d7d21a7fe4a1" accept-ranges bytes timing-allow-origin * expires Mon, 22 Nov 2021 09:11:13 GMT
GET H3-Q050	200	amp-ad-exit-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame AF3B	13 KB 5 KB	47ms 28ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-ad-exit-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ebab910fdc7c7e9e079caa9f7321177b135b2e1542f86ce36937ceb41865086d Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 189604 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4850 x-xss-protection 0 server sffe date Sat, 21 Nov 2020 14:16:33 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "77bd676d834aaa8d" accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 14:16:33 GMT
GET H3-Q050	200	amp-analytics-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame AF3B	90 KB 27 KB	48ms 30ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-analytics-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 477549a4d5fb644cda6bf64af01631b8411022d88e608bbd8e5a06e327b391cb Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 189604 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 27668 x-xss-protection 0 server sffe date Sat, 21 Nov 2020 14:16:33 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "1304c1c0caf7ca3c" accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 14:16:33 GMT
GET H3-Q050	200	amp-fit-text-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame AF3B	3 KB 1 KB	45ms 31ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-fit-text-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a86753d4effe5e607d4eaf03fe37eccb8cac743a528f874f736f4d7f35e094b1 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 121167 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1350 x-xss-protection 0 server sffe date Sun, 22 Nov 2020 09:17:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "12c034eb739190af" accept-ranges bytes timing-allow-origin * expires Mon, 22 Nov 2021 09:17:10 GMT
GET H3-Q050	200	amp-form-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame AF3B	41 KB 13 KB	46ms 32ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-form-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b61eb57ae77f31b91b04781da33023ecd897fda21f6c817e6c27623204046f42 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 189603 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13075 x-xss-protection 0 server sffe date Sat, 21 Nov 2020 14:16:34 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "1e8a1dae72af56cd" accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 14:16:34 GMT
GET H3-Q050	200	css fonts.googleapis.com/ Frame AF3B	4 KB 650 B	46ms 34ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&lang=fr Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2190c16423c2557bcb20ccba2edc176fbeb16e6a3de2b2af297f650aae85a43e Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff last-modified Mon, 23 Nov 2020 18:56:19 GMT server ESF link <https://fonts.gstatic.com>; rel=preconnect; crossorigin date Mon, 23 Nov 2020 18:56:37 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:37 GMT
GET H3-Q050	200	css fonts.googleapis.com/ Frame AF3B	4 KB 650 B	47ms 35ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&text= Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2190c16423c2557bcb20ccba2edc176fbeb16e6a3de2b2af297f650aae85a43e Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff last-modified Mon, 23 Nov 2020 18:14:07 GMT server ESF link <https://fonts.gstatic.com>; rel=preconnect; crossorigin date Mon, 23 Nov 2020 18:56:37 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:37 GMT
GET H3-Q050	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame AF3B	2 KB 3 KB	35ms 22ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 11:08:58 GMT x-content-type-options nosniff server cafe age 28059 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2502 x-xss-protection 0 expires Tue, 24 Nov 2020 11:08:58 GMT
GET H3-Q050	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame AF3B	295 B 384 B	38ms 26ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Sun, 22 Nov 2020 22:32:01 GMT x-content-type-options nosniff server cafe age 73476 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Mon, 23 Nov 2020 22:32:01 GMT
GET DATA	200 OK	truncated / Frame AF3B	211 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 51c615da447a1b56dc8139c64e19d15c3b325c7fcb0f5d5f5ccbf5416b930e26 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 2CCA	0 0	168ms 153ms	Fetch image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv5gdHxueeMq1kDIONEG1l2TdYDgd69HJjF6gJwLi3USPByLzgO8a_YiLkH-T4t8-LxPKTH9JiOcwY4RQjP98wU4ql28j4_lLFIjPZNYr3weELR2nUlXdroEPs-UeAwfYzmxWArfLKSr3gKzl0gpg11JQu_YLUmtM9YMB7BaEXL0iKOQqiR5RbjTxiWnPNfmBB-C2NB6aLxuvH4kgOIH3Z6H4gKt5KAFnKKkb1CxAlhv8R4Cb2h1BFu1tDEON36fth8hG0dX8bU&sig=Cg0ArKJSzDoXRhfM4_inEAE&urlfix=1&adurl= Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:37 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/1.7.1/ Frame 2CCA	92 KB 33 KB	48ms 11ms	Script text/javascript	2a00:1450:4001:801::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 20 Nov 2020 13:30:13 GMT content-encoding gzip x-content-type-options nosniff age 278784 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 33333 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Sat, 20 Nov 2021 13:30:13 GMT
GET H3-Q050	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame 2CCA	75 KB 29 KB	28ms 15ms	Script text/javascript	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5e72a6053c72fd8b75a2723a35b054605a26ed93fe36fa40c5cb1ace71322129 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:37 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1605702985553312" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 29194 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:37 GMT
GET H2	200	moatad.js Show response z.moatads.com/cbsdfp5832910442/ Frame 2CCA	320 KB 107 KB	62ms 41ms	Script application/x-javascript	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/cbsdfp5832910442/moatad.js Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 9291d9d87d61a0608d3a6b508cb92fa452e2ad612696a66716201dffdf968927 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:37 GMT content-encoding gzip last-modified Mon, 09 Nov 2020 21:24:39 GMT server AmazonS3 x-amz-request-id A1A0B3F940F1DAC9 etag "6a6dcf414007d90f491fd34c0ded6f44" vary Accept-Encoding content-type application/x-javascript cache-control max-age=38965 accept-ranges bytes content-length 108768 x-amz-id-2 UR43//usmS5qM1+drhO+VGGwyXg2cnXCFBwLWVAMph1p2VgbAm2TDGDUM47RWoyL9kOfX+yVfbU=
GET H2	200	view googleads4.g.doubleclick.net/pcs/ Frame 99C2	0 0	3686ms 301ms	Fetch image/gif	216.58.208.34 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssRSffDoP3lw0ysd1h-gxM2HqijHn7LJbt13myd6RIYlfzUiharZltzmj9Yz-8HpFDJQ0AnPkdUOcvhGOKS1W-AGnXCiic6aZTacg6xY6G3Wb0W9df-RAYNCQke88AIfbXhYOMisxafZBk2i7uXPA_9akKRaJ9QQgIsm_TI9t5-oqOUP8iVxRJJbK6EVGmaswMUFDJ6rLh3p_LuzkAU8UStxYvcUWvFwxVNw_qY4V-RxU33Dr2Dxs7m6scSecoCJZqb6Le4X5BttGXxvt-U8yMyHQ54SkhZkvknwS3CteetWEFQJdv1U33RmIeY7BPEGPV11IYO5aH66Xq7Z2s&sig=Cg0ArKJSzDpk2HAqFvExEAE&urlfix=1&adurl= Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.208.34 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra15s12-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:41 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H3-Q050	200	UFYwWwmt.js Show response tpc.googlesyndication.com/sodar/ Frame 99C2	41 KB 15 KB	25ms 20ms	Script text/javascript	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/UFYwWwmt.js Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 21 Nov 2020 13:32:56 GMT content-encoding gzip x-content-type-options nosniff age 192221 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15207 x-xss-protection 0 last-modified Tue, 03 Mar 2020 20:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 13:32:56 GMT
GET H3-Q050	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame 99C2	75 KB 29 KB	28ms 24ms	Script text/javascript	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5e72a6053c72fd8b75a2723a35b054605a26ed93fe36fa40c5cb1ace71322129 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:37 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1605702985553312" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 29194 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:37 GMT
GET H2	200	moatad.js Show response z.moatads.com/cbsdfp5832910442/ Frame 99C2	320 KB 107 KB	34ms 31ms	Script application/x-javascript	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/cbsdfp5832910442/moatad.js Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 9291d9d87d61a0608d3a6b508cb92fa452e2ad612696a66716201dffdf968927 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:37 GMT content-encoding gzip last-modified Mon, 09 Nov 2020 21:24:39 GMT server AmazonS3 x-amz-request-id A1A0B3F940F1DAC9 etag "6a6dcf414007d90f491fd34c0ded6f44" vary Accept-Encoding content-type application/x-javascript cache-control max-age=38965 accept-ranges bytes content-length 108768 x-amz-id-2 UR43//usmS5qM1+drhO+VGGwyXg2cnXCFBwLWVAMph1p2VgbAm2TDGDUM47RWoyL9kOfX+yVfbU=
GET H2	200	Leaderboard_Flytrap_FR__728x90_.jpg s0.2mdn.net/9322973/ Frame 99C2	43 KB 43 KB	269ms 223ms	Image image/jpeg	2a00:1450:4001:81f::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/9322973/Leaderboard_Flytrap_FR__728x90_.jpg Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d6f9af3dc90ba848c8845262027b1d256e4062574efcb3ce6d54d8bcc68f6e91 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:37 GMT x-content-type-options nosniff last-modified Tue, 03 Nov 2020 22:17:01 GMT server sffe content-type image/jpeg access-control-allow-origin * cache-control public, max-age=86400 cross-origin-resource-policy cross-origin accept-ranges bytes alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 43630 x-xss-protection 0 expires Tue, 24 Nov 2020 18:56:37 GMT
GET H3-Q050	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/8133901051422931270/ Frame AF3B	20 KB 20 KB	19ms 17ms	Image image/jpeg	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/8133901051422931270/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoIrAIQnQEYASABLQAAAD8wrAI4nQFFAACAPw&rs=AOga4qnCjawFS_y36zh0h5chaWAXQdQ2gw Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ea496cbd55aad75fb84e95392b1e99eb55acace0f4a5411eb5310e4eacbbcc1c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 22 Nov 2020 12:23:42 GMT x-content-type-options nosniff last-modified Wed, 30 Sep 2020 08:43:46 GMT server sffe age 109975 content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20790 x-xss-protection 0 expires Mon, 22 Nov 2021 12:23:42 GMT
GET H3-Q050	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/3964203029168414398/ Frame AF3B	23 KB 23 KB	19ms 16ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/3964203029168414398/downsize_200k_v1?sqp=4sqPyQR5QncIABIUDc3MzD4VAAAAQB0AAAAAJQAAAAAYACIKDQAAgD8VAACAPypPCFoQAR0AALRCIAEoATAGOANAgMLXL0gAUABYAGBacAJ4AIABAIgBAJABAJ0BAACAP6ABAKgBALABgK3iBLgB____________AcUBLbKdPg&rs=AOga4qluU2_8_ZIfS68teKjiZ9aCWq1Kxw Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e1b3702b64985614842c3a57db3f978f648debd99b49cfe65cb06148bf523a85 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 04:33:43 GMT x-content-type-options nosniff last-modified Fri, 10 Jan 2020 11:25:10 GMT server sffe age 570174 content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 23351 x-xss-protection 0 expires Wed, 17 Nov 2021 04:33:43 GMT
GET H3-Q050	200	adview securepubads.g.doubleclick.net/pagead/ Frame AF3B	0 0	107ms 91ms	Image text/html	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CcLbE4wW8X7-lL4eM3gPlsoX4CLujw5pgu6D854QMloLNhYgWEAEgzJGuImD7gYCAiAqgAf7buZgDyAEGqQLYLLf2iPezPuACAKgDAcgDCqoEyAJP0FOMpPSLhqfZseB_fNosQ7cqwfAQDGD70kFGqhV99LM5dz2xBdvFKSALbtf3YiSiNJH4rJPa5OKIZVzzHn-pRuVnlWjAhG5hHkOmnm6P6bt-YV7FvHa_WQwsTCh7t-6n1tJQxS_biUwNBzhvGO8fI5rpkcrtU2RVpd_I6_FrQukqAXQ_WbP8n3ma2YlhjsakAiTik7fX4kRcW8FzTft-wH38QJLs6jl2Fr10ogzy4ZLulZMI6MmfjDHM-ZddMc7-B3KqogIip-85t1ogxUWm-vMSP5dHueohtrF9c3tTiM3ZuQMT_hMMsM0BAFfSs7NIocybntN2QspM1BMvwPNQiOI6uS3jzCBp3372kjQQjGBvDkLWnVPp0idwgWZmnJDEvJuaotDdS553rUQsdC14J2lWOpCGe57Hu9bpP4rrUQQCOgdMYOdjwATr0PyCiAPgBAGSBQQIBBgBkgUECAUYBKAGN4AH6qPGZ6gH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAfIHAxCJL9IICQiA4YAQEAEYHYAKA8gLAdgTDIgUGbIXGgoYCAESFHB1Yi0xOTkxNjc5NjI0MzMxMzY5&sigh=U2Vqw2cgzLE&template_id=492&tpd=AGWhJmshjlzGzTy5Q-Bdv5kdYud6U8-SAnZTSLS631_Hf3LTyQ Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H3-Q050	204	l www.google.com/ads/measurement/ Frame AF3B	0 0	33ms 17ms	Image text/html	2a00:1450:4001:802::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaScx8QHuQoW8_la_8ARlMrQABGgD7tBy5JUT4PXCSuCm33347clU0vWkvSd5kMVeO1QDaJjDwrME67BM9j4ZkE38RPVFw Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H3-Q050	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/ Frame 1AE6	11 KB 11 KB	7ms 6ms	Font font/woff2	2a00:1450:4001:819::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=fr Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://www.zdnet.com Referer https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=fr User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 22 Nov 2020 17:20:24 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 92173 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11016 x-xss-protection 0 expires Mon, 22 Nov 2021 17:20:24 GMT
GET H3-Q050	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/ Frame 1AE6	11 KB 11 KB	8ms 7ms	Font font/woff2	2a00:1450:4001:819::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=fr Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://www.zdnet.com Referer https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=fr User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 22 Nov 2020 09:05:28 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 121869 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11056 x-xss-protection 0 expires Mon, 22 Nov 2021 09:05:28 GMT
GET H3-Q050	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/ Frame AF3B	11 KB 11 KB	14ms 13ms	Font font/woff2	2a00:1450:4001:819::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=fr Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://www.zdnet.com Referer https://fonts.googleapis.com/css?family=Roboto:400,500&lang=fr User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 22 Nov 2020 17:20:24 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 92173 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11016 x-xss-protection 0 expires Mon, 22 Nov 2021 17:20:24 GMT
GET H3-Q050	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/ Frame AF3B	11 KB 11 KB	12ms 9ms	Font font/woff2	2a00:1450:4001:819::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=fr Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://www.zdnet.com Referer https://fonts.googleapis.com/css?family=Roboto:400,500&lang=fr User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 22 Nov 2020 09:05:28 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 121869 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11056 x-xss-protection 0 expires Mon, 22 Nov 2021 09:05:28 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	40ms 39ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=CBS_PREBID_HEADER1&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=11&f=0&j=https%3A%2F%2Ft.co&t=1606157796238&de=568810459764&rx=820943480488&m=0&ar=a63e245-clean&iw=b2c8261&q=4&cb=0&cu=1606157796238&ll=2&lm=0&ln=0&em=0&en=0&d=25365849%3A465723849%3A4676441751%3A138290752599&zMoatAType=content_article&zMoatTest=zdnet&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&bo=aw-zdnet&bd=security&gw=cbsprebidheader506831276743&fd=1&ac=1&it=500&pe=1%3A887%3A887%3A0%3A953&fs=186589&na=769250802&cs=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:38 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:38 GMT
GET H3-Q050	200	gpt.js Show response www.googletagservices.com/tag/js/ Frame 0821	54 KB 18 KB	15ms 14ms	Script text/javascript	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/tag/js/gpt.js Requested by Host: rev.cbsi.com URL: https://rev.cbsi.com/common/js/adKit.min.js?1923904169 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e9d907851f1819dba110cb78d470209ab321d5c9440a70270d5a5387349c168a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:38 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "702 / 525 of 1000 / last-modified: 1606134211" vary Accept-Encoding content-type text/javascript cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 18520 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:38 GMT
