URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Submission: On June 09 via manual from US

Summary

This website contacted 93 IPs in 7 countries across 55 domains to perform 322 HTTP transactions. The main IP is 72.247.178.8, located in Amsterdam, Netherlands and belongs to AKAMAI-ASN1, US. The main domain is www.zdnet.com.
This is the only time www.zdnet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
22 72.247.178.8 20940 (AKAMAI-ASN1)
1 95.100.248.163 20940 (AKAMAI-ASN1)
17 72.247.178.24 20940 (AKAMAI-ASN1)
1 54.192.37.97 16509 (AMAZON-02)
2 52.84.32.101 16509 (AMAZON-02)
4 104.108.48.32 16625 (AKAMAI-AS)
15 68.232.35.180 15133 (EDGECAST)
1 95.100.248.154 20940 (AKAMAI-ASN1)
15 2a00:1450:400... 15169 (GOOGLE)
17 172.217.22.98 15169 (GOOGLE)
17 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:64:... 20940 (AKAMAI-ASN1)
2 2400:cb00:204... 13335 (CLOUDFLAR...)
3 23.111.9.30 54104 (AS-NETDNA)
2 23.111.11.222 54104 (AS-NETDNA)
2 2400:cb00:204... 13335 (CLOUDFLAR...)
1 2a02:26f0:78:... 20940 (AKAMAI-ASN1)
3 2400:cb00:204... 13335 (CLOUDFLAR...)
2 95.101.246.112 16625 (AKAMAI-AS)
1 34.249.129.150 16509 (AMAZON-02)
3 2400:cb00:204... 13335 (CLOUDFLAR...)
2 95.101.245.232 16625 (AKAMAI-AS)
4 52.84.28.208 16509 (AMAZON-02)
2 95.100.248.168 20940 (AKAMAI-ASN1)
2 54.154.158.135 16509 (AMAZON-02)
2 216.239.120.246 6623 (CBSI-1)
3 185.33.223.209 29990 (ASN-APPNEXUS)
3 185.33.223.206 29990 (ASN-APPNEXUS)
2 52.206.49.191 14618 (AMAZON-AES)
1 173.241.240.143 36089 (OPENX-AS1)
2 34.251.148.123 16509 (AMAZON-02)
1 52.208.40.88 16509 (AMAZON-02)
18 151.101.114.2 54113 (FASTLY)
2 54.229.75.228 16509 (AMAZON-02)
1 95.101.241.136 16625 (AKAMAI-AS)
2 34.207.48.84 14618 (AMAZON-AES)
1 2a03:2880:f01... 32934 (FACEBOOK)
1 2620:109:c00c... 14413 (LINKEDIN)
2 151.101.113.181 54113 (FASTLY)
4 95.100.248.105 20940 (AKAMAI-ASN1)
1 52.57.223.246 16509 (AMAZON-02)
2 95.100.248.112 20940 (AKAMAI-ASN1)
1 66.235.148.133 15224 (OMNITURE)
2 52.31.65.152 16509 (AMAZON-02)
1 62.67.193.85 26667 (RUBICONPR...)
1 198.47.127.15 62713 (AS-PUBMATIC)
24 95.101.252.144 16625 (AKAMAI-AS)
2 52.84.34.90 16509 (AMAZON-02)
1 192.132.33.27 18568 (BIDTELLECT)
8 95.100.186.168 16625 (AKAMAI-AS)
1 2a03:2880:f01... 32934 (FACEBOOK)
1 52.48.142.133 16509 (AMAZON-02)
2 34.198.184.115 14618 (AMAZON-AES)
1 52.203.183.164 14618 (AMAZON-AES)
2 2a00:1450:400... 15169 (GOOGLE)
3 54.86.159.215 14618 (AMAZON-AES)
1 34.196.245.179 14618 (AMAZON-AES)
3 34.199.132.64 14618 (AMAZON-AES)
1 52.200.5.59 14618 (AMAZON-AES)
1 66.235.148.65 15224 (OMNITURE)
8 54.192.36.140 16509 (AMAZON-02)
1 34.199.66.174 14618 (AMAZON-AES)
1 52.1.246.30 16509 (AMAZON-02)
1 54.88.164.103 14618 (AMAZON-AES)
1 178.250.2.71 44788 (ASN-CRITE...)
1 192.132.33.31 18568 (BIDTELLECT)
3 52.31.88.15 16509 (AMAZON-02)
2 54.72.151.68 16509 (AMAZON-02)
6 52.30.66.229 16509 (AMAZON-02)
1 23.0.40.31 20940 (AKAMAI-ASN1)
1 52.49.214.49 16509 (AMAZON-02)
1 204.154.111.113 36062 (DOUBLE-VE...)
1 151.101.14.49 54113 (FASTLY)
1 151.101.112.233 54113 (FASTLY)
1 52.201.11.100 14618 (AMAZON-AES)
4 52.17.60.112 16509 (AMAZON-02)
3 2a00:1450:400... 15169 (GOOGLE)
1 50.16.161.127 14618 (AMAZON-AES)
1 52.4.251.102 16509 (AMAZON-02)
1 54.192.36.93 16509 (AMAZON-02)
1 52.84.40.203 16509 (AMAZON-02)
1 54.210.16.8 14618 (AMAZON-AES)
1 54.146.151.35 14618 (AMAZON-AES)
1 178.250.0.67 44788 (ASN-CRITE...)
4 104.108.56.114 16625 (AKAMAI-AS)
1 138.108.96.100 16477 (ACNIELSEN-AS)
2 2a03:2880:f01... 32934 (FACEBOOK)
1 95.100.248.115 20940 (AKAMAI-ASN1)
3 66.117.28.68 15224 (OMNITURE)
1 2a03:2880:f11... 32934 (FACEBOOK)
1 2a00:1450:401... 15169 (GOOGLE)
1 2a00:1288:110... 34010 (YAHOO-IRD)
322 93
Apex Domain
Subdomains
Transfer
35 moatads.com
z.moatads.com
geo.moatads.com
js.moatads.com
px.moatads.com
1 MB
32 cbsistatic.com
zdnet1.cbsistatic.com
zdnet4.cbsistatic.com
zdnet3.cbsistatic.com
zdnet2.cbsistatic.com
2 MB
30 googlesyndication.com
tpc.googlesyndication.com
pagead2.googlesyndication.com
297 KB
19 teads.tv
cdn.teads.tv
sync.teads.tv Failed
a.teads.tv
t.teads.tv
cdn2.teads.tv
407 KB
19 taboola.com
cdn.taboola.com
trc.taboola.com
match.taboola.com
images.taboola.com
171 KB
17 doubleclick.net
securepubads.g.doubleclick.net
pubads.g.doubleclick.net
151 KB
15 tiqcdn.com
tags.tiqcdn.com
81 KB
13 fyre.co
zdnet.bootstrap.fyre.co
zor.fyre.co
zdnet.stream1.fyre.co
avatars.fyre.co
224 KB
10 viglink.com
cdn.viglink.com
api.viglink.com
54 KB
9 livefyre.com
cdn.livefyre.com
data.livefyre.com
bootstrap.livefyre.com
lc.livefyre.com
lc72.dsr.livefyre.com
ct214.dsr.livefyre.com
55 KB
7 zdnet.com
www.zdnet.com
38 KB
6 adnxs.com
secure.adnxs.com
ib.adnxs.com
370 B
6 demdex.net
dpm.demdex.net
cbsi.demdex.net
att.demdex.net
fast.cbsi.demdex.net Failed
3 KB
5 scorecardresearch.com
b.scorecardresearch.com
2 KB
5 cbsi.com
dw.cbsi.com
om.cbsi.com
rev.cbsi.com
2 KB
4 qualtrics.com
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
siteintercept.qualtrics.com
26 KB
4 bttrack.com
cdn.bttrack.com
bttrack.com
api.bttrack.com
38 KB
4 netseer.com
cl.netseer.com Failed
cmi.netseer.com
cm.netseer.com
168 B
4 ml314.com
ml314.com
in.ml314.com
11 KB
4 pagefair.com
asset.pagefair.com
stats.pagefair.com
5 KB
3 everesttech.net
pixel.everesttech.net
384 B
3 gstatic.com
csi.gstatic.com
3 tru.am
tru.am
12 KB
3 lightboxcdn.com
www.lightboxcdn.com
137 KB
3 cbsimg.net
cn.cbsimg.net
dw.cbsimg.net
b2b.cbsimg.net
24 KB
3 go-mpulse.net
c.go-mpulse.net
40 KB
2 facebook.net
connect.facebook.net
19 KB
2 criteo.com
cas.criteo.com
gum.criteo.com
141 B
2 google-analytics.com
www.google-analytics.com
12 KB
2 perfectmarket.com
widget.perfectmarket.com
94 KB
2 facebook.com
graph.facebook.com
www.facebook.com
535 B
2 casalemedia.com
as.casalemedia.com
900 B
2 everestjs.net
www.everestjs.net
17 KB
2 pagefair.net
asset.pagefair.net
229 B
2 googletagservices.com
www.googletagservices.com
3 KB
2 ns-cdn.com
ps.ns-cdn.com
9 KB
1 akstat.io
22fa047d.akstat.io
1 yieldmanager.com
ad.yieldmanager.com
1 google.de
www.google.de
42 B
1 imrworldwide.com
secure-us.imrworldwide.com
44 B
1 doubleverify.com
tps30.doubleverify.com
305 B
1 researchnow.com
tag.researchnow.com
42 B
1 atdmt.com
ad.atdmt.com
51 B
1 pubmatic.com
image2.pubmatic.com
42 B
1 rubiconproject.com
pixel.rubiconproject.com
42 B
1 eyeota.net
ps.eyeota.net
70 B
1 rlcdn.com
idsync.rlcdn.com Failed
43 B
1 linkedin.com
www.linkedin.com
191 B
1 optimizely.com
cdn.optimizely.com
72 KB
1 openx.net
us-u.openx.net
43 B
1 clicktale.net
cdn.clicktale.net
4 KB
1 akamaihd.net
iicbsi-a.akamaihd.net
28 B
1 sharethrough.com
native.sharethrough.com
70 KB
1 indexww.com
js.indexww.com
18 KB
0 bluekai.com Failed
tags.bluekai.com Failed
322 55
Domain Requested by
22 z.moatads.com securepubads.g.doubleclick.net
www.zdnet.com
17 tpc.googlesyndication.com securepubads.g.doubleclick.net
zdnet3.cbsistatic.com
www.zdnet.com
16 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
www.zdnet.com
15 tags.tiqcdn.com zdnet2.cbsistatic.com
tags.tiqcdn.com
13 pagead2.googlesyndication.com securepubads.g.doubleclick.net
www.zdnet.com
11 zdnet1.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zor.fyre.co
10 geo.moatads.com z.moatads.com
10 zdnet4.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zor.fyre.co
9 zor.fyre.co cdn.livefyre.com
zor.fyre.co
www.zdnet.com
8 images.taboola.com www.zdnet.com
8 t.teads.tv www.zdnet.com
7 www.zdnet.com www.zdnet.com
zdnet3.cbsistatic.com
6 trc.taboola.com cdn.taboola.com
www.zdnet.com
6 cdn.teads.tv www.zdnet.com
cdn.teads.tv
6 api.viglink.com cdn.viglink.com
6 zdnet2.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
5 b.scorecardresearch.com cdn.taboola.com
www.zdnet.com
widget.perfectmarket.com
tags.tiqcdn.com
5 secure.adnxs.com js.indexww.com
5 zdnet3.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zor.fyre.co
4 cdn.taboola.com zdnet2.cbsistatic.com
cdn.taboola.com
4 cdn.livefyre.com zdnet2.cbsistatic.com
cdn.livefyre.com
4 cdn.viglink.com tags.tiqcdn.com
www.zdnet.com
3 pixel.everesttech.net www.zdnet.com
3 siteintercept.qualtrics.com zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
3 csi.gstatic.com pagead2.googlesyndication.com
tpc.googlesyndication.com
3 a.teads.tv cdn.teads.tv
3 cmi.netseer.com www.zdnet.com
3 dpm.demdex.net tags.tiqcdn.com
www.zdnet.com
3 tru.am tags.tiqcdn.com
tru.am
3 ml314.com tags.tiqcdn.com
ml314.com
www.zdnet.com
3 www.lightboxcdn.com www.zdnet.com
www.lightboxcdn.com
3 asset.pagefair.com zdnet3.cbsistatic.com
asset.pagefair.com
www.zdnet.com
3 c.go-mpulse.net zdnet4.cbsistatic.com
c.go-mpulse.net
2 connect.facebook.net tags.tiqcdn.com
connect.facebook.net
2 px.moatads.com www.zdnet.com
2 cdn2.teads.tv cdn.teads.tv
2 www.google-analytics.com www.zdnet.com
2 cdn.bttrack.com securepubads.g.doubleclick.net
www.zdnet.com
2 om.cbsi.com tags.tiqcdn.com
www.zdnet.com
2 widget.perfectmarket.com cdn.taboola.com
widget.perfectmarket.com
2 zdnet.bootstrap.fyre.co cdn.livefyre.com
2 cbsi.demdex.net tags.tiqcdn.com
2 dw.cbsi.com tags.tiqcdn.com
www.zdnet.com
2 as.casalemedia.com js.indexww.com
2 www.everestjs.net tags.tiqcdn.com
www.everestjs.net
2 asset.pagefair.net zdnet3.cbsistatic.com
www.zdnet.com
2 www.googletagservices.com zdnet2.cbsistatic.com
rev.cbsi.com
2 ps.ns-cdn.com www.zdnet.com
ps.ns-cdn.com
1 22fa047d.akstat.io c.go-mpulse.net
1 ad.yieldmanager.com www.zdnet.com
1 www.google.de
1 www.facebook.com www.zdnet.com
connect.facebook.net
1 secure-us.imrworldwide.com
1 zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com tags.tiqcdn.com
1 gum.criteo.com native.sharethrough.com
1 ct214.dsr.livefyre.com cdn.livefyre.com
1 js.moatads.com cdn.teads.tv
1 lc72.dsr.livefyre.com cdn.livefyre.com
1 avatars.fyre.co www.zdnet.com
1 lc.livefyre.com cdn.livefyre.com
1 zdnet.stream1.fyre.co cdn.livefyre.com
1 bootstrap.livefyre.com cdn.livefyre.com
1 data.livefyre.com cdn.livefyre.com
1 match.taboola.com www.zdnet.com
1 tps30.doubleverify.com www.zdnet.com
1 att.demdex.net www.zdnet.com
1 tag.researchnow.com www.zdnet.com
1 pubads.g.doubleclick.net cdn.teads.tv
1 api.bttrack.com cdn.bttrack.com
1 cas.criteo.com cdn.bttrack.com
1 cm.netseer.com www.zdnet.com
1 stats.pagefair.com zdnet3.cbsistatic.com
1 ad.atdmt.com www.zdnet.com
1 rev.cbsi.com securepubads.g.doubleclick.net
1 bttrack.com securepubads.g.doubleclick.net
cdn.bttrack.com
1 ib.adnxs.com www.zdnet.com
1 image2.pubmatic.com www.zdnet.com
1 pixel.rubiconproject.com www.zdnet.com
1 b2b.cbsimg.net www.zdnet.com
1 ps.eyeota.net www.zdnet.com
1 idsync.rlcdn.com www.zdnet.com
1 www.linkedin.com zdnet3.cbsistatic.com
1 graph.facebook.com zdnet3.cbsistatic.com
1 cdn.optimizely.com zdnet2.cbsistatic.com
1 in.ml314.com ml314.com
1 us-u.openx.net www.zdnet.com
1 dw.cbsimg.net tags.tiqcdn.com
1 cdn.clicktale.net tags.tiqcdn.com
1 iicbsi-a.akamaihd.net tags.tiqcdn.com
1 cn.cbsimg.net zdnet2.cbsistatic.com
1 native.sharethrough.com www.zdnet.com
1 js.indexww.com www.zdnet.com
0 fast.cbsi.demdex.net Failed tags.tiqcdn.com
0 sync.teads.tv Failed www.zdnet.com
cdn.teads.tv
0 tags.bluekai.com Failed www.zdnet.com
0 cl.netseer.com Failed ps.ns-cdn.com
322 96
Subject Issuer Validity Valid
*.g.doubleclick.net
Google Internet Authority G2
2017-05-31 -
2017-08-23
3 months crt.sh
a248.e.akamai.net
Symantec Class 3 ECC 256 bit SSL CA - G2
2016-07-28 -
2017-07-28
a year crt.sh
www.everestjs.net
Symantec Class 3 Secure Server CA - G4
2016-09-22 -
2017-09-22
a year crt.sh
*.ml314.com
COMODO RSA Domain Validation Secure Server CA
2015-04-21 -
2018-04-20
3 years crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA
2016-12-09 -
2018-12-14
2 years crt.sh