GET DATA	200 OK	truncated / Frame 2CCA	214 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f08bc9eaaca365881b1d523c755b6aa7dbfe038e39cd4a5f78700d232fa524bd Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 2CCA	0 45 B	122ms 122ms	Image image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstNsyOWm-8vnyhZCb6of-OhdxWjugUGvRaKH_huJk-t-SClV5M4cxqugRa0ukontZNSAdrnjlXbVciy2yNUg0TcxfIRay1eZHEcyhmsGh73RDs4ROgN3IegrB2f08XYzxYemUk8YDbgCBwJk2ZKytStPZtCcvZzs8WHblPOnZUGJclq98tYaHt3PtKG5RMUZbFVZVdOqHdjpAKmrlNAJGMAnbZv75oJlOCNAboxJgtvwNY8-1iuJjcfctoY-0sIR9yiOASgdhBWalc&sig=Cg0ArKJSzCYna-dvZIeXEAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:38 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET DATA	200 OK	truncated / Frame 99C2	215 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f744d398e87729f79d16922cd6bf7036d93dd8ac81f41488faab921208523c2f Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	36ms 35ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=372&fi=1&apd=743&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=aw-zdnet&S2id=security&ord=1606157796238&r=135777613503&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:38 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:38 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	37ms 35ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=372&fi=1&apd=743&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=aw-zdnet&S2id=security&ord=1606157796238&r=135777613503&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:38 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:38 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	40ms 39ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=372&fi=1&apd=743&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=aw-zdnet&S2id=security&ord=1606157796238&r=135777613503&t=nht&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:38 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:38 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	40ms 39ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=20&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=29131449&L2id=2740158191&L3id=5467211422&L4id=138322013913&S1id=23586489&S2id=23600769&ord=1606157798551&r=381092721539&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=eb673923-32a8-443b-9c02-0d2653d01dd5&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=bottom&zMoatPT=article&zMoatSL=leader-plus-bottom%3FT-1000&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:38 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:38 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	41ms 40ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=20&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=29131449&L2id=2740158191&L3id=5467211422&L4id=138322013913&S1id=23586489&S2id=23600769&ord=1606157798551&r=381092721539&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=eb673923-32a8-443b-9c02-0d2653d01dd5&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=bottom&zMoatPT=article&zMoatSL=leader-plus-bottom%3FT-1000&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:38 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:38 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	34ms 31ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=534&fi=1&apd=905&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=aw-zdnet&S2id=security&ord=1606157796238&r=135777613503&t=hdn&os=1&fi2=0&div1=0&ait=81&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=4&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:38 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:38 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	33ms 32ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=10&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=aw-zdnet&S2id=security&ord=1606157796238&r=568810459764&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:38 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:38 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	34ms 34ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=10&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=aw-zdnet&S2id=security&ord=1606157796238&r=568810459764&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:38 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:38 GMT
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 56D8	0 22 B	48ms 47ms	Image image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstRV-yjk9WHgNYZSX6nR6zqHqtB7dBcS9_nQPBU398nYItCxb6KpS0_yTRnWkcPNHpxr5tx9qn2BBoQMCP9eIDSKLckLSI5y_TGEzM0U71aDML93lX95IimKqtWJzLmtpW9jzxnj_Bbz4mJzh2D6ZLSaK0nY-4rofl2_fsuWdHuW_2s46Q7fcRrNBIC1Tu0_wuCjsZ44t7LmJJd_5doSdsx77hbZpjqrKYr5LO7rZOBgGy8QiB272vVzGJ2bCdSgADas1oOCYKuA5DM52C-&sig=Cg0ArKJSzEC89bp3I_D7EAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:38 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame A62D	0 22 B	44ms 42ms	Image image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstq_IotHHC37-PEC-M6ywz--yqPfRbneGObn1gIUtsjaDUoJrx5d8A56CnzLQiX9K9EzqLsyJbL5hf0kC5a4Zb_MBfmiV34sILDgxLVaJQzATHkNHqj__j_rQhVXRgMD4MQ5Gu2V9AV7ybD9AYz8GCbSP7cU9ctr1gs_VkDIOSyYnfCA-aRX9oxDNartE4UNj-Cn95aW_ypKF11i_Z-SXLreG98gQJNyey1JCshiKHqGnNFK5HWo1aQJpKo-RSs529ZtJ0hojJsN8hPSF7l&sig=Cg0ArKJSzMt0NvKVrIu5EAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:38 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET DATA	200 OK	truncated / Frame 56D8	220 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 876ebd5fa32dc901507aabb59d73b2e2f0ec5fbe513e14c50313ffd600d26389 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated / Frame A62D	218 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 12e19ada1f6e84d0cd0170bf04e29d6d65ae4cb0451b005371b819b83d5965af Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	45ms 35ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=6&fi=0&apd=12&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=51085689&L2id=2753226908&L3id=5526751081&L4id=138329746587&S1id=23586489&S2id=23600769&ord=1606157798933&r=706121824992&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=eb673923-32a8-443b-9c02-0d2653d01dd5&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=top&zMoatPT=article&zMoatSL=mpu-plus-top%3FT-1000&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:38 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:38 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	45ms 36ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=6&fi=0&apd=12&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=51085689&L2id=2753226908&L3id=5526751081&L4id=138329746587&S1id=23586489&S2id=23600769&ord=1606157798933&r=706121824992&t=nht&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=eb673923-32a8-443b-9c02-0d2653d01dd5&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=top&zMoatPT=article&zMoatSL=mpu-plus-top%3FT-1000&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:38 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:38 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	37ms 36ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=353&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=aw-zdnet&S2id=security&ord=1606157796238&r=568810459764&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:39 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:39 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	36ms 34ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=343&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=aw-zdnet&S2id=security&ord=1606157796238&r=840078733663&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:39 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:39 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	34ms 34ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=343&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=aw-zdnet&S2id=security&ord=1606157796238&r=840078733663&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:39 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:39 GMT
GET H2	200	Enqz_20U.html tpc.googlesyndication.com/sodar/ Frame E91A	0 0	7ms 6ms	Document text/html	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/Enqz_20U.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /sodar/Enqz_20U.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin timing-allow-origin * content-length 8395 date Sat, 21 Nov 2020 13:32:58 GMT expires Sun, 21 Nov 2021 13:32:58 GMT last-modified Tue, 03 Mar 2020 20:15:00 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 192221 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	view securepubads.g.doubleclick.net/pcs/ Frame 99C2	0 173 B	42ms 42ms	Image image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssEcuAddVgcNer7NcZASVwnpvbo96tfthwN5_LxxmbnPbs6MNg1D25WvxVsTeulFdmsFcOiqPLF1wLUaWeyPy_0H1d3QFS5t4RG9VxylFlW0XZCJeEzLUVMLQfxwBHtRNQpjXGehk7CR9slv4svXG2HtQ3kwwJpIxaLBi-nuzSSvFgOBeTV2q_6RTHczKlWEIRww9SaIJ_yUUPuYnSdm8J6ObmsDlOiwV7itBM04JR_ybk5YMmC63tZLF0nqwNXzCbO8SGwKFM&sig=Cg0ArKJSzKYVKDCoZSnmEAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:39 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:39 GMT
POST H2	200	/ Show response www.zdnet.com/m3d0s1/recommend/dfp-in-article/	9 KB 3 KB	189ms 189ms	XHR application/json	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/m3d0s1/recommend/dfp-in-article/ Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 505a54528f240b5f9ecace2128e8ec0455b67b6a07e7b0c2da602de356aff441 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept */* Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-encoding gzip referrer-policy no-referrer-when-downgrade date Mon, 23 Nov 2020 18:56:39 GMT expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" x-frame-options SAMEORIGIN x-tx-id c4c75ff2-ff11-46be-b335-e053774c3370 content-type application/json cache-control max-age=5400, private x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload accept-ranges bytes vary Accept-Encoding, User-Agent x-xss-protection 1; mode=block expires Mon, 23 Nov 2020 20:26:39 GMT
GET H2	200	store.phtml ad.clipcentric.com/user-9/resources/ Frame 5926	0 0	73ms 42ms	Document text/html	65.9.86.41 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ad.clipcentric.com/user-9/resources/store.phtml?v200530 Requested by Host: clipcentric-a.akamaihd.net URL: https://clipcentric-a.akamaihd.net/ad/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/ad.js?q=1604705524 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.86.41 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.2.34 / Resource Hash Request headers :method GET :authority ad.clipcentric.com :scheme https :path /user-9/resources/store.phtml?v200530 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Response headers content-type text/html; charset=UTF-8 content-length 2976 date Mon, 19 Oct 2020 00:49:34 GMT server Apache/2.2.34 access-control-allow-origin * cache-control max-age=31536000 x-cache Hit from cloudfront via 1.1 609487f3e9c1fd7ddcc7b01d9818bfed.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-C1 x-amz-cf-id 3Y4KWW1O8I6FiZbpXqws_pVYwrqlG32iztoNUM_l8T3cZ162LlUNoA== age 3089225
GET H2	200	cbsi_ads_skyboxKit.js Show response rev.cbsi.com/common/js/ Frame 56D8	12 KB 3 KB	137ms 132ms	Script application/javascript	2a04:4e42:31::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://rev.cbsi.com/common/js/cbsi_ads_skyboxKit.js Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:31::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 4dbdcbed018562c656e6c5b5515ef82736596af03d573b06a50951d802f1e725 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:39 GMT content-encoding gzip vary Accept-Encoding age 2138 x-cache HIT content-length 2691 x-served-by cache-ewr18162-EWR access-control-allow-origin * last-modified Fri, 23 Oct 2020 17:13:17 GMT server AmazonS3 x-timer S1606157799.395369,VS0,VE0 etag "d0afa4a98aa5509aad29266c3dca9dbb" strict-transport-security max-age=300 content-type application/javascript via 1.1 varnish accept-ranges bytes x-cache-hits 113
GET DATA	200 OK	truncated / Frame 1174	750 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e9cac3eeba1fc86e06fdc013a4c52742e9b4bd14b7be6517321127d4515095ce Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	E=in,im,fi tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.151921.1606157799112/U=www.zdnet.com/T=211/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330866815/ Frame 56D8	35 B 136 B	168ms 92ms	Image image/gif	34.206.120.154 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.151921.1606157799112/U=www.zdnet.com/T=211/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330866815/E=in,im,fi Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.120.154 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-120-154.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:39 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	xlr9vC2d.webp clipcentric-a.akamaihd.net/file/1068966/ad_q75/1604705147/ Frame 56D8	16 KB 16 KB	91ms 27ms	Image image/webp	2.16.177.50 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://clipcentric-a.akamaihd.net/file/1068966/ad_q75/1604705147/xlr9vC2d.webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.177.50 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS a2-16-177-50.deploy.static.akamaitechnologies.com Software Apache/2.2.34 / Resource Hash 72abfb31f44d9d6ae87bfbebfe2e1eef8d44e58bd6f1603c764d029e9bcfae3e Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers access-control-allow-origin * date Mon, 23 Nov 2020 18:56:39 GMT cache-control max-age=31536000 last-modified Fri, 06 Nov 2020 23:32:08 GMT server Apache/2.2.34 content-length 16342 content-type image/webp
GET H2	200	w4dKN9Ed.webp clipcentric-a.akamaihd.net/file/1068964/ad_q75/1604705147/ Frame 56D8	15 KB 15 KB	106ms 42ms	Image image/webp	2.16.177.50 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://clipcentric-a.akamaihd.net/file/1068964/ad_q75/1604705147/w4dKN9Ed.webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.177.50 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS a2-16-177-50.deploy.static.akamaitechnologies.com Software Apache/2.2.34 / Resource Hash 9b4ca722833450a27d0f22918f250ba5882cadc1af54ac014d7c06f2b9805b1c Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers access-control-allow-origin * date Mon, 23 Nov 2020 18:56:39 GMT cache-control max-age=31536000 last-modified Fri, 06 Nov 2020 23:32:07 GMT server Apache/2.2.34 content-length 14862 content-type image/webp
GET H2	200	E=ls:load%20CBSi%20js%20file.0,li tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.151921.1606157799112/U=www.zdnet.com/T=228/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330866815/ Frame 56D8	35 B 136 B	158ms 94ms	Image image/gif	34.206.120.154 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.151921.1606157799112/U=www.zdnet.com/T=228/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330866815/E=ls:load%20CBSi%20js%20file.0,li Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.120.154 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-120-154.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:39 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	E=ls:Super%20Billboard.0 tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.151921.1606157799112/U=www.zdnet.com/T=244/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330866815/ Frame 56D8	35 B 136 B	157ms 93ms	Image image/gif	34.206.120.154 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.151921.1606157799112/U=www.zdnet.com/T=244/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330866815/E=ls:Super%20Billboard.0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.120.154 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-120-154.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:39 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	E=ls:hotspots%20collapsed.0 tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.151921.1606157799112/U=www.zdnet.com/T=350/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330866815/ Frame 56D8	35 B 136 B	158ms 96ms	Image image/gif	34.206.120.154 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.151921.1606157799112/U=www.zdnet.com/T=350/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330866815/E=ls:hotspots%20collapsed.0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.120.154 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-120-154.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:39 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	E=ls:on%20scroll%20full%20collapse.0 tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.151921.1606157799112/U=www.zdnet.com/T=350/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330866815/ Frame 56D8	35 B 136 B	153ms 92ms	Image image/gif	34.206.120.154 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.151921.1606157799112/U=www.zdnet.com/T=350/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330866815/E=ls:on%20scroll%20full%20collapse.0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.120.154 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-120-154.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:39 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	E=ls:custom%20ad%20controls.0 tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.151921.1606157799112/U=www.zdnet.com/T=357/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330866815/ Frame 56D8	35 B 136 B	159ms 98ms	Image image/gif	34.206.120.154 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.151921.1606157799112/U=www.zdnet.com/T=357/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330866815/E=ls:custom%20ad%20controls.0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.120.154 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-120-154.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:39 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	34ms 33ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=1175&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=29131449&L2id=2740158191&L3id=5467211422&L4id=138322013913&S1id=23586489&S2id=23600769&ord=1606157798551&r=381092721539&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=eb673923-32a8-443b-9c02-0d2653d01dd5&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=bottom&zMoatPT=article&zMoatSL=leader-plus-bottom%3FT-1000&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:39 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:39 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	39ms 39ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=1258&tet=1778&fi=1&apd=2149&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=aw-zdnet&S2id=security&ord=1606157796238&r=135777613503&t=iv&os=1&fi2=0&div1=1&ait=1325&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=5&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:39 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:39 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	40ms 39ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=1234&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=aw-zdnet&S2id=security&ord=1606157796238&r=840078733663&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:39 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:39 GMT
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame AF3B Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	47ms 43ms	Image text/html	2a00:1450:4001:806::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Redirect headers date Mon, 23 Nov 2020 18:56:40 GMT x-content-type-options nosniff server safe content-type text/html; charset=UTF-8 location https://googleads.g.doubleclick.net/pagead/drt/si cache-control private alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 246 x-xss-protection 0
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	38ms 37ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=CBS_PREBID_HEADER1&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=11&f=0&j=https%3A%2F%2Ft.co&t=1606157796238&de=840078733663&rx=820943480488&m=0&ar=a63e245-clean&iw=b2c8261&q=5&cb=0&cu=1606157796238&ll=2&lm=0&ln=0&em=0&en=0&d=25365849%3A465723849%3A4676441751%3A138290752599&zMoatAType=content_article&zMoatTest=zdnet&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&bo=aw-zdnet&bd=security&gw=cbsprebidheader506831276743&fd=1&ac=1&it=500&pe=1%3A887%3A887%3A0%3A953&fs=186589&na=649503089&cs=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:40 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:40 GMT
GET H3-Q050	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/8133901051422931270/ Frame AF3B	20 KB 20 KB	7ms 7ms	Image image/jpeg	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/8133901051422931270/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoIrAIQnQEYASABLQAAAD8wrAI4nQFFAACAPw&rs=AOga4qnCjawFS_y36zh0h5chaWAXQdQ2gw Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ea496cbd55aad75fb84e95392b1e99eb55acace0f4a5411eb5310e4eacbbcc1c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 22 Nov 2020 12:23:42 GMT x-content-type-options nosniff last-modified Wed, 30 Sep 2020 08:43:46 GMT server sffe age 109978 content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20790 x-xss-protection 0 expires Mon, 22 Nov 2021 12:23:42 GMT
GET H3-Q050	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/3964203029168414398/ Frame AF3B	23 KB 23 KB	10ms 9ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/3964203029168414398/downsize_200k_v1?sqp=4sqPyQR5QncIABIUDc3MzD4VAAAAQB0AAAAAJQAAAAAYACIKDQAAgD8VAACAPypPCFoQAR0AALRCIAEoATAGOANAgMLXL0gAUABYAGBacAJ4AIABAIgBAJABAJ0BAACAP6ABAKgBALABgK3iBLgB____________AcUBLbKdPg&rs=AOga4qluU2_8_ZIfS68teKjiZ9aCWq1Kxw Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e1b3702b64985614842c3a57db3f978f648debd99b49cfe65cb06148bf523a85 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 04:33:43 GMT x-content-type-options nosniff last-modified Fri, 10 Jan 2020 11:25:10 GMT server sffe age 570177 content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 23351 x-xss-protection 0 expires Wed, 17 Nov 2021 04:33:43 GMT
GET H3-Q050	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame AF3B	2 KB 2 KB	10ms 9ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 11:08:58 GMT x-content-type-options nosniff server cafe age 28062 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2502 x-xss-protection 0 expires Tue, 24 Nov 2020 11:08:58 GMT
GET H3-Q050	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame AF3B	295 B 325 B	10ms 9ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Sun, 22 Nov 2020 22:32:01 GMT x-content-type-options nosniff server cafe age 73479 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Mon, 23 Nov 2020 22:32:01 GMT
GET H2	200	expertGroup_125x100.jpg static.cbsileads.com/direct/images/doctype/ Redirect Chain https://www.cbsileads.com/direct/images/doctype/expertGroup_125x100.jpg https://static.cbsileads.com/direct/images/doctype/expertGroup_125x100.jpg	4 KB 4 KB	487ms 374ms	Image image/jpeg	35.190.21.111 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://static.cbsileads.com/direct/images/doctype/expertGroup_125x100.jpg Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.190.21.111 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS 111.21.190.35.bc.googleusercontent.com Software UploadServer / Resource Hash c2d107b2b6fd34efc47d3ee61f5a41eb49548e0788beed0a16705f292d31702c Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:40 GMT x-goog-meta-goog-reserved-file-mtime 1553141219 x-guploader-uploadid ABg5-UyYOln6cVxlCcv6cD56eaHDhxsux6hBgBGY4BZur415wSwYgd7fP_YB8dwhgCrxE2nHtepTTaAEAPCR0n_e_Fs x-goog-storage-class REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc clear content-length 3639 last-modified Sat, 24 Aug 2019 01:05:59 GMT server UploadServer etag "c97a073917dd5295aab139330be15303" x-goog-hash crc32c=xc5N/Q==, md5=yXoHORfdUpWqsTkzC+FTAw== content-language en x-goog-generation 1566608759879532 cache-control public, max-age=3600 x-goog-stored-content-length 3639 accept-ranges bytes content-type image/jpeg expires Mon, 23 Nov 2020 19:56:40 GMT Redirect headers location https://static.cbsileads.com/direct/images/doctype/expertGroup_125x100.jpg date Mon, 23 Nov 2020 18:56:40 GMT via 1.1 google server nginx alt-svc clear content-length 162 content-type text/html
GET H2	200	0.4912198988318439 saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/	43 B 209 B	32ms 30ms	Image image/gif	15.237.136.106 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/0.4912198988318439?AQB=1&ce=UTF%2D8&events=event66&v0=ftag_cd:TRE-00-10aaa4f&v2=en&v3=desktop&v4=dfp-in-article&v5=zdnet&v10=&v20=&v22=&v23=&v24=&v30=&v60=33164009&v64=1065&v69=&c0=D%3Dv0&c2=D%3Dv2&c3=D%3Dv3&c4=D%3Dv4&c5=D%3Dv5&c10=D%3Dv10&c20=D%3Dv20&c22=D%3Dv22&c23=D%3Dv23&c24=D%3Dv24&c30=D%3Dv30&c60=D%3Dv60&c64=D%3Dv64&c69=D%3Dv69&pe=lnk_o&pev2=medusa_impression&vid=202011232-leadgen-zdnet&mid=90240133173074011141898988208131324462&aid=2D535D450507F28B-40000106A0001145&AQE=1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 15.237.136.106 Paris, France, ASN16509 (AMAZON-02, US), Reverse DNS ec2-15-237-136-106.eu-west-3.compute.amazonaws.com Software jag / Resource Hash a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:39 GMT x-content-type-options nosniff x-c master-1404.I1e61f9.M0-468 p3p CP="This is not a P3P policy" vary * content-length 43 x-xss-protection 1; mode=block pragma no-cache last-modified Tue, 24 Nov 2020 18:56:40 GMT server jag xserver anedge-f7bfdfcfd-h2pfg etag 3449197611692949504-4621761064581080942 strict-transport-security max-age=31536000; includeSubDomains content-type image/gif;charset=utf-8 access-control-allow-origin * cache-control no-cache, no-store, max-age=0, no-transform, private expires Sun, 22 Nov 2020 18:56:40 GMT
GET H2	200	pixel.png im.cbsileads.com/	609 B 778 B	160ms 156ms	Image image/png	34.120.132.76 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://im.cbsileads.com/pixel.png?spotname=dfp-in-article&docid=33164009&pagetype=&topicname=Project+Management&devicetype=desktop&lon=&promo=1065&site=zdnet&ursid=&tid=2311201856392002026 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.120.132.76 , United States, ASN15169 (GOOGLE, US), Reverse DNS 76.132.120.34.bc.googleusercontent.com Software UploadServer / Resource Hash 0b960c8f9b3fb4ca1d0b1f43e40b5defd11dbf0fd60ebad49ad50ecc06119170 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:40 GMT x-guploader-uploadid ABg5-UygbS_WAlhf4J4X8y1MePC5nKgFgJzKPlmEWxcCbi1E8vvi5n4DDfwHtZFHdGcQBRQ_DG2HOHh7TgPmJa73Eok x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc clear content-length 609 last-modified Tue, 23 Jun 2020 01:31:20 GMT server UploadServer etag "6802175f61adc40617e8ba87a30aa6bd" x-goog-hash crc32c=Yf0PfA==, md5=aAIXX2GtxAYX6LqHowqmvQ== content-language en x-goog-generation 1592875880921192 cache-control no-cache,max-age=0 x-goog-stored-content-length 609 accept-ranges bytes content-type image/png expires Mon, 23 Nov 2020 18:56:40 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	34ms 34ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=12&tet=1242&fi=0&apd=1248&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=51085689&L2id=2753226908&L3id=5526751081&L4id=138329746587&S1id=23586489&S2id=23600769&ord=1606157798933&r=706121824992&t=iv&os=1&fi2=0&div1=0&ait=618&zMoatVGUID=eb673923-32a8-443b-9c02-0d2653d01dd5&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=top&zMoatPT=article&zMoatSL=mpu-plus-top%3FT-1000&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:40 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:40 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	35ms 34ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=12&tet=1242&fi=0&apd=1248&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=51085689&L2id=2753226908&L3id=5526751081&L4id=138329746587&S1id=23586489&S2id=23600769&ord=1606157798933&r=706121824992&t=hdn&os=1&fi2=0&div1=0&ait=618&zMoatVGUID=eb673923-32a8-443b-9c02-0d2653d01dd5&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=top&zMoatPT=article&zMoatSL=mpu-plus-top%3FT-1000&bedc=1&q=4&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:40 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:40 GMT
GET H2	200	E=wi tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.151921.1606157799112/U=www.zdnet.com/T=1108/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330866815/ Frame 56D8	35 B 136 B	140ms 101ms	Image image/gif	34.206.120.154 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.151921.1606157799112/U=www.zdnet.com/T=1108/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330866815/E=wi Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.120.154 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-120-154.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:40 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	39ms 35ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=3&fi=1&apd=6&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=67075449&L2id=2774809331&L3id=5536907755&L4id=138330866815&S1id=23586489&S2id=23600769&ord=1606157798988&r=984731021342&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=eb673923-32a8-443b-9c02-0d2653d01dd5&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=nav&zMoatPT=article&zMoatSL=nav-ad%3FT-1000&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:40 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:40 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	42ms 39ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=3&fi=1&apd=6&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=67075449&L2id=2774809331&L3id=5536907755&L4id=138330866815&S1id=23586489&S2id=23600769&ord=1606157798988&r=984731021342&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=eb673923-32a8-443b-9c02-0d2653d01dd5&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=nav&zMoatPT=article&zMoatSL=nav-ad%3FT-1000&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:40 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:40 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	42ms 39ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=3&fi=1&apd=6&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=67075449&L2id=2774809331&L3id=5536907755&L4id=138330866815&S1id=23586489&S2id=23600769&ord=1606157798988&r=984731021342&t=nht&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=eb673923-32a8-443b-9c02-0d2653d01dd5&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=nav&zMoatPT=article&zMoatSL=nav-ad%3FT-1000&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:40 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:40 GMT
GET H3-Q050	200	si googleads.g.doubleclick.net/pagead/drt/ Frame 1AE6 Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	111ms 94ms	Image text/html	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Redirect headers date Mon, 23 Nov 2020 18:56:40 GMT x-content-type-options nosniff server safe content-type text/html; charset=UTF-8 location https://googleads.g.doubleclick.net/pagead/drt/si cache-control private alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 246 x-xss-protection 0
GET H3-Q050	200	si googleads.g.doubleclick.net/pagead/drt/ Frame 898F Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	97ms 38ms	Image text/html	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Redirect headers date Mon, 23 Nov 2020 18:56:40 GMT x-content-type-options nosniff server safe content-type text/html; charset=UTF-8 location https://googleads.g.doubleclick.net/pagead/drt/si cache-control private alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 246 x-xss-protection 0
GET H3-Q050	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/11253319325380860251/ Frame 1AE6	31 KB 31 KB	8ms 6ms	Image image/jpeg	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/11253319325380860251/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoI2gMQ-AEYASABLQAAAD8w2gM4-AFFAACAPw&rs=AOga4qngw5zs6rQKmhlqcFQxkZZ0oJOwfg Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2b88380497b9347aff99bca5742fdcd5572e021a59b4f3f9c3477caaf76de35b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 13:15:45 GMT x-content-type-options nosniff last-modified Fri, 11 Sep 2020 10:24:32 GMT server sffe age 538855 content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31511 x-xss-protection 0 expires Wed, 17 Nov 2021 13:15:45 GMT
GET H3-Q050	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/10247368670396149040/ Frame 1AE6	20 KB 20 KB	17ms 16ms	Image image/jpeg	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/10247368670396149040/downsize_200k_v1?sqp=4sqPyQSLAUKIAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-Mg8I2AQQ2AQYASABLQAAAD8&rs=AOga4qlPY2iaUapHNAvGzMrRT9878iFZCg Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9e879f510057a9402ebcd35912a42e45b3387f7a2a1c053a4b9794a512b2feca Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 19 Nov 2020 07:10:52 GMT x-content-type-options nosniff last-modified Wed, 26 Aug 2020 06:41:17 GMT server sffe age 387948 content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20480 x-xss-protection 0 expires Fri, 19 Nov 2021 07:10:52 GMT
GET H3-Q050	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 1AE6	2 KB 3 KB	16ms 15ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 11:08:58 GMT x-content-type-options nosniff server cafe age 28062 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2502 x-xss-protection 0 expires Tue, 24 Nov 2020 11:08:58 GMT
GET H3-Q050	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 1AE6	295 B 322 B	16ms 15ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Sun, 22 Nov 2020 22:32:01 GMT x-content-type-options nosniff server cafe age 73479 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Mon, 23 Nov 2020 22:32:01 GMT
GET H2	200	E=ls:on%20scroll%20full%20collapse.1 tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.151921.1606157799112/U=www.zdnet.com/T=1405/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330866815/ Frame 56D8	35 B 136 B	100ms 99ms	Image image/gif	34.206.120.154 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.151921.1606157799112/U=www.zdnet.com/T=1405/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330866815/E=ls:on%20scroll%20full%20collapse.1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.120.154 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-120-154.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:40 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H3-Q050	200	pubads_impl_2020111801.js Show response securepubads.g.doubleclick.net/gpt/ Frame 0821	277 KB 98 KB	44ms 40ms	Script text/javascript	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111801.js?21068793 Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/tag/js/gpt.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software sffe / Resource Hash 35b7f92fe5fa921ff5e686240c5951435b762f2b0b966b3f127245e086e26991 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:40 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 18 Nov 2020 09:41:37 GMT server sffe vary Accept-Encoding content-type text/javascript cache-control private, immutable, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 99950 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:40 GMT
GET DATA	200 OK	truncated / Frame 1174	801 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 2b526196d510bc11f40effba13f1b9e1792120b1f40b453695e8d7dcc05cf38d Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml
GET H3-Q050	200	9093566140434273067 tpc.googlesyndication.com/simgad/ Frame 898F	57 KB 57 KB	6ms 6ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/9093566140434273067?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qletDXFK28fwiVfUwtVSVKA46BBJA Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7d4d7989b416200fba8a0da88650d706810dc6eb34ae3908eaede5ed564cb975 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 10:11:28 GMT x-content-type-options nosniff last-modified Thu, 24 Sep 2020 05:15:35 GMT server sffe age 31512 content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 58612 x-xss-protection 0 expires Tue, 23 Nov 2021 10:11:28 GMT
GET H3-Q050	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 898F	2 KB 2 KB	8ms 6ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 11:08:58 GMT x-content-type-options nosniff server cafe age 28062 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2502 x-xss-protection 0 expires Tue, 24 Nov 2020 11:08:58 GMT
GET H3-Q050	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 898F	295 B 322 B	7ms 7ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Sun, 22 Nov 2020 22:32:01 GMT x-content-type-options nosniff server cafe age 73479 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Mon, 23 Nov 2020 22:32:01 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	134ms 36ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=507&fi=1&apd=510&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=67075449&L2id=2774809331&L3id=5536907755&L4id=138330866815&S1id=23586489&S2id=23600769&ord=1606157798988&r=984731021342&t=hdn&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=eb673923-32a8-443b-9c02-0d2653d01dd5&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=nav&zMoatPT=article&zMoatSL=nav-ad%3FT-1000&bedc=1&q=4&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:40 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:40 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	35ms 34ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F11253319325380860251%2Fdownsize_200k_v1%3Fsqp%3D4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoI2gMQ-AEYASABLQAAAD8w2gM4-AFFAACAPw%26rs%3DAOga4qngw5zs6rQKmhlqcFQxkZZ0oJOwfg&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=248&w=474&rm=1&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=https%3A%2F%2Ft.co&t=1606157796238&de=135777613503&rx=820943480488&cu=1606157796238&m=2303&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=8428&le=1&lf=716&lg=1&lh=85&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A887%3A887%3A0%3A953&as=0&ag=372&an=0&gf=372&gg=0&ix=372&ic=372&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=372&bx=0&dj=1&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=743&cd=0&ah=743&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=aw-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=186589&na=2118021650&cs=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:40 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:40 GMT