COMODO RSA Domain Validation Secure Server CA
2016-02-10 -
2018-02-09
2 years crt.sh
tpc.googlesyndication.com
Google Internet Authority G2
2017-05-31 -
2017-08-23
3 months crt.sh
*.moatads.com
RapidSSL SHA256 CA
2016-04-13 -
2017-07-13
a year crt.sh
*.bttrack.com
COMODO RSA Domain Validation Secure Server CA
2016-03-24 -
2019-04-14
3 years crt.sh
aka.proceau.net
Gandi Standard SSL CA 2
2017-05-08 -
2019-05-08
2 years crt.sh
www.cbs.com
GeoTrust SSL CA - G3
2017-03-31 -
2018-05-12
a year crt.sh
*.atlassolutions.com
DigiCert SHA2 High Assurance Server CA
2017-04-27 -
2018-05-31
a year crt.sh
*.google-analytics.com
Google Internet Authority G2
2017-05-31 -
2017-08-23
3 months crt.sh
*.researchnow.com
Symantec Class 3 Secure Server CA - G4
2016-11-02 -
2017-11-02
a year crt.sh
*.demdex.net
DigiCert SHA2 High Assurance Server CA
2014-11-09 -
2018-01-24
3 years crt.sh
*.doubleverify.com
Network Solutions OV Server CA 2
2016-12-13 -
2019-12-13
3 years crt.sh
*.google.com
Google Internet Authority G2
2017-05-31 -
2017-08-23
3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2016-12-09 -
2018-01-25
a year crt.sh

This page contains 32 frames:

Primary Page: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Frame ID: 603.1
Requests: 213 HTTP requests in this frame

Frame: http://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Frame ID: 603.2
Requests: 2 HTTP requests in this frame

Frame: http://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1496978567361&lv=1
Frame ID: 603.3
Requests: 2 HTTP requests in this frame

Frame: http://cl.netseer.com/dsatserving2/servlet/BannerServer?tagid=21103&url=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&adh=240&adw=770&imps=2&impt=1&frd=1496978567512&apid=1980159&mresp=0&t=0.8628173348193167
Frame ID: 603.5
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Frame ID: 603.7
Requests: 8 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Frame ID: 603.8
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Frame ID: 603.9
Requests: 7 HTTP requests in this frame

Frame: http://tpc.googlesyndication.com/safeframe/1-0-8/html/container.html
Frame ID: 603.19
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Frame ID: 603.11
Requests: 7 HTTP requests in this frame

Frame: http://tpc.googlesyndication.com/safeframe/1-0-8/html/container.html
Frame ID: 603.20
Requests: 1 HTTP requests in this frame

Frame: https://cdn.bttrack.com/js/infeed/1.1/20bc0442-8bec-43f8-9992-08be6e6a3591/31850205/infeed.min.js?bustframe=1
Frame ID: 603.13
Requests: 10 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Frame ID: 603.14
Requests: 6 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Frame ID: 603.15
Requests: 7 HTTP requests in this frame

Frame: https://cdn.teads.tv/media/format.js
Frame ID: 603.16
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Frame ID: 603.17
Requests: 7 HTTP requests in this frame

Frame: https://rev.cbsi.com/common/js/adKit.min.js?1021365231
Frame ID: 603.18
Requests: 16 HTTP requests in this frame

Frame: http://sync.teads.tv/iframe/redirect
Frame ID: 603.21
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Frame ID: 603.22
Requests: 10 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Frame ID: 603.23
Requests: 7 HTTP requests in this frame

Frame: http://bttrack.com/Pixel/Impression/?data=OuJifVtEKZqw3Hzm6f7tW7Pt5tYXW6YgQ67bxMhTPvcdvD21yECtadqcc2b3ezXHmnsOuoo9IdOJDmsbcAdtQEL0FlmyyBFBGHax9kvS-Whuo5keArV_MmUwYWItSaShZ50pP7OmglARsgpApKVrjQATh8sf_9N5XFxYJCTCbmmp0LK8PfJYyOYI1W-ZkFZpSxARywY-42eqJ2HmCIaPYotutOsG1jqsmFhu6kupvUed93uYYoAb-0LU4zug_aCLqYGHLHYknpE21E5_jYteEeOnyBcyvXQY4Yl1TL2Vc8btt45vMQ_8tUjobdHsAI66znN98lZMWS1OUBNfAZryU0hR8spiXk5KCX_wb0aIQAbfJP5Tj5zFxPRevNA2xVHD6M6uqRxv0S2Zu9UsLRddG6U_YfA00
Frame ID: 603.24
Requests: 1 HTTP requests in this frame

Frame: http://match.taboola.com/sg/thetradedesk-network/1/rtb-h?taboola_hm=70df82eb-b8d1-4e97-b70c-10d3446fdea5&tbid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09
Frame ID: 603.25
Requests: 3 HTTP requests in this frame

Frame: http://sync.teads.tv/iframe?pid=61059&userId=300307ed-807e-463d-bce8-e1b0e0e3c93a&1496978569562
Frame ID: 603.27
Requests: 1 HTTP requests in this frame

Frame: http://trc.taboola.com/cbsinteractive-zdnet/log/3/available
Frame ID: 603.28
Requests: 1 HTTP requests in this frame

Frame: http://cdn.teads.tv/media/format/v3/assets/default/player-sprite.svg
Frame ID: 603.30
Requests: 1 HTTP requests in this frame

Frame: http://fast.cbsi.demdex.net/dest5.html?d_nsid=undefined
Frame ID: 603.34
Requests: 1 HTTP requests in this frame

Frame: http://fast.cbsi.demdex.net/dest5.html?d_nsid=0
Frame ID: 603.35
Requests: 1 HTTP requests in this frame

Frame: http://www.everestjs.net/static/pixel_details.html
Frame ID: 603.36
Requests: 1 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/static/identity.html?purl=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=1&prev=0&cb=636294540878687886
Frame ID: 603.37
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 603.38
Requests: 1 HTTP requests in this frame

Frame: http://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
Frame ID: 603.39
Requests: 1 HTTP requests in this frame

Frame: http://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
Frame ID: 603.43
Requests: 1 HTTP requests in this frame

Frame: http://cdn2.teads.tv/scala/141548/aef8ad1069fa72d00fc7ffc16a62d06b/240.mp4
Frame ID: 603.31
Requests: 1 HTTP requests in this frame

Screenshot


Page Statistics

322
Requests

27 %
HTTPS

18 %
IPv6

55
Domains

96
Subdomains

93
IPs

7
Countries

5855 kB
Transfer

15010 kB
Size

33
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request 76
  • http://cm.g.doubleclick.net/pixel?google_nid=netseer1&google_cm=&google_sc=&google_hm=dXNyM2ZlZDgzMTdlM2Y2ZmZkMw%3D%3D&google_tc=
  • http://cmi.netseer.com/match?ex=10&google_gid=CAESENfx3sPJWvZZA3YlujEiNCU&google_cver=1
Request 77
  • http://us-u.openx.net/w/1.0/sd?id=537073006&val=usr3fed8317e3f6ffd3
  • http://us-u.openx.net/w/1.0/sd?cc=1&id=537073006&val=usr3fed8317e3f6ffd3
Request 78
  • http://ads.yahoo.com/cms/v1?esig=1~da31edb5d54623b380c5f13de554040184d2c151&nwid=10000651871&sigv=1
  • http://cmi.netseer.com/match?ex=16&xid=WdycZS7boI5uJ6osqbQBfvVg
Request 102
  • https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&bid=gdo9o51&newuser=1
  • https://ps.eyeota.net/match?bid=gdo9o51&newuser=1&google_gid=CAESEC1H-HKfRJOKyLEEirkPvJg&google_cver=1
Request 103
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151335970770985%26eid=50220&mm_bnc&mm_bct
  • https://ml314.com/csync.ashx?fp=d79c593a-1487-4700-9ef2-546e83189443&person_id=5978151335970770985&eid=50220
Request 105
  • http://intent.cbsi.com/redir?tag=medi-right-rail&siteId=2&rsid=cnetzdnetglobalsite&pagetype=article&sl=en&sc=eu&topicguid=&assetguid=27081696-34e5-11e4-9e6a-00505685119a&assettype=content_article&f...
  • http://b2b.cbsimg.net/b.gif
Request 112
  • http://pixel.rubiconproject.com/tap.php?v=6073&nid=2100&expires=30&put=usr3fed8317e3f6ffd3
  • http://pixel.rubiconproject.com/tap.php?cookie_redirect=1&v=6073&nid=2100&expires=30&put=usr3fed8317e3f6ffd3
Request 116
  • http://b.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1496978567955&ns_c=UTF-8&cv=3.1&c8=Washington%20Post%2C%20Guardian%20links%20used%20to%20infect%20The%20Mask%20malware%20victi...
  • http://b.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1496978567955&ns_c=UTF-8&cv=3.1&c8=Washington%20Post%2C%20Guardian%20links%20used%20to%20infect%20The%20Mask%20malware%20vict...
Request 118
  • http://cmi.netseer.com/redirect?ex=18&t=3&cookie=2&cr=1
  • http://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwMDEmdGw9MTI5NjAw&piggybackCookie=usr3fe26b3d7c60ed93
Request 120
  • http://cm.netseer.com/pixelmatch?user_id=7041121888677254550&ex=14&ui=1&t=3
  • http://ib.adnxs.com/setuid?entity=19&code=usr3fe26b3d7c60ed93
Request 173
  • http://www.google-analytics.com/analytics.js
  • https://www.google-analytics.com/analytics.js
Request 201
  • http://www.google-analytics.com/r/collect?v=1&_v=j55&aip=1&a=790477278&t=pageview&_s=1&dl=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victi...
  • https://www.google-analytics.com/r/collect?v=1&_v=j55&aip=1&a=790477278&t=pageview&_s=1&dl=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-vict...
Request 203
  • http://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTk1NjkwMzUvdC8y/dpuid/14d961f4ad805689d47f15d0ba15101fd82f43abf03a3a0e13db010910bd6dec3528d9f17d145da0/url/http://idsync.rlcdn.com/367408.gif?partner_uid=...
  • http://idsync.rlcdn.com/367408.gif?partner_uid=3248526639972084495
Request 204
  • http://ssum.casalemedia.com/usermatchredir?s=183876&cb=http%3A%2F%2Fcmi.netseer.com%2Fpixelmatch%3Fex%3D39%26xid%3D__UID__%26t%3D3&C=1
  • http://cmi.netseer.com/pixelmatch?ex=39&xid=WToUiLlQJ8QAAHjozBgAAACE%261137&t=3
Request 205
  • http://bttrack.com/pixel/cookiesync/NetSeer1489?t=3
  • http://cm.netseer.com/pixelmatch?ex=41&buyerid=1c560347-2d91-4c7b-956d-a5c8d7a1899d
Request 208
  • http://sync.teads.tv/iframe?pid=32374&userId=6ddb3e27-dbfe-4c2d-ad37-30ae4606c599&1496978568969
  • http://sync.teads.tv/iframe/redirect
Request 232
  • https://ad.atdmt.com/i/img;adv=11022204319972;ec=11022204320517;adv.a=6141273;c.a=11235374;s.a=2935648;p.a=149873033;a.a=320818982;cache=1314820144;qpb=1;?h=https://att.demdex.net/event?d_event=imp...
  • https://att.demdex.net/event?d_event=imp&d_src=127123&d_placement=149873033&d_campaign=11235374&d_site=2935648&d_cb=1314820144
Request 241
  • http://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=70df82eb-b8d1-4e97-b70c-10d3446fdea5
  • http://match.taboola.com/sg/thetradedesk-network/1/rtb-h?taboola_hm=70df82eb-b8d1-4e97-b70c-10d3446fdea5&tbid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09
Request 242
  • http://tags.bluekai.com/site/35702?dt=0&r=287950946&sig=2551099617&bkca=KJy+iLWvy09xHndslQ0SBR688aJYGwuzLfig+o/WyjgdfhTv1XmqRUvR+xWz/aCJz5euJODAl+cv8sZ6skVvG8c+GQRyKEU5SQ08p3J4VSNuNp0VzFim0L7n2XtOh...
  • http://trc.taboola.com/sg/bluekai/1/cm?taboola_hm=dn%2FwiWyA99ed7poj
Request 243
  • http://d.agkn.com/pixel/8463/?che=1496978569&sk=163850202351000158163&puid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09&l0=http://trc.taboola.com/sg/neustar/1/cm?taboola_hm=163850202351000158163
  • http://trc.taboola.com/sg/neustar/1/cm?taboola_hm=163850202351000158163
Request 307
  • http://pixel.everesttech.net/4083/gr?ev_gb=0&url=http%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__EFOPTOUT__%26throttleCookie...
  • http://www.everestjs.net/static/pixel_details.html
Request 310
  • http://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=http%3A//www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/&rp=&ts=compact&rnd=1496...
  • http://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=http%3A//www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/&rp=&ts=compact&rnd=1496...
Request 318
  • http://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEP16djRA38Ah5gQcWAHRVPY&google_cver=1
  • http://pixel.everesttech.net/1x1
Request 321
  • http://www.google.com/ads/user-lists/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1773981433&cdct=2&is_vtc=1&random=38932789&fpvtc=/1036174608/%3Flab...
  • http://www.google.de/ads/user-lists/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1773981433&cdct=2&is_vtc=1&random=38932789&fpvtc=/1036174608/%3Flabe...