GET H2	200	integrator.js Show response adservice.google.de/adsid/ Frame 0821	109 B 169 B	18ms 17ms	Script application/javascript	2a00:1450:4001:81c::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111801.js?21068793 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:41 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 104 x-xss-protection 0
GET H2	200	integrator.js Show response adservice.google.com/adsid/ Frame 0821	109 B 169 B	19ms 18ms	Script application/javascript	2a00:1450:4001:806::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111801.js?21068793 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:41 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 104 x-xss-protection 0
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/ Frame 0821	17 KB 5 KB	299ms 298ms	XHR text/plain	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=56105006463552&correlator=4398875695928540&output=ldjh&impl=fifs&eid=21068727%2C21068793%2C21068418%2C21068480&vrg=2020111801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201123&iu_parts=8264%2Caw-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=372x142%2C372x142&prev_scp=env%3Dprod%26session%3Dd%26subses%3D4%26ptype%3Darticle%26vguid%3Deb673923-32a8-443b-9c02-0d2653d01dd5%7Cenv%3Dprod%26session%3Dd%26subses%3D4%26ptype%3Darticle%26vguid%3Deb673923-32a8-443b-9c02-0d2653d01dd5&cookie_enabled=1&cdm=www.zdnet.com&bc=31&abxe=1&lmt=1606157801&dt=1606157801078&dlt=1606157797358&idt=3686&frm=23&biw=1600&bih=1200&isw=371&ish=771&oid=3&adxs=-12245933%2C-12245933&adys=-12245933%2C-12245933&adks=2442809372%2C2442809371&ucis=eih74rl1xa3t%7Cl8y451lyrl7c&ifi=1&ifk=2345846311&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&top=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&dssz=13&icsg=10888&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0%7C0x0&msz=0x0%7C0x0&ga_vid=424039904.1606157801&ga_sid=1606157801&ga_hid=1489938020&fws=256%2C256&ohw=0%2C0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111801.js?21068793 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash 36a25d47d18aaf2c4f31c7bff63da0be73f1db752273d1608283baf027660ac0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:41 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2,-2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4662 x-xss-protection 0 google-lineitem-id 4746066197,4746066197 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id 138239468731,138239375540 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.zdnet.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	container.html 26a162762980aaa11d0e8196c3758fda.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 0821	0 0	85ms 22ms	Other text/html	2a00:1450:4001:817::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://26a162762980aaa11d0e8196c3758fda.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html?n=1 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111801.js?21068793 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:817::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	43ms 42ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F9093566140434273067%3Fsqp%3D4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4%26rs%3DAOga4qletDXFK28fwiVfUwtVSVKA46BBJA&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&rm=1&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=https%3A%2F%2Ft.co&t=1606157796238&de=568810459764&rx=820943480488&cu=1606157796238&m=2459&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=8428&le=1&lf=716&lg=1&lh=85&ch=0&vv=1&vw=1%3A0%3A0&vp=0&vx=0%3A-%3A-&pe=1%3A887%3A887%3A0%3A953&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=10&cd=0&ah=10&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=aw-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&tc=0&fs=186589&na=892588301&cs=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:41 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:41 GMT
GET H3-Q050	200	activeview pagead2.googlesyndication.com/pcs/ Frame 56D8	42 B 66 B	16ms 14ms	Image image/gif	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstn4Djr1hMPzbXqNRPCvZMp9nRa9TgTObDCMcCBLCmIBLyjhGwebBwJlaTUZ5uqp0rE0sYPD2t0yN0BsoynGpGyunYXy0UsQFL0nRx7-0A&sig=Cg0ArKJSzKhInFsK4r6yEAE&adk=301620764&tt=-1&bs=1600%2C1200&mtos=1073,1073,1073,1073,1073&tos=1073,0,0,0,0&p=0,0,105,1600&mcvt=1073&rs=0&ht=0&tfs=1245&tls=2318&mc=1&lte=-1&bas=0&bac=0&met=ce&avms=nio&niot_obs=4&niot_cbk=1245&md=2&btr=0&cpmav=0&lm=2&rst&dlt&rpt&isd&msd&xdi=0&postrxl=1&ps=1600%2C9485&scs=1600%2C1200&pt=-1&bin=4&deb=1-0-0-5-4-4-4-0-0-0&tvt=2315&is=1600%2C105&iframe_loc=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&r=v&id=osdim&vs=4&uc=5&upc=1&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20201118 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:41 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	activeview pagead2.googlesyndication.com/pcs/ Frame A62D	42 B 66 B	22ms 22ms	Image image/gif	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuWLBm0Ltq726ewxl0tjBC5RrnAKrDLfspfoo3rstvphPN8GG4-_d0EmwfAE24QQMxH5STn3d7oRXs-FIZSoZ-Z6o7WvygAd_Up2X3G6Ws&sig=Cg0ArKJSzKUQSBGZTTI1EAE&adk=2729011605&tt=-1&bs=1600%2C1200&mtos=0,1171,1171,1171,1171&tos=0,1171,0,0,0&p=745,1050,1345,1350&mcvt=1171&rs=0&ht=0&tfs=1236&tls=2407&mc=0.88&lte=-1&bas=0&bac=0&met=mue&avms=nio&niot_obs=3&niot_cbk=1236&md=2&btr=0&cpmav=0&lm=2&rst&dlt&rpt&isd&msd&xdi=0&postrxl=1&ps=1600%2C9485&scs=1600%2C1200&pt=-1&bin=4&deb=1-0-0-5-3-4-4-0-0-0&tvt=2413&is=300%2C600&iframe_loc=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&r=v&id=osdim&vs=4&uc=5&upc=2&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20201118 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:41 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	43ms 34ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=806&tet=1061&fi=1&apd=1064&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=67075449&L2id=2774809331&L3id=5536907755&L4id=138330866815&S1id=23586489&S2id=23600769&ord=1606157798988&r=984731021342&t=iv&os=1&fi2=0&div1=1&ait=0&zMoatVGUID=eb673923-32a8-443b-9c02-0d2653d01dd5&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=nav&zMoatPT=article&zMoatSL=nav-ad%3FT-1000&bedc=1&q=5&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:41 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:41 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	52ms 40ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F8133901051422931270%2Fdownsize_200k_v1%3Fsqp%3D4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoIrAIQnQEYASABLQAAAD8wrAI4nQFFAACAPw%26rs%3DAOga4qnCjawFS_y36zh0h5chaWAXQdQ2gw&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=157&w=300&rm=1&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=https%3A%2F%2Ft.co&t=1606157796238&de=840078733663&rx=820943480488&cu=1606157796238&m=2798&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=8428&le=1&lf=716&lg=1&lh=85&ch=0&vv=1&vw=1%3A0%3A0&vp=0&vx=0%3A-%3A-&pe=1%3A887%3A887%3A0%3A953&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=343&cd=0&ah=343&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=aw-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&tc=0&fs=186589&na=962337341&cs=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:41 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:41 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	43ms 43ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=26&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=29307369&L2id=452196489&L3id=316148409&L4id=101222456769&S1id=23586489&S2id=23600769&ord=1606157798416&r=374727933919&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=eb673923-32a8-443b-9c02-0d2653d01dd5&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=top&zMoatPT=article&zMoatSL=sharethrough-top%3FT-1000&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:41 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:41 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	43ms 42ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=26&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=29307369&L2id=452196489&L3id=316148409&L4id=101222456769&S1id=23586489&S2id=23600769&ord=1606157798416&r=374727933919&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=eb673923-32a8-443b-9c02-0d2653d01dd5&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=top&zMoatPT=article&zMoatSL=sharethrough-top%3FT-1000&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:41 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:41 GMT
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 0821	0 182 B	393ms 257ms	Image image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuuFduiGpOisQ9RJiE4OdOba_BW_12rqb8W5pjgcadPXTp6r9SuC21sra-0Hqx1vBXbt5hEFnUGRJDxeqYlpQS67u-iJDRRcXIx1o0sQmKwxDMv_uyWHqUuymJn1bAU4gAMxmw3fgg0rdp-v2NsRWAx9dII6iy3lSd087P-QfVJVTKINBKQbpCyzVQZdtvkvCKYAOH0Petice9SdFDqEuxo3QSuIvuAjwh5Wo1Jbhs6ibiPqazt60fadGkUMU364DLa3nbLnMAU2ZU&sig=Cg0ArKJSzLGWjvoOvOX7EAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:41 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:41 GMT
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 56DF	0 0	277ms 255ms	Fetch image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuX9QQSe3PQgrOLvMN55jX_Ei6cYCFmVDnHtD9nFLl_rP-h-94LrMmVJGCDPo2P-XFB2DS3UoibwFe1_riXKKxRcoJvBXBNMAegUehDmwGf4rJSVy9Ne7qwvdMnlhtVpSGxtqfpAwoHN6fBbbtfIRw3KENdMDFjdm0264iYJRyKAdsubvkQCCVGez9pgnJY9Dfjdl-DMyzcsm1PXJ7uUEWPfQZ9rTS5a1M5YX7jRHjlNewoIW5rNTqrNHqmQRDByfheKKvyEHy3&sig=Cg0ArKJSzIAxi-BDque1EAE&urlfix=1&adurl= Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:41 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H2	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame 56DF	75 KB 29 KB	68ms 45ms	Script text/javascript	2a00:1450:4001:808::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111801.js?21068793 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5e72a6053c72fd8b75a2723a35b054605a26ed93fe36fa40c5cb1ace71322129 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:41 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1605702985553312" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 29194 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:41 GMT
GET H2	200	moatad.js Show response z.moatads.com/cbsdfp5832910442/ Frame 56DF	320 KB 107 KB	62ms 39ms	Script application/x-javascript	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/cbsdfp5832910442/moatad.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111801.js?21068793 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 9291d9d87d61a0608d3a6b508cb92fa452e2ad612696a66716201dffdf968927 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:41 GMT content-encoding gzip last-modified Mon, 09 Nov 2020 21:24:39 GMT server AmazonS3 x-amz-request-id A1A0B3F940F1DAC9 etag "6a6dcf414007d90f491fd34c0ded6f44" vary Accept-Encoding content-type application/x-javascript cache-control max-age=38961 accept-ranges bytes content-length 108768 x-amz-id-2 UR43//usmS5qM1+drhO+VGGwyXg2cnXCFBwLWVAMph1p2VgbAm2TDGDUM47RWoyL9kOfX+yVfbU=
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 2DCE	0 0	265ms 255ms	Fetch image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsueHwAm8j7WeE2C28OOWnJRL-JRAl3oNvOS4Mh55_yBcN9qKk1RQtGu6YZrungeiX6GgplTzshRRlaAZRsFHK8jlgq6FWpp5Bcf9OCEqdQlHQNKVoJpOP4zM57bLcTUBgocWXZP5b2VQhoK5TsaXSc4dTl8XaL6w2bqFwTzLETStVLD6-DCeiI4Qt8VlHmBC_dxgMHcJl7oHhat4wUboncTvJlbra20nXnE1hS0izinb8bPgyGhUuLWWkpiMCKoa0jfnRTfc0TH&sig=Cg0ArKJSzLq4aAgZjd_rEAE&urlfix=1&adurl= Requested by Host: t.co URL: https://t.co/cejlFPR8a9 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:41 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H2	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame 2DCE	75 KB 29 KB	52ms 43ms	Script text/javascript	2a00:1450:4001:808::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111801.js?21068793 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5e72a6053c72fd8b75a2723a35b054605a26ed93fe36fa40c5cb1ace71322129 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:41 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1605702985553312" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 29194 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:41 GMT
GET H2	200	moatad.js Show response z.moatads.com/cbsdfp5832910442/ Frame 2DCE	320 KB 107 KB	56ms 47ms	Script application/x-javascript	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/cbsdfp5832910442/moatad.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111801.js?21068793 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 9291d9d87d61a0608d3a6b508cb92fa452e2ad612696a66716201dffdf968927 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:41 GMT content-encoding gzip last-modified Mon, 09 Nov 2020 21:24:39 GMT server AmazonS3 x-amz-request-id A1A0B3F940F1DAC9 etag "6a6dcf414007d90f491fd34c0ded6f44" vary Accept-Encoding content-type application/x-javascript cache-control max-age=38961 accept-ranges bytes content-length 108768 x-amz-id-2 UR43//usmS5qM1+drhO+VGGwyXg2cnXCFBwLWVAMph1p2VgbAm2TDGDUM47RWoyL9kOfX+yVfbU=
GET H2	200	osd.js Show response www.googletagservices.com/activeview/js/current/ Frame 0821	73 KB 28 KB	52ms 44ms	Script text/javascript	2a00:1450:4001:808::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111801.js?21068793 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d56ee6a2ba915ad87e2dc9b49d9199563f3b35f9e048938e84d1a033e5c2b1c5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:41 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1605702985553312" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 28207 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:41 GMT
GET H3-Q050	200	sodar Show response pagead2.googlesyndication.com/getconfig/ Frame 0821	8 KB 6 KB	22ms 20ms	XHR application/json	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020111801&st=env Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111801.js?21068793 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash c8c14fbd46e4767087497e3f4e7eadcde0798a8b93c2f0b724f8ea2503567967 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:41 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 6400 x-xss-protection 0
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	57ms 56ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=248&w=474&rm=1&fy=1&gp=1&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=https%3A%2F%2Ft.co&t=1606157796238&de=135777613503&rx=820943480488&cu=1606157796238&m=3686&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=1&lb=8503&le=1&lf=716&lg=1&lh=85&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A887%3A887%3A0%3A953&as=1&ag=1778&an=372&gi=1&gf=1778&gg=372&ix=1778&ic=1778&ez=1&ck=1778&kw=1258&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1778&bx=372&ci=1778&jz=1258&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1258&cd=743&ah=1258&am=743&rf=0&re=1&ft=1325&fv=0&fw=1325&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=aw-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=186589&na=1582652266&cs=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:41 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:41 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	56ms 55ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=214&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=29307369&L2id=452196489&L3id=316148409&L4id=101222456769&S1id=23586489&S2id=23600769&ord=1606157798416&r=374727933919&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=eb673923-32a8-443b-9c02-0d2653d01dd5&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=top&zMoatPT=article&zMoatSL=sharethrough-top%3FT-1000&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:41 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:41 GMT
GET H3-Q050	200	sodar2.js Show response tpc.googlesyndication.com/sodar/ Frame 0821	16 KB 6 KB	46ms 18ms	Script text/javascript	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111801.js?21068793 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:41 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1603823857801521" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6015 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:41 GMT
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 56DF	0 22 B	119ms 118ms	Image image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvYJ7JcNMc7ksmJLW4FeWWi1CvwsRhsf1Z05VYg2EvJYqm8XYKouKgwz1o7lqXYm9azE5w2jLqPfV_SdURykSI_sgFUs8NO2Ff_qaUp-nHxykBZ72FKMx8Vhbmq8VLjzuX7kC2mj6hYl_mIho_Vi_0kbWCIoum4gBI00TaB0rV-a7FTuVgabDGBk6tbkTytH1qSxl_8059cX34-AU3oX3KVufaowdrSrntJ3zZfU83fb2uXeEoq0JIi75SLH6JxYY6L9usXeeOsXXU&sig=Cg0ArKJSzF2cl6lms_18EAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:41 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	36ms 35ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=248&w=474&rm=1&fy=1&gp=1&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=https%3A%2F%2Ft.co&t=1606157796238&de=135777613503&rx=820943480488&cu=1606157796238&m=3720&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=1&lb=8503&le=1&lf=716&lg=1&lh=85&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A887%3A887%3A0%3A953&as=1&ag=1778&an=1778&gi=1&gf=1778&gg=1778&ix=1778&ic=1778&ez=1&ck=1778&kw=1258&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1778&bx=1778&ci=1778&jz=1258&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1258&cd=1258&ah=1258&am=1258&rf=0&re=1&ft=1325&fv=1325&fw=1325&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=aw-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=186589&na=697832673&cs=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:41 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:41 GMT