322 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Cookie set /
www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
117 KB
26 KB
Document
General
Full URL
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
f8cbde9598cb80b5fa29512ed9b1247c410cfb378d99195ad28ac089bffc61ca

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.zdnet.com
Accept-Language
en-US,en;q=0.8
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Cache-Control
no-cache
Connection
keep-alive
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:46 GMT
Content-Encoding
gzip
Last-Modified
Fri, 09 Jun 2017 03:22:45 GMT
Server
nginx
Connection
keep-alive
Vary
Accept-Encoding
X-Tx-Id
acdae94f-d2be-4b74-9c21-93b66cad4710
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=28800, private
Set-Cookie
fly_geo={"countryCode": "de"}; expires=Fri, 16-Jun-2017 03:22:46 GMT; path=/; domain=.zdnet.com fly_default_edition=eu; expires=Fri, 16-Jun-2017 03:22:46 GMT; path=/; domain=.zdnet.com fly_device=desktop; expires=Fri, 16-Jun-2017 03:22:46 GMT; path=/; domain=.zdnet.com ak_bmsc=D847596FDE7F1DA8E5BED09D02CED00E48F7B204AE48000086143A59543DF46F~plOCH8ln5qywrfqLKbXdYIwVxSTBhZMDAoQD04BMWkRVjDg8UNpebmtX+v9TYDY1oEDaIHjlGOe+pKYgqKzaWZM8fLSggYHWAPhqgI5DelV5xxkO+4KifM9ThlXmRMcCvOOiE9a1EyioqmaVS7tKIGiwRxIgvAX5CYRhWj8SxZCQU7esEXHfOcELiIehrr8XxnOyPYF3rSLVIza5pkne4QnTkJJsUjl7z6kHisFLxMqxw=; expires=Fri, 09 Jun 2017 05:22:46 GMT; max-age=7200; path=/; domain=.zdnet.com; HttpOnly bm_mi=B6AD4036A5556108520CF4ABAFF8A102~XIT/mGH5U4U1uotE4zVV0dpIPbQh+5a7SlqwB7+IHQUIi1lgrkfn+UYy9iY5fmHN7dnjTzImRxyQqkhU+L9XFZVVYXCKHGRbcxrEe2ApgnIWTFJtb0jGEFLfcM/s1EKMcL/9eFodb0RrS/5aMbIhg/5I8yi82v30IQeQWj2XVk1eni0Cr4rUpkhXBMYxtSWszzKzYg1seSw0JFNyqadMG6+PM2yfcONiTUASjfh6WP/1Fd2njc5gdpmxEBrhzBs8hNzelllTFIMPiN+I4vxlvYHp2x+JsVkB1MtyZb0v5ROFmNLKDzPCHLgZ8vc8shTdES5LcXPg3n4CHgIoPVp+xw==; Domain=.zdnet.com; Path=/; Max-Age=7200; HttpOnly
Accept-Ranges
bytes
Content-Length
26910
X-Akamai-Transformed
h - 0 pmb=mTOE,2
Expires
Fri, 09 Jun 2017 11:22:45 GMT
main-88cf334629-rev.css
zdnet1.cbsistatic.com/fly/css/core/
375 KB
67 KB
Stylesheet
General
Full URL
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
12b21dc2a6ecc24566c1087756966f341cff296b8758bcdda4efd2d3c908a0a7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet1.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:46 GMT
Content-Encoding
gzip
Last-Modified
Thu, 08 Jun 2017 17:03:59 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=604800
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
68122
Expires
Fri, 16 Jun 2017 03:22:46 GMT
boomr.js
zdnet4.cbsistatic.com/fly/bundles/zdnetcore/js/
1 KB
566 B
Script
General
Full URL
http://zdnet4.cbsistatic.com/fly/bundles/zdnetcore/js/boomr.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
c11f9bc2f99850a7f24363f80193d1669a9008989e2b81151daa707aa53e78ee

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet4.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:46 GMT
Content-Encoding
gzip
Last-Modified
Wed, 25 Jan 2017 16:26:29 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
application/x-javascript
Connection
keep-alive
Content-Length
566
mpulse-1.0.2.js
zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/
12 KB
5 KB
Script
General
Full URL
http://zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/mpulse-1.0.2.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
773b777ab91359b0edbf42357f200c6f2dbd496b625e534a0ebc0f07a67654e2

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet4.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:46 GMT
Content-Encoding
gzip
Last-Modified
Thu, 09 Mar 2017 15:27:21 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
application/x-javascript
Connection
keep-alive
Content-Length
4902
ls-zdnet.js
js.indexww.com/ht/
66 KB
18 KB
Script
General
Full URL
http://js.indexww.com/ht/ls-zdnet.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
95.100.248.163 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-100-248-163.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
ba166cb05072de6f5f37fef26f2a477924a429e54076a6be382929a3add66cc3

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
js.indexww.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Fri, 09 Jun 2017 03:22:26 GMT
Server
Apache
ETag
"da1572-10750-5517e7a7f8e4a"
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/javascript
Content-Length
18380
Expires
Fri, 09 Jun 2017 04:22:47 GMT
Cookie set 61e19a54
www.zdnet.com/akam/10/
30 KB
10 KB
Script
General
Full URL
http://www.zdnet.com/akam/10/61e19a54
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
/
Resource Hash
4d7ef2d59fa6de55fd64c182a866be72d9a14a1c187dc063e493a6e6009b2e75

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.zdnet.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
fly_geo={"countryCode": "de"}; fly_default_edition=eu; fly_device=desktop; ak_bmsc=D847596FDE7F1DA8E5BED09D02CED00E48F7B204AE48000086143A59543DF46F~plOCH8ln5qywrfqLKbXdYIwVxSTBhZMDAoQD04BMWkRVjDg8UNpebmtX+v9TYDY1oEDaIHjlGOe+pKYgqKzaWZM8fLSggYHWAPhqgI5DelV5xxkO+4KifM9ThlXmRMcCvOOiE9a1EyioqmaVS7tKIGiwRxIgvAX5CYRhWj8SxZCQU7esEXHfOcELiIehrr8XxnOyPYF3rSLVIza5pkne4QnTkJJsUjl7z6kHisFLxMqxw=; bm_mi=B6AD4036A5556108520CF4ABAFF8A102~XIT/mGH5U4U1uotE4zVV0dpIPbQh+5a7SlqwB7+IHQUIi1lgrkfn+UYy9iY5fmHN7dnjTzImRxyQqkhU+L9XFZVVYXCKHGRbcxrEe2ApgnIWTFJtb0jGEFLfcM/s1EKMcL/9eFodb0RrS/5aMbIhg/5I8yi82v30IQeQWj2XVk1eni0Cr4rUpkhXBMYxtSWszzKzYg1seSw0JFNyqadMG6+PM2yfcONiTUASjfh6WP/1Fd2njc5gdpmxEBrhzBs8hNzelllTFIMPiN+I4vxlvYHp2x+JsVkB1MtyZb0v5ROFmNLKDzPCHLgZ8vc8shTdES5LcXPg3n4CHgIoPVp+xw==
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Tue, 25 Apr 2017 00:43:45 GMT
ETag
"98830bea002971ed35787da7ea4222a0a751899b5271d0a183ccdab32fa49aa4"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
Set-Cookie
fly_default_edition=eu; expires=Fri, 16-Jun-2017 03:22:47 GMT; path=/; domain=.zdnet.com bm_mi=B6AD4036A5556108520CF4ABAFF8A102~XIT/mGH5U4U1uotE4zVV0dpIPbQh+5a7SlqwB7+IHQUIi1lgrkfn+UYy9iY5fmHNiITGg/lBYNFDBZOTxItf+ftgiqRRF7AdgfL4r920am8JLY8lDAj77ZV3IKGnTPKedza8wlHvlGFvAeofhRLLvOhGg5rR3u0vAeYmtzM81O7IX/ZS5/q1AGJh8Ot3H0bUcSQ0eIA1Kgvp51CcTZu+AyYNtwOSDAE2/E/4DQXxb/drm72WXAANnGBHOsGoQsgrLYji/I4P1Neg7ZNmANQ2V+Lh7XAjkGymsred/G/YvrbNYRDtYGODDxzhUEAUp+X+xt9yNGGfgv2HXeet4SlAS0XVqYW5Dj69jkr5ahfrq4Tr+wr7zXKlUeVGLBPddsNS; Domain=.zdnet.com; Path=/; Max-Age=7200; HttpOnly
Content-Length
9896
violet-blue.jpg
zdnet3.cbsistatic.com/hub/i/r/2014/07/22/3d2a7fa6-1175-11e4-9732-00505685119a/thumbnail/40x40/0c171c8cf13e7541c923dbf7bd8a328a/
829 B
829 B
Image
General
Full URL
http://zdnet3.cbsistatic.com/hub/i/r/2014/07/22/3d2a7fa6-1175-11e4-9732-00505685119a/thumbnail/40x40/0c171c8cf13e7541c923dbf7bd8a328a/violet-blue.jpg
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
b1c9c19ebc4698c418de6590bbbc794483312b24630b5c7c73fe03156518f359

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet3.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Last-Modified
Sun, 18 Dec 2016 18:17:44 GMT
Server
nginx
Content-Type
image/jpeg
Access-Control-Allow-Origin
http://origin.img.hub.zdnet.com
Cache-Control
max-age=5184000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
829
Expires
Tue, 08 Aug 2017 03:22:47 GMT
washington-post-guardian-links-used-to-infect-the-mask-malware-victims.jpg
zdnet3.cbsistatic.com/hub/i/r/2014/02/10/1e22bb55-1d17-11e4-8c7f-00505685119a/resize/170xauto/ae9e226d6bac4682203022e5d76cea03/
7 KB
7 KB
Image
General
Full URL
http://zdnet3.cbsistatic.com/hub/i/r/2014/02/10/1e22bb55-1d17-11e4-8c7f-00505685119a/resize/170xauto/ae9e226d6bac4682203022e5d76cea03/washington-post-guardian-links-used-to-infect-the-mask-malware-victims.jpg
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
126916b85594f83b0b2219434f7d9101ddd3b7627937f76a9741a5512d507355

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet3.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Fri, 20 Nov 2015 22:24:38 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
image/jpeg
Access-Control-Allow-Origin
http://origin.img.hub.zdnet.com
Cache-Control
max-age=5184000
Connection
keep-alive
Content-Length
7130
Expires
Tue, 08 Aug 2017 03:22:47 GMT
thumb.jpg
zdnet1.cbsistatic.com/hub/i/r/2017/06/08/e1133161-9b3c-4fed-b4ab-f47f56186034/thumbnail/170x128/e689b72197f17dc73fa25238ef1e0f87/
7 KB
7 KB
Image
General
Full URL
http://zdnet1.cbsistatic.com/hub/i/r/2017/06/08/e1133161-9b3c-4fed-b4ab-f47f56186034/thumbnail/170x128/e689b72197f17dc73fa25238ef1e0f87/thumb.jpg
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
8c16c186d7b03c922a03744d16e8f83794c0aafe6a0f3483d679987a95e3c1cc

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet1.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:46 GMT
Content-Encoding
gzip
Last-Modified
Thu, 08 Jun 2017 20:43:03 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
image/jpeg
Access-Control-Allow-Origin
http://origin.img.hub.zdnet.com
Cache-Control
max-age=5184000
Connection
keep-alive
Content-Length
6870
Expires
Tue, 08 Aug 2017 03:22:46 GMT
digital-grenade.jpg
zdnet2.cbsistatic.com/hub/i/r/2017/05/13/8eae65e5-7e16-4ede-b49f-8585dcc43c55/thumbnail/170x128/8a5d2dd29e751f8d14b2bb0372582be3/
9 KB
9 KB
Image
General
Full URL
http://zdnet2.cbsistatic.com/hub/i/r/2017/05/13/8eae65e5-7e16-4ede-b49f-8585dcc43c55/thumbnail/170x128/8a5d2dd29e751f8d14b2bb0372582be3/digital-grenade.jpg
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.24 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-24.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
aa3a5670b0b5ce2799bc93fb728027cdbb8fff7abd8b848bcd9ccd9d8d030e31

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet2.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:46 GMT
Content-Encoding
gzip
Last-Modified
Thu, 08 Jun 2017 16:56:55 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
image/jpeg
Access-Control-Allow-Origin
http://origin.img.hub.zdnet.com
Cache-Control
max-age=5184000
Connection
keep-alive
Content-Length
9143
Expires
Tue, 08 Aug 2017 03:22:46 GMT
comey.jpg
zdnet1.cbsistatic.com/hub/i/r/2017/06/08/9b20ee6b-f133-4ac6-a8c9-61402f3721e2/thumbnail/170x128/2c265e9ded77a39687ab0033f19e005b/
3 KB
3 KB
Image
General
Full URL
http://zdnet1.cbsistatic.com/hub/i/r/2017/06/08/9b20ee6b-f133-4ac6-a8c9-61402f3721e2/thumbnail/170x128/2c265e9ded77a39687ab0033f19e005b/comey.jpg
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.24 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-24.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
b2af0307bd7dc07e1f8f44bbcb4203df50d4565434025066f8fa2f1e236a4728

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet1.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:46 GMT
Content-Encoding
gzip
Last-Modified
Thu, 08 Jun 2017 16:34:12 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
image/jpeg
Access-Control-Allow-Origin
http://origin.img.hub.zdnet.com
Cache-Control
max-age=5184000
Connection
keep-alive
Content-Length
3196
Expires
Tue, 08 Aug 2017 03:22:46 GMT
msbuyshexadite.jpg
zdnet1.cbsistatic.com/hub/i/r/2017/06/08/cc227cc7-673d-40a9-8f10-05eaa9c64009/thumbnail/170x128/9c1f437c3593e41ff8afd4db1684975b/
3 KB
3 KB
Image
General
Full URL
http://zdnet1.cbsistatic.com/hub/i/r/2017/06/08/cc227cc7-673d-40a9-8f10-05eaa9c64009/thumbnail/170x128/9c1f437c3593e41ff8afd4db1684975b/msbuyshexadite.jpg
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.24 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-24.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
e526d264e12ef01dd5e2f286373430ee9f9399ed4a7a99ee9d1606fd672bb9d3

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet1.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:46 GMT
Content-Encoding
gzip
Last-Modified
Thu, 08 Jun 2017 14:26:58 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
image/jpeg
Access-Control-Allow-Origin
http://origin.img.hub.zdnet.com
Cache-Control
max-age=5184000
Connection
keep-alive
Content-Length
3075
Expires
Tue, 08 Aug 2017 03:22:46 GMT
require-2.1.2.js
zdnet2.cbsistatic.com/fly/js/libs/
16 KB
6 KB
Script
General
Full URL
http://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.24 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-24.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
c1a5beacf0910d974ee3033e8303aef0403890b511cb5f0cb880c418285351f4