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 2DCE	0 22 B	75ms 74ms	Image image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst8ZgtDvc79hx5HAt4OFtuJgzY6bL0Qycewbhj5924BEyOtI7es0i3D54alQlp_6kJMpAFGHcrfFRr53jomO61E3XpIFMFWeA_qSXB1CxKiCxV5GuK95oXGmj_CIRIBIdoNKt6hHFhzby_qMAYYWMOSicK96pi276FfNywAiMbo7dUwJoqeujbHjnA4OerpSmGT3UtVaUn_t9kZJCBXeld0bIISXUcxkDO2A95uG66hX4ZvTchUUg0lZinlmQVYZzqzmRE4hAbIcrs&sig=Cg0ArKJSzFcbyw_3gNAjEAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:41 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H3-Q050	200	runner.html tpc.googlesyndication.com/sodar/sodar2/219/ Frame 7DA2	0 0	11ms 6ms	Document text/html	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /sodar/sodar2/219/runner.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin content-length 4867 date Mon, 23 Nov 2020 18:35:53 GMT expires Tue, 23 Nov 2021 18:35:53 GMT last-modified Mon, 05 Oct 2020 22:33:01 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 1248 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	43ms 42ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=248&w=474&rm=1&fy=1&gp=1&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=https%3A%2F%2Ft.co&t=1606157796238&de=135777613503&rx=820943480488&cu=1606157796238&m=3721&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=1&lb=8503&le=1&lf=716&lg=1&lh=85&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A887%3A887%3A0%3A953&as=1&ag=1778&an=1778&gi=1&gf=1778&gg=1778&ix=1778&ic=1778&ez=1&ck=1778&kw=1258&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1778&bx=1778&ci=1778&jz=1258&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1258&cd=1258&ah=1258&am=1258&rf=0&re=1&ft=1325&fv=1325&fw=1325&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=aw-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=186589&na=328159555&cs=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:41 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:41 GMT
GET H2	200	nr-1184.min.js Show response js-agent.newrelic.com/	27 KB 10 KB	48ms 47ms	Script application/javascript	151.101.114.110 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/nr-1184.min.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.110 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 780861f2ab29c0144055244696561fb0306c8cb3cb7f548f9105c763b0e91f77 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:41 GMT content-encoding gzip x-amz-request-id A21809B1C987C063 x-cache HIT content-length 10624 x-amz-id-2 5/0iWHe8AbcxZN6Jo3BmJ2Q+tztfRSNwr+lcNTrsM79nJm6KurTN6rNwf14f8ELquc1TIDOjlf4= x-served-by cache-hhn4055-HHN last-modified Mon, 28 Sep 2020 16:34:45 GMT server AmazonS3 x-timer S1606157802.904332,VS0,VE0 etag "3d7f312be60d08a2568e311e4762f3af" vary Accept-Encoding content-type application/javascript via 1.1 varnish cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 10313
GET H3-Q050	200	sodar Show response pagead2.googlesyndication.com/getconfig/	8 KB 6 KB	17ms 17ms	XHR application/json	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020111701&st=env Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ff8a53964698946bf643871bb60d0db9e17e5290a30b32fde06fb5eda9891218 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:41 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 6527 x-xss-protection 0
GET H3-Q050	200	sodar2.js Show response tpc.googlesyndication.com/sodar/	16 KB 6 KB	15ms 15ms	Script text/javascript	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1603823857801521" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6015 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:42 GMT
GET H2	200	/ Show response www.zdnet.com/components/breaking-news/xhr/	1 KB 625 B	130ms 125ms	XHR application/json	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 3a4a0cd9fba1b85eaa8fc1222f0965fd563dd5631a07ab1c2dff170f1d0bc6e8 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Mon, 23 Nov 2020 18:56:34 GMT x-frame-options SAMEORIGIN date Mon, 23 Nov 2020 18:56:42 GMT expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" vary Accept-Encoding, User-Agent x-tx-id c938dff8-142e-4865-b707-d551386694b2 content-type application/json cache-control max-age=5400, private accept-ranges bytes expires Mon, 23 Nov 2020 20:26:34 GMT
GET H2	200	r-emotet.png zdnet1.cbsistatic.com/hub/i/2020/11/20/3cc3f4ca-b496-4207-9f10-0a80e649ce0d/	12 KB 12 KB	6ms 6ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet1.cbsistatic.com/hub/i/2020/11/20/3cc3f4ca-b496-4207-9f10-0a80e649ce0d/r-emotet.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash fd5f254160734cb504a726cc3fd8b534191a507bfc62d1ea5b8e399abd2f0c24 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306690 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 11921 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:27:37 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"ad7329ed69a1cd18d06ba2e1fc73532e" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 11921 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-trickbot.png zdnet4.cbsistatic.com/hub/i/2020/11/20/1b8341cf-dadb-40c8-b2ba-66f53a6caee1/	6 KB 7 KB	7ms 6ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet4.cbsistatic.com/hub/i/2020/11/20/1b8341cf-dadb-40c8-b2ba-66f53a6caee1/r-trickbot.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 0852a03789c2c216174ddae0a69503ff7f97fdf7d0675977ed4fd5f38473178e Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306691 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 6410 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:35:41 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"1984faad0c4fabe5ffd0f5973c29bfd3" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 6410 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-bazar.png zdnet4.cbsistatic.com/hub/i/2020/11/20/71f81cca-756f-4ac3-a54b-be2f2d223130/	7 KB 7 KB	9ms 5ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet4.cbsistatic.com/hub/i/2020/11/20/71f81cca-756f-4ac3-a54b-be2f2d223130/r-bazar.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 282464f343a1ed2c3e0b4a5a6e0e4bc752c5a720f98bd8211c918450f028adb4 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306623 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 7082 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:40:48 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"4f79134d3332607173f5665af3387d8d" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 7082 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-qbot.png zdnet3.cbsistatic.com/hub/i/2020/11/20/0cdf641b-5900-4a5b-ad29-212a0f41ee2e/	16 KB 17 KB	13ms 9ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet3.cbsistatic.com/hub/i/2020/11/20/0cdf641b-5900-4a5b-ad29-212a0f41ee2e/r-qbot.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 6066b15b5a8a1ec97658e0bb7a8485fef03d833c3d3c813843ffb912ee960794 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306654 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 16783 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:46:23 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"090c34f18ab19c990a2b3815d3b9696e" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 16783 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 02:25:18 GMT
GET H2	200	r-sdbbot.png zdnet1.cbsistatic.com/hub/i/2020/11/20/c997580d-1a8f-4b66-a5e0-57705be7527f/	6 KB 6 KB	13ms 9ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet1.cbsistatic.com/hub/i/2020/11/20/c997580d-1a8f-4b66-a5e0-57705be7527f/r-sdbbot.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 04d8bd36ba34b7709873296c02eb9cc09cb1709a168fbde7c6f3d28cae4cce29 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306655 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 6490 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:56:50 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"882f7af6a82b1cd0a0bb02d1ac73267d" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 6490 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-dridex.png zdnet3.cbsistatic.com/hub/i/2020/11/20/edefaceb-85cb-4f3b-a820-18d8dac7d787/	6 KB 6 KB	13ms 10ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet3.cbsistatic.com/hub/i/2020/11/20/edefaceb-85cb-4f3b-a820-18d8dac7d787/r-dridex.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 61f390f09e05236631b453b30c48c58a630c1bc8501e397edfd80de4b19e66f9 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306655 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 5894 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:57:02 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"1de527d7269606586163e568cdf3889b" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 5894 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-zloader.png zdnet2.cbsistatic.com/hub/i/2020/11/20/814d41d2-52f0-40bc-a452-e170c20725f1/	6 KB 6 KB	10ms 7ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet2.cbsistatic.com/hub/i/2020/11/20/814d41d2-52f0-40bc-a452-e170c20725f1/r-zloader.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f65b40035a6fb820501c15c8cdff5fc437ea0f4c71125ba572de42a6324cc1f9 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306655 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 6049 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 02:02:00 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"dab2d159d7b0fbeca3dd6fd0ef81f5b1" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 6049 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-buer.png zdnet2.cbsistatic.com/hub/i/2020/11/20/1bd4f30c-864c-486b-a6b1-2e64b61ae307/	7 KB 7 KB	9ms 6ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet2.cbsistatic.com/hub/i/2020/11/20/1bd4f30c-864c-486b-a6b1-2e64b61ae307/r-buer.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 62772634c444620fcdde31d967001780e18886ba684bcfca3599bdfc0ae2023a Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306623 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 7064 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 02:06:51 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"de1fe633c9754255355dcdeb074a2b74" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 7064 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-phorpiex.png zdnet1.cbsistatic.com/hub/i/2020/11/20/8c8942a5-df7f-4e72-81d9-e37e98e3dc83/	8 KB 8 KB	13ms 11ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet1.cbsistatic.com/hub/i/2020/11/20/8c8942a5-df7f-4e72-81d9-e37e98e3dc83/r-phorpiex.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f1b6769841d8855161c81c4b3df805698216e85781bfa9ea49147d1c1766b536 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306686 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 7877 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 02:14:46 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"7b03f982f98d4143ed74275886af31b7" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 7877 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-cobalt.png zdnet4.cbsistatic.com/hub/i/2020/11/20/583205c5-7a98-466b-be41-102020c73f8d/	7 KB 7 KB	10ms 8ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet4.cbsistatic.com/hub/i/2020/11/20/583205c5-7a98-466b-be41-102020c73f8d/r-cobalt.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash b7c2702e4b5c5f4e157a08a5209cad35606e424c8492ca5340b4426bf9ff45e4 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306686 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 7492 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 02:16:58 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"d0877cdf7d6a876fdb0293fb95411756" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 7492 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	image-gallery-modal-426b98fe1d-rev.js Show response zdnet1.cbsistatic.com/fly/js/components/	5 KB 2 KB	8ms 6ms	Script application/javascript	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet1.cbsistatic.com/fly/js/components/image-gallery-modal-426b98fe1d-rev.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 744ae87db00be85a6a482a3e8036f81aafaa7754be29b05a2330d0fbc8fea803 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT content-encoding gzip x-content-type-options nosniff age 345163 vary Accept-Encoding, Accept content-length 1860 x-xss-protection 1; mode=block last-modified Thu, 19 Nov 2020 18:10:37 GMT server ContentServer x-frame-options SAMEORIGIN etag "d52e85ba65e246e80154e01e5159303a" strict-transport-security max-age=31536000 content-type application/javascript access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Thu, 26 Nov 2020 19:03:57 GMT
GET H2	200	anthem-hacker.jpg zdnet3.cbsistatic.com/hub/i/r/2019/05/29/48679984-c00c-4d32-87b9-4963628f9813/thumbnail/170x128/f09153854c6474331f0a55b83f1abd32/	4 KB 4 KB	17ms 14ms	Image image/jpeg	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet3.cbsistatic.com/hub/i/r/2019/05/29/48679984-c00c-4d32-87b9-4963628f9813/thumbnail/170x128/f09153854c6474331f0a55b83f1abd32/anthem-hacker.jpg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 639c05b819b690aa73793fe651ef9b97e2130dd8e6ecb314fbd0d3f4143b1dad Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT content-encoding gzip x-content-type-options nosniff age 1204879 vary Accept-Encoding, Accept content-length 4127 x-xss-protection 1; mode=block last-modified Fri, 21 Aug 2020 16:50:43 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"3caf5467bcfec002279f8326d433e3a9" strict-transport-security max-age=31536000 content-type image/jpeg access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 08 Jan 2021 20:15:23 GMT
GET H2	200	apt41.png zdnet4.cbsistatic.com/hub/i/r/2020/09/16/e6206a11-5b28-4028-88cc-d11e56ea37c2/thumbnail/170x128/31d2f891ad3b5e9031950156b16d0265/	20 KB 20 KB	10ms 7ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet4.cbsistatic.com/hub/i/r/2020/09/16/e6206a11-5b28-4028-88cc-d11e56ea37c2/thumbnail/170x128/31d2f891ad3b5e9031950156b16d0265/apt41.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash beb37102acb27e46ccf21505537172f0636fac464a0b13107aa6a049e169f897 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT content-encoding gzip x-content-type-options nosniff age 1204899 vary Accept-Encoding, Accept content-length 20659 x-xss-protection 1; mode=block last-modified Wed, 16 Sep 2020 16:39:45 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"8f192c0643162c7a4047796a9d6ce492" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 08 Jan 2021 20:15:04 GMT
GET H2	200	sae.jpg zdnet3.cbsistatic.com/hub/i/r/2019/05/28/119595aa-09b6-4aa3-80f8-a29d823ec9d3/thumbnail/170x128/c3b8c7f157484ec06dfdacd038bc3a3e/	5 KB 5 KB	16ms 13ms	Image image/jpeg	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet3.cbsistatic.com/hub/i/r/2019/05/28/119595aa-09b6-4aa3-80f8-a29d823ec9d3/thumbnail/170x128/c3b8c7f157484ec06dfdacd038bc3a3e/sae.jpg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 19ed1f41f7e045dafd78caec8848b6c14bf348121b0861ffe30bdae24774ba27 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff age 1038416 vary Accept-Encoding, Accept content-length 4680 x-xss-protection 1; mode=block last-modified Fri, 21 Aug 2020 16:50:43 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"19a223efb8cb70ab2a3763a68ec0c034" strict-transport-security max-age=31536000 content-type image/jpeg access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Sun, 10 Jan 2021 18:29:46 GMT
GET H2	200	lazarus-group-member.jpg zdnet1.cbsistatic.com/hub/i/r/2019/05/29/0470890a-3f2d-4291-bf6f-168fa50d6537/thumbnail/170x128/75bbbeebb309f148e251ea16f2ff22e7/	4 KB 4 KB	21ms 19ms	Image image/jpeg	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet1.cbsistatic.com/hub/i/r/2019/05/29/0470890a-3f2d-4291-bf6f-168fa50d6537/thumbnail/170x128/75bbbeebb309f148e251ea16f2ff22e7/lazarus-group-member.jpg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash b812ea0519c2fd65624b96ae5f3704ded0ac78eacd1bb4ec9b551a9d6fc77f1c Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff age 1039455 vary Accept-Encoding, Accept content-length 4228 x-xss-protection 1; mode=block last-modified Fri, 21 Aug 2020 16:50:43 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"27963ab30220bdc399383d654dc9a002" strict-transport-security max-age=31536000 content-type image/jpeg access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Sun, 10 Jan 2021 18:11:22 GMT
GET H2	200	zeus.jpg zdnet3.cbsistatic.com/hub/i/r/2019/05/28/238b3585-22ff-4ba9-8c90-bb5d864a1f00/thumbnail/170x128/6de0fc8e9b5d999206db3b7ff0cac1ae/	4 KB 4 KB	16ms 14ms	Image image/jpeg	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet3.cbsistatic.com/hub/i/r/2019/05/28/238b3585-22ff-4ba9-8c90-bb5d864a1f00/thumbnail/170x128/6de0fc8e9b5d999206db3b7ff0cac1ae/zeus.jpg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 2139e564507235ce0fb33edd4796536bcec35161a8186ff82cc386d1413cfdb7 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT content-encoding gzip x-content-type-options nosniff age 1204856 vary Accept-Encoding, Accept content-length 4462 x-xss-protection 1; mode=block last-modified Fri, 21 Aug 2020 16:50:43 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"939cadc3eaf300ddebe96f6553f0e45a" strict-transport-security max-age=31536000 content-type image/jpeg access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 08 Jan 2021 20:15:23 GMT
GET H2	200	disqus-loader-e3cab293df-rev.js Show response zdnet3.cbsistatic.com/fly/js/components/	1 KB 989 B	18ms 16ms	Script application/javascript	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet3.cbsistatic.com/fly/js/components/disqus-loader-e3cab293df-rev.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 2b1068aa007abf0e405b0840844c67718204a0073dc392337d78427a0dba6854 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT content-encoding gzip x-content-type-options nosniff age 544345 vary Accept-Encoding, Accept content-length 667 x-xss-protection 1; mode=block last-modified Mon, 16 Nov 2020 17:08:32 GMT server ContentServer x-frame-options SAMEORIGIN etag "eac3a26f962835dccb7790960dc0a8fb" strict-transport-security max-age=31536000 content-type application/javascript access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 24 Nov 2020 11:44:16 GMT