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet2.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:46 GMT
Content-Encoding
gzip
Last-Modified
Mon, 13 Feb 2017 17:39:18 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=604800
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
6316
Expires
Fri, 16 Jun 2017 03:22:46 GMT
sfp.js
native.sharethrough.com/assets/
260 KB
70 KB
Script
General
Full URL
http://native.sharethrough.com/assets/sfp.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
54.192.37.97 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-192-37-97.jfk1.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b340026b1782dbaa451f7d0b25fcc8c7ed10075c88dde36af54f870e6ae03028

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
native.sharethrough.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 21:59:57 GMT
Content-Encoding
gzip
Last-Modified
Thu, 08 Jun 2017 21:53:33 GMT
Server
AmazonS3
Age
1297
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Via
1.1 8bbf72e941cf5b676089162d6282d373.cloudfront.net (CloudFront)
Cache-Control
public, max-age=3600
Transfer-Encoding
chunked
Connection
keep-alive
X-Amz-Cf-Id
QOUjvmq_87n6KDw_FO1Fh2vhsfklRDampZHib90r3v9Jb3MLvBrRIQ==
Expires
Thu, 08 Jun 2017 22:53:32 GMT
netseerads.js
ps.ns-cdn.com/dsatserving2/scripts/
8 KB
3 KB
Script
General
Full URL
http://ps.ns-cdn.com/dsatserving2/scripts/netseerads.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
52.84.32.101 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-84-32-101.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
117415b3c7ca40c605848ccbe4c73ebd211d005eed28c2d0bd58fcba0a58ceec

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
ps.ns-cdn.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Wed, 07 Jun 2017 22:51:01 GMT
Content-Encoding
gzip
Last-Modified
Wed, 07 Jun 2017 22:50:25 GMT
Server
AmazonS3
Age
5506
ETag
"a334fc7b8661c1b1c22f569e5e7c71bb"
X-Cache
Hit from cloudfront
Content-Type
application/x-javascript
Via
1.1 261e801dca9c54ff576f39f96d80ede5.cloudfront.net (CloudFront)
Cache-Control
max-age=10800
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3102
X-Amz-Cf-Id
0mSOcNGqlwJWs0tAcBjUGusc69uxZO3WNWfWdqgb-9kakRdgyAGXmQ==
YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
c.go-mpulse.net/boomerang/ Frame 603.
129 KB
38 KB
Script
General
Full URL
http://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Requested by
Host: zdnet4.cbsistatic.com
URL: http://zdnet4.cbsistatic.com/fly/bundles/zdnetcore/js/boomr.js
Protocol
HTTP/1.1
Server
104.108.48.32 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-108-48-32.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
eb25e2373947c4e5fa5f594e711fea0c9e601dd0f16eeb7df9511875df6a4c31

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
c.go-mpulse.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:46 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/javascript;charset=UTF-8
Cache-Control
max-age=14400, s-maxage=604800
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
38554
Expires
Fri, 09 Jun 2017 07:22:46 GMT
Raleway-Bold.woff
zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
31 KB
31 KB
Font
General
Full URL
http://zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Bold.woff
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.24 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-24.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
a882ed0de2cbc72018357222851d2cdfb8e55ab2e71164d5fef176f67fb51e44

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
zdnet1.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
Origin
http://www.zdnet.com

Response headers

Date
Fri, 09 Jun 2017 03:22:46 GMT
Last-Modified
Thu, 12 Jan 2017 17:14:18 GMT
Server
nginx
Content-Type
application/octet-stream
Access-Control-Allow-Origin
*
Cache-Control
max-age=19242555
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
31928
Expires
Wed, 17 Jan 2018 20:32:01 GMT
header-divider.png
zdnet4.cbsistatic.com/fly/1496941226-fly/bundles/zdnetcss/images/core/
946 B
946 B
Image
General
Full URL
http://zdnet4.cbsistatic.com/fly/1496941226-fly/bundles/zdnetcss/images/core/header-divider.png
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
bce96ac7a2ef110da2515407d716cd3ac640f5de8ce3ede325aef0ceac5dbadb

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet4.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:46 GMT
Last-Modified
Thu, 08 Jun 2017 17:00:26 GMT
Server
nginx
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
946
Expires
Fri, 16 Jun 2017 03:22:46 GMT
logo.png
zdnet2.cbsistatic.com/fly/1496941227-fly/bundles/zdnetcss/images/core/
4 KB
4 KB
Image
General
Full URL
http://zdnet2.cbsistatic.com/fly/1496941227-fly/bundles/zdnetcss/images/core/logo.png
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.24 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-24.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet2.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:46 GMT
Content-Encoding
gzip
Last-Modified
Thu, 08 Jun 2017 17:00:27 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
4128
Expires
Fri, 16 Jun 2017 03:22:46 GMT
Raleway-Regular.woff
zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
31 KB
31 KB
Font
General
Full URL
http://zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Regular.woff
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.24 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-24.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
b5c9194053ff64cbd9797b72f1b5f7766a01489df826fa6ad382169dcc0045f5

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
zdnet1.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
Origin
http://www.zdnet.com

Response headers

Date
Fri, 09 Jun 2017 03:22:46 GMT
Last-Modified
Thu, 12 Jan 2017 17:14:18 GMT
Server
nginx
Content-Type
application/octet-stream
Access-Control-Allow-Origin
*
Cache-Control
max-age=19242575
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
31840
Expires
Wed, 17 Jan 2018 20:32:21 GMT
Raleway-Light.woff
zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
31 KB
31 KB
Font
General
Full URL
http://zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Light.woff
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.24 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-24.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
122d78976bfc083338ea0bbbee7ede31726a809f7f90752ed08b5f883c0628ce

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
zdnet1.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
Origin
http://www.zdnet.com

Response headers

Date
Fri, 09 Jun 2017 03:22:46 GMT
Last-Modified
Thu, 27 Apr 2017 20:27:30 GMT
Server
nginx
Content-Type
application/octet-stream
Access-Control-Allow-Origin
*
Cache-Control
max-age=28046356
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
31720
Expires
Sun, 29 Apr 2018 18:02:02 GMT
Raleway-Black.woff
zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
31 KB
31 KB
Font
General
Full URL
http://zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Black.woff
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
1fd9cb1187942e358453708b06ce4c6ece34a1ce3a1d80bd316c34d56e661742

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
zdnet1.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
Origin
http://www.zdnet.com

Response headers

Date
Fri, 09 Jun 2017 03:22:46 GMT
Last-Modified
Thu, 12 Jan 2017 17:14:18 GMT
Server
nginx
Content-Type
application/octet-stream
Access-Control-Allow-Origin
*
Cache-Control
max-age=19242604
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
31648
Expires
Wed, 17 Jan 2018 20:32:50 GMT
comment.png
zdnet2.cbsistatic.com/fly/1496941227-fly/bundles/zdnetcss/images/livefyre/
1 KB
1 KB
Image
General
Full URL
http://zdnet2.cbsistatic.com/fly/1496941227-fly/bundles/zdnetcss/images/livefyre/comment.png
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.24 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-24.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
a9b5bcb47ad59808d2028d544476ba365f8ed4d6fffdce2fcd0a3afd58bcaf34

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet2.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:46 GMT
Content-Encoding
gzip
Last-Modified
Thu, 08 Jun 2017 17:00:27 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
1086
Expires
Fri, 16 Jun 2017 03:22:46 GMT
mag-white01.png
zdnet4.cbsistatic.com/fly/1496941227-fly/bundles/zdnetcss/images/core/
1 KB
936 B
Image
General
Full URL
http://zdnet4.cbsistatic.com/fly/1496941227-fly/bundles/zdnetcss/images/core/mag-white01.png
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet4.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:46 GMT
Content-Encoding
gzip
Last-Modified
Thu, 08 Jun 2017 17:00:27 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
936
Expires
Fri, 16 Jun 2017 03:22:46 GMT
config.js
c.go-mpulse.net/boomerang/ Frame 603.
1 KB
653 B
Script
General
Full URL
http://c.go-mpulse.net/boomerang/config.js?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=4989929&v=1.413.1477614597&if=&sl=0&si=vaknptlsxq-NaN&plugins=ConfigOverride,PageParams,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,LOGN
Requested by
Host: c.go-mpulse.net
URL: http://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol
HTTP/1.1
Server
104.108.48.32 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-108-48-32.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
1a388f6470b57a4aea303bf37f2e14b5f09d828200cf7ebc371bf46647263f3f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
c.go-mpulse.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
653
config.json
c.go-mpulse.net/api/v2/
1 KB
1 KB
XHR
General
Full URL
http://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1496978566999&s=87baf099dce83e7d0496c951fbc3fcb2e34e772f07904dd18a27fc8fb800a7b0
Requested by
Host: zdnet4.cbsistatic.com
URL: http://zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Server
104.108.48.32 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-108-48-32.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
800fa2ade5da03a8b63e6b2a08d3e1cd9c0a823a666a28a24de721916390e53f

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
c.go-mpulse.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com

Response headers

Access-Control-Allow-Origin
http://www.zdnet.com
Date
Fri, 09 Jun 2017 03:22:47 GMT
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
1413
Content-Type
application/json; charset=utf-8
main.default.js
zdnet3.cbsistatic.com/fly/883-fly/js/
220 KB
74 KB
Script
General
Full URL
http://zdnet3.cbsistatic.com/fly/883-fly/js/main.default.js
Requested by
Host: zdnet2.cbsistatic.com
URL: http://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
786f05e6f9e7a1c0879925b1c4b8ac90d9d9cab67c8bc43a1ffafd5544dbe1af

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet3.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 08 Jun 2017 17:04:02 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=604800
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
75936
Expires
Fri, 16 Jun 2017 03:22:47 GMT
render.js
ps.ns-cdn.com/dsatserving2/scripts/
19 KB
6 KB
Script
General
Full URL
http://ps.ns-cdn.com/dsatserving2/scripts/render.js
Requested by
Host: ps.ns-cdn.com
URL: http://ps.ns-cdn.com/dsatserving2/scripts/netseerads.js
Protocol
HTTP/1.1
Server
52.84.32.101 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-84-32-101.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
fb342f0e0aed2577171981df7c1b90297ca156a0884373c291cddb269172038c

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
ps.ns-cdn.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Wed, 07 Jun 2017 22:51:01 GMT
Content-Encoding
gzip
Last-Modified
Wed, 07 Jun 2017 22:50:37 GMT
Server
AmazonS3
Age
5507
ETag
"7d2810f4b607ec9e9938f3a3d05804a5"
X-Cache
Hit from cloudfront
Content-Type
application/x-javascript
Via
1.1 261e801dca9c54ff576f39f96d80ede5.cloudfront.net (CloudFront)
Cache-Control
max-age=10800
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6538
X-Amz-Cf-Id
nqZMB4lX-HcUJzbWuvcYb0-R2m2xMR1X-ediaER69EMXRcuu76ujDA==
truncated
/
8 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dac04bcfa7f177ab3bfda32f23244821815941a32bdbca8e04604967c76ef1f2

Request headers

Response headers

truncated
/
157 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
80d54533f80e8233621f965ae0a7713928bdb4d491ed0eb5e90434550f1894cb

Request headers

Response headers

utag.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
87 KB
17 KB
Script
General
Full URL
http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Requested by
Host: zdnet2.cbsistatic.com
URL: http://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
HTTP/1.1
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (oxr/839E) /
Resource Hash
f2253a35b3e82ef10635d6124df03f988146eed49c7f0266911d6b61d9d95d85

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
tags.tiqcdn.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 25 May 2017 21:22:06 GMT
Server
ECS (oxr/839E)
Etag
"3088976011"
Vary
Accept-Encoding
X-Cache
HIT
Content-Type
text/javascript
Cache-Control
max-age=300
Accept-Ranges
bytes
Content-Length
17473
Expires
Fri, 09 Jun 2017 03:27:47 GMT
urs.js
cn.cbsimg.net/cnwk.1d/Aud/javascript/
50 KB
18 KB
Script
General
Full URL
http://cn.cbsimg.net/cnwk.1d/Aud/javascript/urs.js
Requested by
Host: zdnet2.cbsistatic.com
URL: http://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
HTTP/1.0
Server
95.100.248.154 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-100-248-154.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cn.cbsimg.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Tue, 08 Nov 2016 20:15:07 GMT
Server
Apache
ETag
"c7f5"
Vary
Accept-Encoding
P3P
CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
18231
gpt.js
www.googletagservices.com/tag/js/
3 KB
1 KB
Script
General
Full URL
http://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: zdnet2.cbsistatic.com
URL: http://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
HTTP/1.1
Server
2a00:1450:4001:824::2002 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
b2d4f345ea445291da59ae9025de142ceaaecc64c21fdd203cb4078349db2471
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.googletagservices.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:09:04 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 08 Jun 2017 17:51:05 GMT
Server
sffe
Age
823
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
private, max-age=900, stale-while-revalidate=3600
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
1360
X-XSS-Protection
1; mode=block
Expires
Fri, 09 Jun 2017 03:09:04 GMT
pubads_impl_121.js
securepubads.g.doubleclick.net/gpt/
185 KB
64 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Requested by
Host: www.googletagservices.com
URL: http://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
sffe /
Resource Hash
ac4f9618be0b43e3a85ccb1b5ae9b9c5efbe4d1ac30bcd5db7b624a767024481
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/gpt/pubads_impl_121.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Tue, 06 Jun 2017 15:29:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
215597
status
200
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
65897
x-xss-protection
1; mode=block
last-modified
Tue, 06 Jun 2017 14:12:08 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 06 Jun 2018 15:29:30 GMT
scrolling-mpu-88db309ec5-rev.js
zdnet3.cbsistatic.com/fly/js/components/
1023 B
1023 B
Script
General
Full URL
http://zdnet3.cbsistatic.com/fly/js/components/scrolling-mpu-88db309ec5-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: http://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
346405485b8eb5393d72c6d004c888cbdddc4bd264274a91f6dc4d2c670798fc

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet3.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Last-Modified
Mon, 28 Nov 2016 16:28:52 GMT
Server
nginx
Content-Type
application/x-javascript
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
1023
Expires
Fri, 16 Jun 2017 03:22:47 GMT
waypoints-08d1a93302-rev.js
zdnet1.cbsistatic.com/fly/js/managers/
298 B
298 B
Script
General
Full URL
http://zdnet1.cbsistatic.com/fly/js/managers/waypoints-08d1a93302-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: http://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
HTTP/1.1
Server
72.247.178.24 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-24.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
ebc89aefb3d617c497756eac9dfebaf0311d3a4767be126d1c9f9c8be19fad66

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet1.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Last-Modified
Mon, 20 Feb 2017 15:55:50 GMT
Server
nginx
Content-Type
application/x-javascript
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
298
Expires
Fri, 16 Jun 2017 03:22:47 GMT
jquery.waypoints.js
zdnet4.cbsistatic.com/fly/js/libs/jquery/
9 KB
3 KB
Script
General
Full URL
http://zdnet4.cbsistatic.com/fly/js/libs/jquery/jquery.waypoints.js
Requested by
Host: zdnet2.cbsistatic.com
URL: http://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
5707c0c20a0c6e4e510904c4229eca894570a439467f7562a0694dfbd9b28c5f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet4.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Feb 2017 19:44:53 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=604800
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
2744
Expires
Fri, 16 Jun 2017 03:22:47 GMT
waypoints.sticky.js
zdnet4.cbsistatic.com/fly/js/libs/jquery/
1 KB
604 B
Script
General
Full URL
http://zdnet4.cbsistatic.com/fly/js/libs/jquery/waypoints.sticky.js
Requested by
Host: zdnet2.cbsistatic.com
URL: http://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
deee21acc86b40fe0cb13584d9b68a15a21f471fcd0523822aa1f5b58b603604

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet4.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Feb 2017 19:44:55 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=604800
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
604
Expires
Fri, 16 Jun 2017 03:22:47 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-8/html/
3 KB
2 KB
Other
General
Full URL
http://tpc.googlesyndication.com/safeframe/1-0-8/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
96d3bf038966f99afc2c91b78a83c887caf0456db1e58ed2c7be2504dde9e810
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Purpose
prefetch
Accept-Encoding
gzip, deflate, sdch
Host
tpc.googlesyndication.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Purpose
prefetch
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Wed, 07 Jun 2017 20:15:48 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Tue, 18 Apr 2017 21:46:52 GMT
Server
sffe
Age
112019
Vary
Accept-Encoding
Content-Type
text/html
Cache-Control
public, immutable, max-age=31536000
Accept-Ranges
bytes
Content-Length
1747
X-XSS-Protection
1; mode=block
Expires
Thu, 07 Jun 2018 20:15:48 GMT
isInternalUser.js
iicbsi-a.akamaihd.net/common/js/esi/
28 B
28 B
Script
General
Full URL
https://iicbsi-a.akamaihd.net/common/js/esi/isInternalUser.js?cb=cbsiInternal
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:64::210:6b08 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
3c599ef176cecdb3de25c6c36bc2945b92c12bcbc2ab03350729f4de296b53b8

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
iicbsi-a.akamaihd.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Cache-Control
max-age=53526
Server
Apache
Connection
keep-alive
ETag
"fb25287978f1b619e801f164a2dfd9ea:1473886414"
Content-Length
28
Content-Type
application/x-javascript
Cookie set vglnk.js
cdn.viglink.com/api/
77 KB
27 KB
Script
General
Full URL
http://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Server
2400:cb00:2048:1::6810:a00d , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software
cloudflare-nginx /
Resource Hash
8d132c2ec29a828cc58c2060046cfcfc4c4312ebb2570973221ad8a4fadf7490

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.viglink.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
x-amz-request-id
86EFEB3A821C4CF6
Connection
keep-alive
Content-Length
27392
x-amz-id-2
xYY6QdRqzgoNuPvJGAn4uVTJXceYX8zhq/2y5onTQwVinE1gG7GgQ09rvUHXbYLD3SfF4+FLzpk=
Last-Modified
Tue, 09 May 2017 17:46:08 GMT
Server
cloudflare-nginx
ETag
"0c7f630eb71f657108a7590a6e47e1bd"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
public, max-age=60
Set-Cookie
__cfduid=d2391243a4caa1f8d7c537eb00a3d24be1496978567; expires=Sat, 09-Jun-18 03:22:47 GMT; path=/; domain=.viglink.com; HttpOnly
Accept-Ranges
bytes
CF-RAY
36c0f7eda2b76493-FRA
Expires
Fri, 09 Jun 2017 03:23:47 GMT
utag.1783.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1783.js?utv=201704052043
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/9F8B) /
Resource Hash
4d049d83eef469c1f2cc0f5df820144ff6c5eb896b4e4aa2e681a1cba7d622a9