GET H2	200	tesla-model-x.png zdnet4.cbsistatic.com/hub/i/r/2020/11/23/8f00ebf8-09f0-4458-810a-9ebbff9e690b/thumbnail/170x128/1b24a61c7410c909e913913e59225889/	30 KB 30 KB	20ms 10ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet4.cbsistatic.com/hub/i/r/2020/11/23/8f00ebf8-09f0-4458-810a-9ebbff9e690b/thumbnail/170x128/1b24a61c7410c909e913913e59225889/tesla-model-x.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash bad84eb6e0f8f9254ac62ec0ab6dd294a89b0ae7d0b1b991478fab0b2794a710 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff age 4755 vary Accept-Encoding, Accept content-length 30577 x-xss-protection 1; mode=block last-modified Mon, 23 Nov 2020 17:37:27 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"b567f7d01bcac9f5853552a06820379d" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 22 Jan 2021 17:37:28 GMT
GET H2	200	/ Show response www.zdnet.com/newsletter/xhr/widget-login/	2 KB 879 B	167ms 158ms	XHR application/json	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/newsletter/xhr/widget-login/?topic=security Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash ab27772807ccd35add3f53c1c430bc7e665f254c43c8efc8eb2c9bb91d3238a1 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-encoding gzip referrer-policy no-referrer-when-downgrade date Mon, 23 Nov 2020 18:56:42 GMT expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" x-frame-options SAMEORIGIN x-tx-id 7d73dc5a-87df-4b66-8140-62d54f6057c1 content-type application/json cache-control no-cache x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload accept-ranges bytes vary Accept-Encoding, User-Agent x-xss-protection 1; mode=block
POST H2	200	/ Show response www.zdnet.com/m3d0s1/xhr/right-rail/	12 KB 2 KB	191ms 188ms	XHR application/json	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/m3d0s1/xhr/right-rail/ Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 78b5fc62f9e92bd554a500d702e52e7e2a297d18cf76d391a2c3a40058eb4dac Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-encoding gzip referrer-policy no-referrer-when-downgrade date Mon, 23 Nov 2020 18:56:42 GMT expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" x-frame-options SAMEORIGIN x-tx-id e63e76a1-dfe3-4c80-8bc4-90951b0995ca content-type application/json cache-control no-cache x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload accept-ranges bytes vary Accept-Encoding, User-Agent x-xss-protection 1; mode=block
GET H2	200	front-door-carousel-d989216481-rev.js Show response zdnet1.cbsistatic.com/fly/js/components/	5 KB 2 KB	9ms 6ms	Script application/javascript	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet1.cbsistatic.com/fly/js/components/front-door-carousel-d989216481-rev.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a0aa48808ddef7604ba969db62e4af3a2ba001b7a8751823cf0ab2d430308ea5 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT content-encoding gzip x-content-type-options nosniff age 345326 vary Accept-Encoding, Accept content-length 1542 x-xss-protection 1; mode=block last-modified Thu, 19 Nov 2020 18:10:37 GMT server ContentServer x-frame-options SAMEORIGIN etag "15b374003241d75f16514aad8cfd3520" strict-transport-security max-age=31536000 content-type application/javascript access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Thu, 26 Nov 2020 19:01:15 GMT
GET H2	200	urban-airship-0350b998c8-rev.js Show response zdnet3.cbsistatic.com/fly/js/components/	2 KB 1 KB	6ms 6ms	Script application/javascript	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-0350b998c8-rev.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a11031f99966230867eebb1167b3855ed90e2b4d4bb562601d7e6f4d816ec118 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT content-encoding gzip x-content-type-options nosniff age 381195 vary Accept-Encoding, Accept content-length 1139 x-xss-protection 1; mode=block last-modified Wed, 18 Nov 2020 16:48:10 GMT server ContentServer x-frame-options SAMEORIGIN etag "ecbf8f7744e83bf9d1cc909276e8d013" strict-transport-security max-age=31536000 content-type application/javascript access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Thu, 26 Nov 2020 09:03:26 GMT
GET H3-Q050	200	activeview pagead2.googlesyndication.com/pcs/ Frame 1AE6	42 B 102 B	30ms 29ms	Image image/gif	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuYd5cBOjOkYn56ZM-oNDm7jqgfUblERkniO0YRm8TDbRtqgp597vZekijnoptzl86lDlNWQ2rJlD4uMQ1cVQe2Z8pVEEYRvJZB6nk11rDe0rWiw2cEc0q7nekW4A&sai=AMfl-YRamwEM_HFQ6tpYw_F7cz1NJm9L9rl9QpHG8rLcbg1WK3g3rbiA475cA0Yh1CUns6oBSJ1bNUM99VpnfZbZ5wOxXxvfdmbZGNmdPePJTH0wb8nykykk1oXV-aQ&sig=Cg0ArKJSzJI52WVsXfarEAE&cid=CAASF-Roj5EjHp5SgwgxKuN6YyKgincbjfAX&id=ampim&o=315,465&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1392&mtos=0,0,0,1392,1392&tos=0,0,0,1392,0&tfs=1308&tls=2700&g=100&h=100&tt=2700&r=v&avms=ampa&adk=3718565486 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	advertisement-9a7c0c51b1-rev.js Show response zdnet2.cbsistatic.com/fly/js/utils/	0 367 B	24ms 23ms	Script application/javascript	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet2.cbsistatic.com/fly/js/utils/advertisement-9a7c0c51b1-rev.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT content-encoding gzip x-content-type-options nosniff age 210931 vary Accept-Encoding, Accept content-length 32 x-xss-protection 1; mode=block last-modified Thu, 19 Nov 2020 18:10:38 GMT server ContentServer x-frame-options SAMEORIGIN etag "b5d40c40856e0c071b192d6cea7ea934" strict-transport-security max-age=31536000 content-type application/javascript access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Sat, 28 Nov 2020 08:21:10 GMT
GET H/1.1	200 OK	NRJS-04e0f5db0886b3b33ff Show response bam-cell.nr-data.net/1/	57 B 651 B	144ms 142ms	Script text/javascript	162.247.243.147 NEWRELIC-AS-1
General Check archive.org Show headers Download Go to Full URL https://bam-cell.nr-data.net/1/NRJS-04e0f5db0886b3b33ff?a=450235099&v=1184.ab39b52&to=ZFMHbUMCXktYWxJZX10ZJFpFCl9WFlkURFlQWgBmQgpeX1Vd&rst=10024&ck=1&ref=https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/&ap=230&be=204&fe=9551&dc=953&perf=%7B%22timing%22:%7B%22of%22:1606157792328,%22n%22:0,%22f%22:2,%22dn%22:2,%22dne%22:2,%22c%22:2,%22ce%22:2,%22rq%22:4,%22rp%22:122,%22rpe%22:201,%22dl%22:174,%22di%22:954,%22ds%22:954,%22de%22:954,%22dc%22:9551,%22l%22:9551,%22le%22:9602%7D,%22navigation%22:%7B%7D%7D&fp=887&fcp=887&at=SBQQGwsYTRQbWUQKS05L&jsonp=NREUM.setToken Requested by Host: js-agent.newrelic.com URL: https://js-agent.newrelic.com/nr-1184.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.147 San Francisco, United States, ASN23467 (NEWRELIC-AS-1, US), Reverse DNS Software cloudflare / Resource Hash d10c94b6cdb747904baee9070f003bb45849da46f8100b1320f286c21cbcaaa1 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:42 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Expect-CT max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Vary Accept-Encoding Content-Type text/javascript;charset=ISO-8859-1 Transfer-Encoding chunked Connection keep-alive CF-Ray 5f6d1c98c89732ab-CDG cf-request-id 069810337e000032ab112c3000000001 Expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	loader.js Show response cdn.taboola.com/libtrc/cbsinteractive-zdnet/	115 KB 22 KB	31ms 29ms	Script application/javascript	151.101.13.44 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software obaker.90.1.2-10.498 / Resource Hash c756e5a479faa069fd72f90b99148c210b604f077f735f75f25c2308fc6620dc Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id yIxM8xLu03hPS43YAZc7ysCtAUyiLLLk content-encoding gzip etag "d175fa3eaacc76de509c6bb056b9c388cec0a3b0" age 15 via 1.1 varnish x-cache HIT x-from-cache 1 content-length 22227 x-amz-id-2 IxcgrTFhhmRz7aphTusiPbPS7F74zDQxcCto+mniR2n81EgW8L85Q1QF7zw215CqhicBAScHMs0= x-served-by cache-fra19142-FRA last-modified Mon, 23 Nov 2020 18:56:26 UTC server obaker.90.1.2-10.498 x-timer S1606157802.373437,VS0,VE0 date Mon, 23 Nov 2020 18:56:42 GMT vary Accept-Encoding, Accept-Encoding x-amz-request-id 42418B5B8139F1B1 access-control-allow-origin * cache-control private,max-age=14400 accept-ranges bytes content-type application/javascript; charset=utf-8 abp 13 x-cache-hits 1
GET H2	200	r-emotet.png zdnet1.cbsistatic.com/hub/i/2020/11/20/3cc3f4ca-b496-4207-9f10-0a80e649ce0d/	12 KB 12 KB	7ms 6ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet1.cbsistatic.com/hub/i/2020/11/20/3cc3f4ca-b496-4207-9f10-0a80e649ce0d/r-emotet.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash fd5f254160734cb504a726cc3fd8b534191a507bfc62d1ea5b8e399abd2f0c24 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306690 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 11921 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:27:37 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"ad7329ed69a1cd18d06ba2e1fc73532e" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 11921 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-trickbot.png zdnet4.cbsistatic.com/hub/i/2020/11/20/1b8341cf-dadb-40c8-b2ba-66f53a6caee1/	6 KB 6 KB	7ms 6ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet4.cbsistatic.com/hub/i/2020/11/20/1b8341cf-dadb-40c8-b2ba-66f53a6caee1/r-trickbot.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 0852a03789c2c216174ddae0a69503ff7f97fdf7d0675977ed4fd5f38473178e Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306691 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 6410 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:35:41 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"1984faad0c4fabe5ffd0f5973c29bfd3" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 6410 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-bazar.png zdnet4.cbsistatic.com/hub/i/2020/11/20/71f81cca-756f-4ac3-a54b-be2f2d223130/	7 KB 7 KB	7ms 6ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet4.cbsistatic.com/hub/i/2020/11/20/71f81cca-756f-4ac3-a54b-be2f2d223130/r-bazar.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 282464f343a1ed2c3e0b4a5a6e0e4bc752c5a720f98bd8211c918450f028adb4 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306623 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 7082 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:40:48 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"4f79134d3332607173f5665af3387d8d" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 7082 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-buer.png zdnet2.cbsistatic.com/hub/i/2020/11/20/1bd4f30c-864c-486b-a6b1-2e64b61ae307/	7 KB 7 KB	11ms 8ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet2.cbsistatic.com/hub/i/2020/11/20/1bd4f30c-864c-486b-a6b1-2e64b61ae307/r-buer.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 62772634c444620fcdde31d967001780e18886ba684bcfca3599bdfc0ae2023a Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306623 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 7064 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 02:06:51 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"de1fe633c9754255355dcdeb074a2b74" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 7064 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-zloader.png zdnet2.cbsistatic.com/hub/i/2020/11/20/814d41d2-52f0-40bc-a452-e170c20725f1/	6 KB 6 KB	9ms 6ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet2.cbsistatic.com/hub/i/2020/11/20/814d41d2-52f0-40bc-a452-e170c20725f1/r-zloader.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f65b40035a6fb820501c15c8cdff5fc437ea0f4c71125ba572de42a6324cc1f9 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306655 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 6049 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 02:02:00 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"dab2d159d7b0fbeca3dd6fd0ef81f5b1" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 6049 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-cobalt.png zdnet4.cbsistatic.com/hub/i/2020/11/20/583205c5-7a98-466b-be41-102020c73f8d/	7 KB 8 KB	9ms 7ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet4.cbsistatic.com/hub/i/2020/11/20/583205c5-7a98-466b-be41-102020c73f8d/r-cobalt.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash b7c2702e4b5c5f4e157a08a5209cad35606e424c8492ca5340b4426bf9ff45e4 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306686 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 7492 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 02:16:58 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"d0877cdf7d6a876fdb0293fb95411756" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 7492 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-qbot.png zdnet3.cbsistatic.com/hub/i/2020/11/20/0cdf641b-5900-4a5b-ad29-212a0f41ee2e/	16 KB 17 KB	25ms 12ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet3.cbsistatic.com/hub/i/2020/11/20/0cdf641b-5900-4a5b-ad29-212a0f41ee2e/r-qbot.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 6066b15b5a8a1ec97658e0bb7a8485fef03d833c3d3c813843ffb912ee960794 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306654 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 16783 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:46:23 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"090c34f18ab19c990a2b3815d3b9696e" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 16783 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 02:25:18 GMT
GET H2	200	r-sdbbot.png zdnet1.cbsistatic.com/hub/i/2020/11/20/c997580d-1a8f-4b66-a5e0-57705be7527f/	6 KB 6 KB	15ms 13ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet1.cbsistatic.com/hub/i/2020/11/20/c997580d-1a8f-4b66-a5e0-57705be7527f/r-sdbbot.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 04d8bd36ba34b7709873296c02eb9cc09cb1709a168fbde7c6f3d28cae4cce29 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306655 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 6490 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:56:50 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"882f7af6a82b1cd0a0bb02d1ac73267d" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 6490 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-dridex.png zdnet3.cbsistatic.com/hub/i/2020/11/20/edefaceb-85cb-4f3b-a820-18d8dac7d787/	6 KB 6 KB	17ms 15ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet3.cbsistatic.com/hub/i/2020/11/20/edefaceb-85cb-4f3b-a820-18d8dac7d787/r-dridex.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 61f390f09e05236631b453b30c48c58a630c1bc8501e397edfd80de4b19e66f9 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306655 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 5894 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:57:02 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"1de527d7269606586163e568cdf3889b" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 5894 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-phorpiex.png zdnet1.cbsistatic.com/hub/i/2020/11/20/8c8942a5-df7f-4e72-81d9-e37e98e3dc83/	8 KB 8 KB	16ms 14ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet1.cbsistatic.com/hub/i/2020/11/20/8c8942a5-df7f-4e72-81d9-e37e98e3dc83/r-phorpiex.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f1b6769841d8855161c81c4b3df805698216e85781bfa9ea49147d1c1766b536 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306686 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 7877 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 02:14:46 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"7b03f982f98d4143ed74275886af31b7" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 7877 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	tesla-model-x.png zdnet4.cbsistatic.com/hub/i/r/2020/11/23/8f00ebf8-09f0-4458-810a-9ebbff9e690b/thumbnail/170x128/1b24a61c7410c909e913913e59225889/	30 KB 30 KB	8ms 6ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet4.cbsistatic.com/hub/i/r/2020/11/23/8f00ebf8-09f0-4458-810a-9ebbff9e690b/thumbnail/170x128/1b24a61c7410c909e913913e59225889/tesla-model-x.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash bad84eb6e0f8f9254ac62ec0ab6dd294a89b0ae7d0b1b991478fab0b2794a710 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff age 4755 vary Accept-Encoding, Accept content-length 30577 x-xss-protection 1; mode=block last-modified Mon, 23 Nov 2020 17:37:27 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"b567f7d01bcac9f5853552a06820379d" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 22 Jan 2021 17:37:28 GMT
GET H3-Q050	200	runner.html tpc.googlesyndication.com/sodar/sodar2/219/ Frame 0D7C	0 0	7ms 6ms	Document text/html	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /sodar/sodar2/219/runner.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin content-length 4867 date Mon, 23 Nov 2020 18:35:53 GMT expires Tue, 23 Nov 2021 18:35:53 GMT last-modified Mon, 05 Oct 2020 22:33:01 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 1249 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	ua-sdk.min.js Show response web-sdk.urbanairship.com/notify/v1/	157 KB 29 KB	20ms 19ms	Script application/javascript	35.227.208.151 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://web-sdk.urbanairship.com/notify/v1/ua-sdk.min.js Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-0350b998c8-rev.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.227.208.151 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS 151.208.227.35.bc.googleusercontent.com Software UploadServer / Resource Hash ebc8419821dd4d9a2cd710ea02fd413bded2fe931609c77b35997471a2c0bd21 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:54:00 GMT content-encoding gzip age 162 x-guploader-uploadid ABg5-UxsPelXhHMjxxmgYXWzJlzLmkCPxRvn25YKev8H1148czMCsHBLup-bsnDVu_JReV4Rnwwp_0988F3GDwbI0LXUSYbhyA x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding gzip alt-svc clear content-length 29548 last-modified Thu, 03 Sep 2020 13:21:36 GMT server UploadServer etag "29e2383112026cd1bc0bd7f1a436a222" x-goog-hash crc32c=THaGHA==, md5=KeI4MRICbNG8C9fxpDaiIg== x-goog-generation 1599139296738055 cache-control public,max-age=300,no-transform x-goog-stored-content-length 29548 accept-ranges bytes content-type application/javascript expires Mon, 23 Nov 2020 18:59:00 GMT
GET H2	200	0.6236779568614168 saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/	43 B 210 B	31ms 28ms	Image image/gif	15.237.136.106 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/0.6236779568614168?AQB=1&ce=UTF%2D8&events=event66&v0=ftag_cd:LGN22ef1e6&v2=en&v3=desktop&v4=right-rail&v5=zdnet&v10=article&v20=the+malware+that+usually+installs+ransomware+and+you+need+to+remove+right+away&v22=content_article&v23=&v24=eb673923-32a8-443b-9c02-0d2653d01dd5&v30=11810b01-3924-4277-9d2c-5fe945d43f07&v60=33164073,33164070,33164072&v64=2150&v69=&c0=D%3Dv0&c2=D%3Dv2&c3=D%3Dv3&c4=D%3Dv4&c5=D%3Dv5&c10=D%3Dv10&c20=D%3Dv20&c22=D%3Dv22&c23=D%3Dv23&c24=D%3Dv24&c30=D%3Dv30&c60=D%3Dv60&c64=D%3Dv64&c69=D%3Dv69&pe=lnk_o&pev2=medusa_impression&vid=202011232-leadgen-zdnet&mid=90240133173074011141898988208131324462&aid=2D535D450507F28B-40000106A0001145&AQE=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 15.237.136.106 Paris, France, ASN16509 (AMAZON-02, US), Reverse DNS ec2-15-237-136-106.eu-west-3.compute.amazonaws.com Software jag / Resource Hash a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff x-c master-1404.I1e61f9.M0-468 p3p CP="This is not a P3P policy" vary * content-length 43 x-xss-protection 1; mode=block pragma no-cache last-modified Tue, 24 Nov 2020 18:56:42 GMT server jag xserver anedge-f7bfdfcfd-qnnsw etag 3449197615987916800-4621655062646421327 strict-transport-security max-age=31536000; includeSubDomains content-type image/gif;charset=utf-8 access-control-allow-origin * cache-control no-cache, no-store, max-age=0, no-transform, private expires Sun, 22 Nov 2020 18:56:42 GMT
GET H2	200	pixel.png im.cbsileads.com/	609 B 777 B	151ms 148ms	Image image/png	34.120.132.76 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://im.cbsileads.com/pixel.png?spotname=right-rail&docid=33164073,33164070,33164072&pagetype=article&topicname=Security,Security,Security&devicetype=desktop&lon=1500008513,1500008513,1500008513&promo=2150&site=zdnet&ursid=&tid=2311201856424003401 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.120.132.76 , United States, ASN15169 (GOOGLE, US), Reverse DNS 76.132.120.34.bc.googleusercontent.com Software UploadServer / Resource Hash 0b960c8f9b3fb4ca1d0b1f43e40b5defd11dbf0fd60ebad49ad50ecc06119170 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT x-guploader-uploadid ABg5-UxH8iccV7fcLoRMBiUHrfhq203R9z_kKA9QpsEyNuK3jrivS5PI8ukbwebnoM9tlHRf-vDyiHcqcKSGjnsKUzA x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc clear content-length 609 last-modified Tue, 23 Jun 2020 01:31:20 GMT server UploadServer etag "6802175f61adc40617e8ba87a30aa6bd" x-goog-hash crc32c=Yf0PfA==, md5=aAIXX2GtxAYX6LqHowqmvQ== content-language en x-goog-generation 1592875880921192 cache-control no-cache,max-age=0 x-goog-stored-content-length 609 accept-ranges bytes content-type image/png expires Mon, 23 Nov 2020 18:56:42 GMT
GET H2	200	show-hide-1.0-7bf562809f-rev.js Show response zdnet3.cbsistatic.com/fly/js/components/	2 KB 1 KB	9ms 6ms	Script application/javascript	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet3.cbsistatic.com/fly/js/components/show-hide-1.0-7bf562809f-rev.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash cd715c0fa7d69e85432e8b08d0a02b9613edf40212cca2040bde31670167638e Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT content-encoding gzip x-content-type-options nosniff age 383891 vary Accept-Encoding, Accept content-length 671 x-xss-protection 1; mode=block last-modified Wed, 18 Nov 2020 16:48:09 GMT server ContentServer x-frame-options SAMEORIGIN etag "b05603b1b4fd765174fc4171bed7290d" strict-transport-security max-age=31536000 content-type application/javascript access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Thu, 26 Nov 2020 08:18:30 GMT
GET H/1.1	200 OK	beacon.js Show response sb.scorecardresearch.com/	1 KB 1 KB	66ms 63ms	Script application/x-javascript	104.111.238.139 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://sb.scorecardresearch.com/beacon.js Requested by Host: cdn.taboola.com URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.238.139 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-238-139.deploy.static.akamaitechnologies.com Software / Resource Hash a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:42 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/x-javascript Cache-Control private, no-transform, max-age=86400 Connection keep-alive Content-Length 884 Expires Tue, 24 Nov 2020 18:56:42 GMT
GET H2	200	tr5 cdn.taboola.com/libtrc/	3 B 78 B	39ms 38ms	Image text/html	151.101.13.44 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.taboola.com/libtrc/tr5?abgroup=vpl_ctrl Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:42 GMT via 1.1 varnish server Varnish x-timer S1606157803.614666,VS0,VE0 x-served-by cache-fra19142-FRA x-cache HIT content-type text/html cache-control private,max-age=14400 accept-ranges bytes content-length 3 retry-after 0 x-cache-hits 0
GET H2	200	load.js Show response widget.perfectmarket.com/cbsinteractive-zdnet/	13 KB 5 KB	29ms 28ms	Script application/javascript	151.101.193.181 FASTLY
General Check archive.org Show headers Download Go to Full URL https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js Requested by Host: cdn.taboola.com URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.193.181 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id rwr9L97XovW8QPypI62jHvd7E2HiNZm2 content-encoding gzip etag "fc0de48a0976cde02ddee0bd49a81832" age 174 x-cache HIT, HIT content-length 4742 x-amz-id-2 L9yj3L5x6DgDGCOllzFF3eSn5r2nzIZtAeTjNbt70zeCA9tZ8NYdTf2IlgAnrL/PNegw1sNU07U= x-served-by cache-lax10650-LGB, cache-cdg20758-CDG last-modified Thu, 20 Oct 2016 17:48:07 GMT server AmazonS3 x-timer S1606157803.609227,VS0,VE0 date Mon, 23 Nov 2020 18:56:42 GMT vary Accept-Encoding,, x-amz-request-id AEDE2788DB2CA3A9 via 1.1 varnish, 1.1 varnish cache-control max-age=300 accept-ranges bytes content-type application/javascript; charset=utf-8 x-cache-hits 1, 2
GET H2	200	impl.20201116-23-RELEASE.js Show response cdn.taboola.com/libtrc/	448 KB 103 KB	34ms 34ms	Script application/javascript	151.101.13.44 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.taboola.com/libtrc/impl.20201116-23-RELEASE.js Requested by Host: cdn.taboola.com URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3-br / Resource Hash f7eae951f0a4d945f86cafe6725d20c83229ef15ddd9b22e9ab4b09045bca250 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id 8.LuYV88Q3BN3Xjq2riT7SAL2.ixv6Fy content-encoding br etag "35aff8820f47348863899539c6944606" age 7522 x-cache HIT content-length 105235 x-amz-id-2 6V5Rasqw6rxt6EZ8FsG7/S/MPLLAaNxWrjvHLZJ/yhu0CWUF0FoifejFPiVmooZJl+alFHdmj4Y= x-served-by cache-fra19142-FRA last-modified Tue, 17 Nov 2020 00:37:26 GMT server AmazonS3-br x-timer S1606157803.614796,VS0,VE0 date Mon, 23 Nov 2020 18:56:42 GMT vary Accept-Encoding x-amz-request-id F25274519A1AC225 via 1.1 varnish cache-control private,max-age=31536000 accept-ranges bytes content-type application/javascript abp 78 x-cache-hits 1378
GET H2	200	pmk-201618008.1.js Show response widget.perfectmarket.com/cbsinteractive-zdnet/	323 KB 89 KB	19ms 19ms	Script application/javascript	151.101.193.181 FASTLY
General Check archive.org Show headers Download Go to Full URL https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js Requested by Host: widget.perfectmarket.com URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.193.181 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id bVoOWfmxkMrYwv2s6Uu9D96fE._5IBqu content-encoding gzip etag "da73fb2066df9f51d08b6688cfb35441" age 4567441 x-cache HIT, HIT content-length 91236 x-amz-id-2 XpQc4w2tqjXS8i9b9g54OgKhFFuKl0h4kOoHVy9VhSOp3SbZkQc3KSURTRjh4JTn7jZQx4vMUNA= x-served-by cache-lax8648-LAX, cache-cdg20758-CDG last-modified Thu, 20 Oct 2016 17:47:53 GMT server AmazonS3 x-timer S1606157803.732392,VS0,VE0 date Mon, 23 Nov 2020 18:56:42 GMT vary Accept-Encoding,, x-amz-request-id 7W3KFJ6PFXBX9J5R via 1.1 varnish, 1.1 varnish cache-control max-age=31536000 accept-ranges bytes content-type application/javascript; charset=utf-8 x-cache-hits 1, 2
GET H/1.1	204 No Content	b2 sb.scorecardresearch.com/ Redirect Chain https://sb.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1606157802809&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%2... https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1606157802809&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%...	0 399 B	41ms 41ms	Image text/plain	104.111.238.139 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1606157802809&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20away%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&c9=https%3A%2F%2Ft.co%2FcejlFPR8a9&cs_ak_ss=1 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.238.139 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-238-139.deploy.static.akamaitechnologies.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Mon, 23 Nov 2020 18:56:42 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Connection keep-alive Content-Length 0 Expires Mon, 01 Jan 1990 00:00:00 GMT Redirect headers Location https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1606157802809&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20away%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&c9=https%3A%2F%2Ft.co%2FcejlFPR8a9&cs_ak_ss=1 Pragma no-cache Date Mon, 23 Nov 2020 18:56:42 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Connection keep-alive Content-Length 0 Expires Mon, 01 Jan 1990 00:00:00 GMT
GET H/1.1	204 No Content	b2 sb.scorecardresearch.com/ Redirect Chain https://sb.scorecardresearch.com/b?c1=7&c2=34354936&c3=1&ns__t=1606157802809&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20a... https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1606157802809&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20...	0 399 B	39ms 38ms	Image text/plain	104.111.238.139 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1606157802809&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20away%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&c9=https%3A%2F%2Ft.co%2FcejlFPR8a9&cs_ak_ss=1 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.238.139 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-238-139.deploy.static.akamaitechnologies.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Mon, 23 Nov 2020 18:56:42 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Connection keep-alive Content-Length 0 Expires Mon, 01 Jan 1990 00:00:00 GMT Redirect headers Location https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1606157802809&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20away%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&c9=https%3A%2F%2Ft.co%2FcejlFPR8a9&cs_ak_ss=1 Pragma no-cache Date Mon, 23 Nov 2020 18:56:42 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Connection keep-alive Content-Length 0 Expires Mon, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	204	gen_204 pagead2.googlesyndication.com/pagead/ Frame 0821	0 23 B	21ms 21ms	Image image/gif	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=219&t=2&li=gpt_2020111801&jk=56105006463552&bg=!h4SlhKTNAAUoamvQKFhO3y5h4WH79wIAAAH1UgAAAI5oAQcKAK0vUVTk6y1jlWulbRI-DJF8qV_eq90kzvH35qIQ3oX-BG2rwCTV4t5b8EALPR-jPHS8-9yNCAPVtDBZrrZ9VBYX593FBg5xnUn4awq_Aty4W28zzJmvasgSpqwedIQxJZWzi3pFaqSXWH5t5rppRe-JeUiah_6_9RcZsT_YjPWA517WN5EpFg8Q2EIpGun67Jptn55JEMAWrdifhGBDqgneOYvh5mzY-oNIMR7HN5kBvFlGkrqBtcU8HYBn8FRhuMQWoC6QCt2LSKmMD36GZtQXnHJRCN0Xg-olewzoCCLJJ2ZloQ3PjnxYTTRGaSo2FX4Nyk8StqjgL8zc2S0-1g14Zp-XUhOV2_A0zz7r88G5wC_P0X6NhJeIzxVi2-QrnGC7KVLBYi8nSFUOCZJYab-HGMsphkuwR2R1En3WNQsnhYvndhaxJ6bXjOtbXoSi6TdR1otylNlEvm9QSiuzVRIqXysxeznIEtgiAy8lMEdzjSkwnHdGsnH3LitaIuyFmgd8v_dfN1qjDAmsUDW3xX3JpeLF_69kJDN7sB5BdQ6PaoZjHhBtRSY_1WIH1aAjzOYLauKaW8olDPXeVCJohRPTjEPa0cfaO6xWXP2dnWYCOJNaMi-DYgcJ5N05QSPAZTV4LSNChYrCxhv6Bw1vefhyVQoTdZ60LpqOr0isguUdOmwx4dm-hhniEoD0CzVz4RbPNKeBcqVPXSb234xuZK7-Mt_apjPDB3Pyigs__cB7ReVKebLyqyZ81IH0gfbfwuPA-TKF7JVl8Y4MLzT7zuQVpukNzhVVEsyTueYPQYnpMntK7EnXvoezZUjoFA Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:42 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	bcn www.summerhamster.com/	43 B 182 B	85ms 28ms	Image image/gif	52.28.163.208 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.summerhamster.com/bcn?fe=1606157802835&y=2.0.1105&elg=766197899&flg=68&x=zzz.cgqhw.frp%2Fduwlfoh%2Fwkh-pdozduh-wkdw-xvxdoob-lqvwdoov-udqvrpzduh-dqg-brx-qhhg-wr-uhpryh-uljkw-dzdb%2F&vqwo=1&deo=0&g0=vg%3A%3Aer%2Cxd%3A%3Aqexd%3A%3Aqsu%7Cvg%3A%3Ask%3A%3Aqsk%3A%3Aqsu%7Cgisl%3A%3Alp%2Clqi%2Cqh%3A%3Aqoe%3A%3Aqsu%3A%3Axuo%3D%2F%2Fdg.grxeohfolfn.qhw%2Fggp%2Fdg%2Fxc%2Fedrrpkxmv%2Fksxqle%2Fovzwkxmnxgy%2Fsbiuhgvt%2F%3Brug%3D1606157794591%3F%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cddg%2Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.des_re_halvw%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Csu%3A%3Aid%3A%3Auivv%3A%3Aqsu&hu=0&g2=0%3A%3A0%3A%3A0%3A%3A0%3A%3A0 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.28.163.208 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-28-163-208.eu-central-1.compute.amazonaws.com Software Jetty(9.2.10.v20150310) / Resource Hash a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers access-control-allow-origin * date Mon, 23 Nov 2020 18:56:42 GMT server Jetty(9.2.10.v20150310) content-length 43 access-control-allow-methods * content-type image/gif
GET H3-Q050	200	analytics.js Show response www.google-analytics.com/	46 KB 18 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:824::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: widget.perfectmarket.com URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Fri, 23 Oct 2020 03:00:57 GMT server Golfe2 age 6054 date Mon, 23 Nov 2020 17:15:48 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 18817 expires Mon, 23 Nov 2020 19:15:48 GMT
GET H/1.1	200 OK	beacon.js Show response sb.scorecardresearch.com/	1 KB 1 KB	57ms 56ms	Script application/x-javascript	104.111.238.139 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://sb.scorecardresearch.com/beacon.js Requested by Host: widget.perfectmarket.com URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.238.139 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-238-139.deploy.static.akamaitechnologies.com Software / Resource Hash a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:43 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/x-javascript Cache-Control private, no-transform, max-age=86400 Connection keep-alive Content-Length 884 Expires Tue, 24 Nov 2020 18:56:43 GMT
GET H2	404	tboptevent.html widget.perfectmarket.com/opt/ Frame 3FC7	0 0	20ms 20ms	Document text/plain	151.101.193.181 FASTLY
General Check archive.org Show headers Download Go to Full URL https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D Requested by Host: widget.perfectmarket.com URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.193.181 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash Request headers :method GET :authority widget.perfectmarket.com :scheme https :path /opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Response headers server Varnish retry-after 0 accept-ranges bytes date Mon, 23 Nov 2020 18:56:43 GMT via 1.1 varnish x-served-by cache-cdg20758-CDG x-cache MISS x-cache-hits 0 x-timer S1606157803.061603,VS0,VE0 content-length 0
GET H3-Q050	204	gen_204 pagead2.googlesyndication.com/pagead/	0 46 B	15ms 15ms	Image image/gif	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=219&t=2&li=gpt_2020111701&jk=743995740963303&bg=!_P-l_9_NAAVGySeIRlg6UPwqhomRrQIAAADWUgAAABloAQcKAUg1qf2ZRobJ-sKMHF8J8WEGhdzvFYwMFb6frKcuEbcmE3IBiTVGvTcbHI79-f3AHGpaGH_8emvslVOASVthRCuLg29ZDZo7MCyHZ3Rv0622ww1uimIhB-tAiSt9V3gWf_iLv6b6pn4bGc5Vv_j4_A-GhA2X62lgtk0kC2vQb9sMjTLiViixszdcsemjxJ3cXNdXFAu99Gm8YGYjpc6ZILSYZiupA-2IHFz2ghMbHPG7PpbCk8bd2TQpB40JE16I9Uo1moZBeX4Jac7OecP8wbTn8jVK5oiuExMHVZc92DhIfHu40v2zUraWloAfKhfGNOqiN4rCP8JqJIIRtnWnrKuQo-DRjOxKJgp0aAh69l7JsvuUBxQl51Qo94POzJYiD9B1i3PXamWOH1dsshhEkJfG84uvcq7XjpfYIJZuufsaerhxXY9oMWEfmQG25aMS11KcSIVTw0NOlVFPiUZGlJFWbbtaI1AalAekPXEKF4B9vfac1wlxKpBknVTvoFlCp67LYudeMzrqlzG4S2osfAid3-w6XsRQIBvG0rw4CAtK67WN_ACHokMxiLzCLWpj0qzy68O7sSNCI0TMAcvpRrbosX0wZLteXAFjBn1cWVfrg6r0hKYGHZY3nRMoXJAvxNC5G7xKt5EaraF2pQWwCFEfD03Mn-g9qzIapMY9g25irwQqikk80QwEU0TGdeR70OWFItrXm8IYnUt57tcKghy5RbKBQpEaAF68dTSPhOeZbOTdabbeHwpuSYO7Y2isJVn0KxU3WXJRtza3lveGdYlt_8_rddvmr6EWEVcyrKuYTlhW7rSKMjHi4ObTC_EVR8WcIA3u-V5HL6XX_IIPk6mbEnWn2uirpVOjSCN9tKfp9GatdKq0xN_mDQirv0Zq8ItYOsVcH0-6RyO7WWajVaVTh65y0yJBqmAyDf-aSyPGoic9ZP0Rc2rm9_kHrMARbYvB7JyzMOXWlaqglfvGcK1m2o7bZfT2q8tbeKY7CD7o9jgFiGQBQcHvmHmVJBAVwXWD Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:43 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H/1.1	204 No Content	/ 684dd309.akstat.io/	0 354 B	50ms 34ms	Other image/gif	2a02:26f0:6c00:287::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://684dd309.akstat.io/ Requested by Host: c.go-mpulse.net URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:287::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers Pragma no-cache Date Mon, 23 Nov 2020 18:56:43 GMT Content-Type image/gif Access-Control-Allow-Origin https://www.zdnet.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Timing-Allow-Origin * X-XSS-Protection 0 Expires Mon, 23 Nov 2020 18:56:43 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	42ms 40ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=248&w=474&rm=1&fy=1&gp=1&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=https%3A%2F%2Ft.co&t=1606157796238&de=135777613503&rx=820943480488&cu=1606157796238&m=6917&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=1&lb=9538&le=1&lf=716&lg=1&lh=85&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A887%3A887%3A0%3A953&as=1&ag=5009&an=1778&gi=1&gf=5009&gg=1778&ix=5009&ic=5009&ez=1&ck=1778&kw=1258&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5009&bx=1778&ci=1778&jz=1258&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5074&cd=1258&ah=5074&am=1258&rf=0&re=1&ft=4556&fv=1325&fw=1325&wb=2&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=aw-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=186589&na=627602386&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:43 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:43 GMT
POST H3-Q050	200	collect Show response www.google-analytics.com/j/	2 B 48 B	14ms 14ms	XHR text/plain	2a00:1450:4001:824::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j87&aip=1&a=2050800954&t=pageview&_s=1&dl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&dr=https%3A%2F%2Ft.co%2FcejlFPR8a9&ul=en-us&de=UTF-8&dt=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20away%20%7C%20ZDNet&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAEABAAAAAC~&jid=1901884569&gjid=1883282975&cid=183045475.1606157796&tid=UA-33613588-22&_gid=170172753.1606157803&_r=1&_slc=1&cd2=other&z=1110144061 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:43 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.zdnet.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	404	tboptevent.html widget.perfectmarket.com/opt/ Frame 63A6	0 0	20ms 19ms	Document text/plain	151.101.193.181 FASTLY
General Check archive.org Show headers Download Go to Full URL https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D Requested by Host: widget.perfectmarket.com URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.193.181 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash Request headers :method GET :authority widget.perfectmarket.com :scheme https :path /opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Response headers server Varnish retry-after 0 accept-ranges bytes date Mon, 23 Nov 2020 18:56:43 GMT via 1.1 varnish x-served-by cache-cdg20758-CDG x-cache MISS x-cache-hits 0 x-timer S1606157803.290331,VS0,VE0 content-length 0
GET H2	200	json Show response trc.taboola.com/cbsinteractive-zdnet/trc/3/	14 KB 5 KB	427ms 426ms	XHR application/javascript	151.101.113.44 FASTLY
General Check archive.org Show headers Download Go to Full URL https://trc.taboola.com/cbsinteractive-zdnet/trc/3/json?tim=19%3A56%3A43.822&lti=vpl_ctrl&data=%7B%22id%22%3A527%2C%22ii%22%3A%22%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22lbt%22%3A1606060369894%2C%22vi%22%3A1606157803818%2C%22cv%22%3A%2220201116-23-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22pev%22%3A4141%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22e%22%3A%22https%3A%2F%2Ft.co%2FcejlFPR8a9%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1600%2C%22dh%22%3A9562%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A8%2C%22uim%22%3A%22alternating-thumbnails-a%3Aabp%3D0%22%2C%22uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22orig_uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22cd%22%3A8957.03125%2C%22mw%22%3A770%7D%5D%2C%22cacheKey%22%3A%22text%3D%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2CZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%3Dalternating-thumbnails-a%3Aabp%3D0%22%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22vpl_ctrl%22%7D Requested by Host: cdn.taboola.com URL: https://cdn.taboola.com/libtrc/impl.20201116-23-RELEASE.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash b98d6bfc5d4bf1a8fc057aaac263316c1321076e8ed307ad8e900c38e33249b7 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers x-vcl-time-ms 395 date Mon, 23 Nov 2020 18:56:44 GMT content-encoding gzip server nginx x-timer S1606157804.837499,VS0,VE395 x-served-by cache-hhn4076-HHN vary Accept-Encoding x-cache MISS p3p policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" access-control-allow-origin https://www.zdnet.com access-control-allow-credentials true accept-ranges bytes content-type application/javascript; charset=utf-8 via 1.1 varnish x-cache-hits 0
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	85ms 85ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&rm=1&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=https%3A%2F%2Ft.co&t=1606157796238&de=568810459764&rx=820943480488&cu=1606157796238&m=7727&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=9562&le=1&lf=716&lg=1&lh=85&ch=0&vv=1&vw=1%3A0%3A0&vp=0&vx=0%3A-%3A-&pe=1%3A887%3A887%3A0%3A953&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&aj=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&dj=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5083&cd=10&ah=5083&am=10&rf=0&re=1&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=aw-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&tc=0&fs=186589&na=2093486193&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:44 GMT
GET H2	200	cta-branding.js Show response cdn.taboola.com/demand-formats/cta-branding/	22 KB 5 KB	29ms 28ms	Script application/javascript	151.101.13.44 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.taboola.com/demand-formats/cta-branding/cta-branding.js Requested by Host: cdn.taboola.com URL: https://cdn.taboola.com/libtrc/impl.20201116-23-RELEASE.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash d105039750eae90346c700600eee4d839f6c61aec77f30669013c2c01d0d7361 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id MPfcHgBulRizUm1OhOUPQznYQ1jgzw60 content-encoding gzip etag "8cee40ddbad0d56c6e33b6479d8e45c4" age 5748 x-cache HIT x-amz-replication-status PENDING content-length 4310 x-amz-id-2 CwwtQCduCl+T76f9HGvrkRu/59XuVKsgyM1KCgZ82weig+RGB+WnHJ+CBEjuF/ur9BJgiZcs4LE= x-served-by cache-fra19142-FRA last-modified Sun, 15 Nov 2020 09:20:35 GMT server AmazonS3 x-timer S1606157804.269371,VS0,VE0 date Mon, 23 Nov 2020 18:56:44 GMT vary Accept-Encoding x-amz-request-id C803D9C9AA785B79 via 1.1 varnish cache-control private,max-age=14400 accept-ranges bytes content-type application/javascript abp 78 x-cache-hits 6217
GET H2	200	cta-branding.css cdn.taboola.com/demand-formats/cta-branding/	3 KB 941 B	29ms 28ms	Stylesheet text/css	151.101.13.44 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.taboola.com/demand-formats/cta-branding/cta-branding.css Requested by Host: cdn.taboola.com URL: https://cdn.taboola.com/libtrc/impl.20201116-23-RELEASE.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash b2cb57515497d75f4345929ae896c87c21f27d609aed94fb83f857e5b96f9835 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id tcahAQL7SM5vHmChLog9xryayd2KNhUu content-encoding gzip etag "9e155136143a96e23a99757df9aa3cc8" age 5753 x-cache HIT x-amz-replication-status PENDING content-length 728 x-amz-id-2 f65xj6iuxogMKrz0V0PcFaMwZec2VDREXRA0jdjbf3aLNlkxtn2vhTmCXQ21535SK5HpYLHFJGI= x-served-by cache-fra19142-FRA last-modified Sun, 15 Nov 2020 09:20:35 GMT server AmazonS3 x-timer S1606157804.271772,VS0,VE0 date Mon, 23 Nov 2020 18:56:44 GMT vary Accept-Encoding x-amz-request-id 414C1B5C7AA1A893 via 1.1 varnish cache-control private,max-age=14400 accept-ranges bytes content-type text/css abp 78 x-cache-hits 6137
GET H2	200	userx.20201116-23-RELEASE.es6.js Show response cdn.taboola.com/libtrc/	23 KB 8 KB	31ms 31ms	Script application/javascript	151.101.13.44 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.taboola.com/libtrc/userx.20201116-23-RELEASE.es6.js Requested by Host: cdn.taboola.com URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 9ec1d960b9c13263c5acac08d184a8ea24c401bd7cc00ae34fc41fc7694d3cf7 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id 8AdQq2s2jDt1jE8u9BhnhZm3qRZiiS85 content-encoding gzip etag "57a52f762444c874b7d3e1d5813c5886" age 12 x-cache HIT x-amz-replication-status COMPLETED content-length 7880 x-amz-id-2 f0VuYJsHuHsYgzZcITwKVL1XaOY4TzFDsKBzgGLXLzUuydS8p5rS9oSAuTHLc9SHsEP4LbySn/o= x-served-by cache-fra19142-FRA last-modified Tue, 17 Nov 2020 00:38:04 GMT server AmazonS3 x-timer S1606157804.311140,VS0,VE1 date Mon, 23 Nov 2020 18:56:44 GMT vary Accept-Encoding x-amz-request-id C00AF1605EF2CE8A via 1.1 varnish cache-control private,max-age=14400 accept-ranges bytes content-type application/javascript; charset=utf-8 abp 78 x-cache-hits 1
GET H2	204	social trc-events.taboola.com/cbsinteractive-zdnet/log/3/	0 274 B	30ms 29ms	Image text/plain	141.226.228.48 TABOOLA-AS
General Check archive.org Show headers Download Go to Show image Full URL https://trc-events.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=vpl_ctrl&ri=ff1e5bdf0725842e5e0e992dcb015bc0&sd=v2_2a3e0fc01b5406002332aca9d69273e1_97c3bb6f-5025-4751-a3ef-dc415cfd38bb-tuct6b58b6b_1606157803_1606157803_CGoQzro_GKrC3LPfLiABKAEwSjjE1whA7IsQSJSE2ANQ7aEPWAFgAGjipqqRsq2X4nA&ui=97c3bb6f-5025-4751-a3ef-dc415cfd38bb-tuct6b58b6b&pi=/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&wi=3925768829892879526&pt=text&vi=1606157803818&st=social-available&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22widget%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22ctx%22%2C%22ism%22%3Afalse%2C%22srx%22%3A1600%2C%22sry%22%3A1200%2C%22pd%22%3Anull%2C%22tpl%22%3A%22%22%2C%22url%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%22%2C%22rref%22%3A%22https%3A%2F%2Ft.co%2FcejlFPR8a9%22%2C%22sref%22%3A%22_sessionPending_%22%2C%22hdl%22%3A%22%22%2C%22sec%22%3A%22%22%2C%22aut%22%3A%22%22%2C%22img%22%3A%22%22%2C%22v%22%3A13%7D%5D%7D&tim=19%3A56%3A44.315&id=4224&llvl=1&cv=20201116-23-RELEASE& Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:44 GMT server nginx x-fastly-to-nlb-rtt 9352 p3p policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" access-control-allow-origin * cache-control no-cache access-control-allow-credentials true tbl-x-upstream 10.40.20.9:10213
GET H2	204	social trc-events.taboola.com/cbsinteractive-zdnet/log/3/	0 275 B	32ms 31ms	Image text/plain	141.226.228.48 TABOOLA-AS
General Check archive.org Show headers Download Go to Show image Full URL https://trc-events.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=vpl_ctrl&ri=ff1e5bdf0725842e5e0e992dcb015bc0&sd=v2_2a3e0fc01b5406002332aca9d69273e1_97c3bb6f-5025-4751-a3ef-dc415cfd38bb-tuct6b58b6b_1606157803_1606157803_CGoQzro_GKrC3LPfLiABKAEwSjjE1whA7IsQSJSE2ANQ7aEPWAFgAGjipqqRsq2X4nA&ui=97c3bb6f-5025-4751-a3ef-dc415cfd38bb-tuct6b58b6b&pi=/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&wi=3925768829892879526&pt=text&vi=1606157803818&st=social-visible&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A1%2C%22ln%22%3A%22below-fold%22%2C%22lx%22%3A341%2C%22ly%22%3A765%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%5D%7D&tim=19%3A56%3A44.315&id=4690&llvl=1&cv=20201116-23-RELEASE& Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:44 GMT server nginx x-fastly-to-nlb-rtt 9352 p3p policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" access-control-allow-origin * cache-control no-cache access-control-allow-credentials true tbl-x-upstream 10.41.32.36:10213
GET H2	204	social trc-events.taboola.com/cbsinteractive-zdnet/log/3/	0 275 B	30ms 30ms	Image text/plain	141.226.228.48 TABOOLA-AS
General Check archive.org Show headers Download Go to Show image Full URL https://trc-events.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=vpl_ctrl&ri=ff1e5bdf0725842e5e0e992dcb015bc0&sd=v2_2a3e0fc01b5406002332aca9d69273e1_97c3bb6f-5025-4751-a3ef-dc415cfd38bb-tuct6b58b6b_1606157803_1606157803_CGoQzro_GKrC3LPfLiABKAEwSjjE1whA7IsQSJSE2ANQ7aEPWAFgAGjipqqRsq2X4nA&ui=97c3bb6f-5025-4751-a3ef-dc415cfd38bb-tuct6b58b6b&pi=/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&wi=3925768829892879526&pt=text&vi=1606157803818&st=social-visible&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A1%2C%22ln%22%3A%22below-fold%22%2C%22lx%22%3A383%2C%22ly%22%3A765%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%5D%7D&tim=19%3A56%3A44.316&id=4102&llvl=1&cv=20201116-23-RELEASE& Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:44 GMT server nginx x-fastly-to-nlb-rtt 9352 p3p policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" access-control-allow-origin * cache-control no-cache access-control-allow-credentials true tbl-x-upstream 10.41.24.10:10213
GET H2	200	f539211219b796ffbb49949997c764f0.png cdn.taboola.com/libtrc/static/thumbnails/	254 B 666 B	29ms 28ms	Image image/png	151.101.13.44 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC via 1.1 varnish etag "dfa7b52c86e56bd67fa4002f6ed19854" age 25210 x-cache HIT x-amz-replication-status COMPLETED content-length 254 x-amz-id-2 Vjnfq2okxpLEG/cBVxSfv3DOOCGN7KTpixt29L7DwUhoZL6eRlgDSODZqhfatrYL58q01gaLKf4= x-served-by cache-fra19142-FRA last-modified Wed, 24 Jun 2015 07:14:11 GMT server AmazonS3 x-amz-meta-s3cmd-attrs uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567 x-timer S1606157804.404760,VS0,VE0 date Mon, 23 Nov 2020 18:56:44 GMT x-amz-request-id F6D91014AAA6CDC4 cache-control private,max-age=31536000 accept-ranges bytes content-type image/png abp 78 x-cache-hits 42443
POST H2	204	bulk Show response trc.taboola.com/cbsinteractive-zdnet/log/3/	0 80 B	38ms 38ms	XHR image/gif	151.101.113.44 FASTLY
General Check archive.org Show headers Download Go to Full URL https://trc.taboola.com/cbsinteractive-zdnet/log/3/bulk?route=AM%3AAM%3AV&lti=vpl_ctrl&bulkSize=1 Requested by Host: cdn.taboola.com URL: https://cdn.taboola.com/libtrc/impl.20201116-23-RELEASE.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers x-vcl-time-ms 10 pragma no-cache date Mon, 23 Nov 2020 18:56:45 GMT via 1.1 varnish server nginx x-timer S1606157805.341280,VS0,VE10 x-served-by cache-hhn4076-HHN x-cache MISS p3p policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" access-control-allow-origin https://www.zdnet.com cache-control no-cache access-control-allow-credentials true accept-ranges bytes content-type image/gif x-cache-hits 0
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	32ms 31ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=248&w=474&rm=1&fy=1&gp=1&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=https%3A%2F%2Ft.co&t=1606157796238&de=135777613503&rx=820943480488&cu=1606157796238&m=11998&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=1&lb=10089&le=1&lf=716&lg=1&lh=85&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A887%3A887%3A0%3A953&as=1&ag=10090&an=5009&gi=1&gf=10090&gg=5009&ix=10090&ic=10090&ez=1&ck=1778&kw=1258&aj=1&pg=100&pf=100&ib=0&cc=1&bw=10090&bx=5009&ci=1778&jz=1258&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=10258&cd=5074&ah=10258&am=5074&rf=0&re=1&ft=7908&fv=4556&fw=1325&wb=2&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=aw-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=186589&na=684471130&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:48 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:48 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	32ms 32ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&rm=1&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=https%3A%2F%2Ft.co&t=1606157796238&de=568810459764&rx=820943480488&cu=1606157796238&m=12812&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=10089&le=1&lf=716&lg=1&lh=85&ch=0&vv=1&vw=1%3A0%3A0&vp=0&vx=0%3A-%3A-&pe=1%3A887%3A887%3A0%3A953&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&aj=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&dj=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=10169&cd=5083&ah=10169&am=5083&rf=0&re=1&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=aw-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&tc=0&fs=186589&na=2016980390&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:49 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:49 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	32ms 32ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=157&w=300&rm=1&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=https%3A%2F%2Ft.co&t=1606157796238&de=840078733663&rx=820943480488&cu=1606157796238&m=12813&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=10089&le=1&lf=716&lg=1&lh=85&ch=0&vv=1&vw=1%3A0%3A0&vp=0&vx=0%3A-%3A-&pe=1%3A887%3A887%3A0%3A953&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&aj=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&dj=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=10159&cd=343&ah=10159&am=343&rf=0&re=1&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=aw-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&tc=0&fs=186589&na=1571493413&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:49 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:49 GMT
POST H/1.1	200 OK	NRJS-04e0f5db0886b3b33ff Show response bam-cell.nr-data.net/events/1/	24 B 489 B	185ms 184ms	XHR image/gif	162.247.243.147 NEWRELIC-AS-1
General Check archive.org Show headers Download Go to Full URL https://bam-cell.nr-data.net/events/1/NRJS-04e0f5db0886b3b33ff?a=450235099&v=1184.ab39b52&to=ZFMHbUMCXktYWxJZX10ZJFpFCl9WFlkURFlQWgBmQgpeX1Vd&rst=20025&ck=1&ref=https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Requested by Host: js-agent.newrelic.com URL: https://js-agent.newrelic.com/nr-1184.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.147 San Francisco, United States, ASN23467 (NEWRELIC-AS-1, US), Reverse DNS Software cloudflare / Resource Hash 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 content-type text/plain Response headers Date Mon, 23 Nov 2020 18:56:52 GMT CF-Cache-Status DYNAMIC Server cloudflare Expect-CT max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Vary Accept-Encoding Content-Type image/gif Access-Control-Allow-Origin https://www.zdnet.com Access-Control-Allow-Credentials true Connection keep-alive CF-Ray 5f6d1cd7484132ab-CDG Content-Length 24 cf-request-id 0698105a9c000032abe5a18000000001
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	32ms 31ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=25&q=2&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F11253319325380860251%2Fdownsize_200k_v1%3Fsqp%3D4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoI2gMQ-AEYASABLQAAAD8w2gM4-AFFAACAPw%26rs%3DAOga4qngw5zs6rQKmhlqcFQxkZZ0oJOwfg&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=6&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=248&w=474&rm=1&fy=1&gp=1&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=https%3A%2F%2Ft.co%2FcejlFPR8a9&t=1606157796238&de=135777613503&rx=820943480488&cu=1606157796238&m=17084&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=1&lb=10089&le=1&lf=716&lg=1&lh=85&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A887%3A887%3A0%3A953&as=1&ag=15176&an=10090&gi=1&gf=15176&gg=10090&ix=15176&ic=15176&ez=1&ck=1778&kw=1258&aj=1&pg=100&pf=100&ib=0&cc=1&bw=15176&bx=10090&ci=1778&jz=1258&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=15345&cd=10258&ah=15345&am=10258&rf=0&re=1&ft=7908&fv=7908&fw=1325&wb=2&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=aw-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=186589&zsqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoI2gMQ-AEYASABLQAAAD8w2gM4-AFFAACAPw&zrs=AOga4qngw5zs6rQKmhlqcFQxkZZ0oJOwfg&na=903368680&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:53 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:53 GMT