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
tags.tiqcdn.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Wed, 15 Mar 2017 15:25:15 GMT
Server
ECS (fcn/9F8B)
Etag
"1364231194"
Vary
Accept-Encoding
X-Cache
HIT
Content-Type
text/javascript
Cache-Control
max-age=1296000
Accept-Ranges
bytes
Content-Length
1130
Expires
Sat, 24 Jun 2017 03:22:47 GMT
utag.1479.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
965 B
602 B
Script
General
Full URL
http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1479.js?utv=201511192223
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/41A5) /
Resource Hash
4d1d55134769d5168118292383c17ca1e4cfdea886bd484f2fe4c47a551fb9d0

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
tags.tiqcdn.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Mon, 11 Jul 2016 20:43:57 GMT
Server
ECS (fcn/41A5)
Etag
"2137191049+gzip"
Vary
Accept-Encoding
X-Cache
HIT
Content-Type
text/javascript
Cache-Control
max-age=1296000
Accept-Ranges
bytes
Content-Length
602
Expires
Sat, 24 Jun 2017 03:22:47 GMT
utag.1779.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
3 KB
2 KB
Script
General
Full URL
http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1779.js?utv=201705011846
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/9F8F) /
Resource Hash
cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
tags.tiqcdn.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Mon, 11 Jul 2016 20:43:57 GMT
Server
ECS (fcn/9F8F)
Etag
"4282255839"
Vary
Accept-Encoding
X-Cache
HIT
Content-Type
text/javascript
Cache-Control
max-age=1296000
Accept-Ranges
bytes
Content-Length
1785
Expires
Sat, 24 Jun 2017 03:22:47 GMT
utag.1782.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=201703151525
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/41CC) /
Resource Hash
255edb1f0d3fb5a7d930c19a27388967ec3141a3fce88d7507b336a8ae27ba97

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
tags.tiqcdn.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Wed, 15 Mar 2017 15:25:15 GMT
Server
ECS (fcn/41CC)
Etag
"1442449131"
Vary
Accept-Encoding
X-Cache
HIT
Content-Type
text/javascript
Cache-Control
max-age=1296000
Accept-Ranges
bytes
Content-Length
1058
Expires
Sat, 24 Jun 2017 03:22:47 GMT
utag.1787.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
121 KB
42 KB
Script
General
Full URL
http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=201703281836
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/4197) /
Resource Hash
d5781eec877972949ec6b00e57e5da597e6cdb39e227584cadf0ffe349585356

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
tags.tiqcdn.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Tue, 28 Mar 2017 18:35:58 GMT
Server
ECS (fcn/4197)
Etag
"1136627128"
Vary
Accept-Encoding
X-Cache
HIT
Content-Type
text/javascript
Cache-Control
max-age=1296000
Accept-Ranges
bytes
Content-Length
43093
Expires
Sat, 24 Jun 2017 03:22:47 GMT
utag.1790.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
872 B
Script
General
Full URL
http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1790.js?utv=201608011431
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/9FA3) /
Resource Hash
10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
tags.tiqcdn.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Mon, 01 Aug 2016 14:31:10 GMT
Server
ECS (fcn/9FA3)
Etag
"161779343"
Vary
Accept-Encoding
X-Cache
HIT
Content-Type
text/javascript
Cache-Control
max-age=1296000
Accept-Ranges
bytes
Content-Length
872
Expires
Sat, 24 Jun 2017 03:22:47 GMT
utag.1791.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1791.js?utv=201608011431
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/404D) /
Resource Hash
7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
tags.tiqcdn.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Mon, 01 Aug 2016 14:31:10 GMT
Server
ECS (fcn/404D)
Etag
"1229231683"
Vary
Accept-Encoding
X-Cache
HIT
Content-Type
text/javascript
Cache-Control
max-age=1296000
Accept-Ranges
bytes
Content-Length
1196
Expires
Sat, 24 Jun 2017 03:22:47 GMT
utag.1792.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
4 KB
2 KB
Script
General
Full URL
http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1792.js?utv=201607282020
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/419B) /
Resource Hash
dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
tags.tiqcdn.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 28 Jul 2016 14:28:47 GMT
Server
ECS (fcn/419B)
Etag
"4159703848"
Vary
Accept-Encoding
X-Cache
HIT
Content-Type
text/javascript
Cache-Control
max-age=1296000
Accept-Ranges
bytes
Content-Length
1664
Expires
Sat, 24 Jun 2017 03:22:47 GMT
utag.1797.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
883 B
Script
General
Full URL
http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=201701252008
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/9FA6) /
Resource Hash
3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
tags.tiqcdn.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Wed, 25 Jan 2017 20:07:58 GMT
Server
ECS (fcn/9FA6)
Etag
"1924601413"
Vary
Accept-Encoding
X-Cache
HIT
Content-Type
text/javascript
Cache-Control
max-age=1296000
Accept-Ranges
bytes
Content-Length
883
Expires
Sat, 24 Jun 2017 03:22:47 GMT
article-85bc14e79f-rev.js
zdnet4.cbsistatic.com/fly/js/pages/
124 KB
34 KB
Script
General
Full URL
http://zdnet4.cbsistatic.com/fly/js/pages/article-85bc14e79f-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: http://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
771e516f92e03baf7b791224a638d51116f9238ffc88c6ee331a14c9c420dde0

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet4.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 27 Apr 2017 20:31:06 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=604800
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
34528
Expires
Fri, 16 Jun 2017 03:22:47 GMT
measure.min.js
asset.pagefair.com/
11 KB
5 KB
Script
General
Full URL
http://asset.pagefair.com/measure.min.js?_=1496978567335
Requested by
Host: zdnet3.cbsistatic.com
URL: http://zdnet3.cbsistatic.com/fly/883-fly/js/main.default.js
Protocol
HTTP/1.1
Server
23.111.9.30 Phoenix, United States, ASN54104 (AS-NETDNA - netDNA, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
100770ceb57c9e10d5283206c1ae0b2b9653a0433021f48e9808751d3900c384

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
asset.pagefair.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Fri, 14 Apr 2017 09:32:51 GMT
Server
NetDNA-cache/2.2
x-amz-request-id
5CA7D7B330483258
ETag
"a0622f0694c6162047ec528b9a8b0704"
X-Cache
MISS
Content-Type
application/x-javascript
Cache-Control
max-age=7200
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4825
x-amz-id-2
rQD1MSx9UpGFLYwDVLomnOh+SZGnWDYYNbfK9B+GtT6wZXB8aEUBU9nhVV63DXvjmZlVjUrDV0Q=
ads.min.js
asset.pagefair.net/
0
0
Script
General
Full URL
http://asset.pagefair.net/ads.min.js?_=1496978567336
Requested by
Host: zdnet3.cbsistatic.com
URL: http://zdnet3.cbsistatic.com/fly/883-fly/js/main.default.js
Protocol
HTTP/1.1
Server
23.111.11.222 Phoenix, United States, ASN54104 (AS-NETDNA - netDNA, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
asset.pagefair.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Fri, 14 Apr 2017 09:32:52 GMT
Server
NetDNA-cache/2.2
x-amz-request-id
9F0452C1EB6BF8AE
ETag
"8d6bcedcf571298a6e15eac1b15a542a"
X-Cache
MISS
Content-Type
application/x-javascript
Cache-Control
max-age=7200
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
31
x-amz-id-2
suVPA4C1jIfmpq5dxCiQc4RxU1Lzcv/j68Fb5bBZszXikIaI9d0B12ZLbC497fcrMnGuaGayioE=
pixel.gif
cdn.viglink.com/images/
43 B
43 B
Image
General
Full URL
http://cdn.viglink.com/images/pixel.gif?ch=1&rn=0.5586726240742472
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
2400:cb00:2048:1::6810:a00d , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software
cloudflare-nginx /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.viglink.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
__cfduid=d2391243a4caa1f8d7c537eb00a3d24be1496978567
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
CF-Cache-Status
HIT
Last-Modified
Tue, 10 Feb 2015 03:29:39 GMT
Server
cloudflare-nginx
x-amz-request-id
A1C34C1DD7B82119
ETag
"221d8352905f2c38b3cb2bd191d630b0"
Vary
Accept-Encoding
Content-Type
image/gif
Cache-Control
max-age=15, must-revalidate
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
36c0f7edf2c36493-FRA
Content-Length
43
x-amz-id-2
wufWluWF4XAUux0r0eDgfRq2RWj48DVhcOKoZ20e2xyHhAf0zekEo8Sbeg57ncnZeK/EkDA0RO0=
pixel.gif
cdn.viglink.com/images/
43 B
43 B
Image
General
Full URL
http://cdn.viglink.com/images/pixel.gif?ch=2&rn=0.5586726240742472
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
2400:cb00:2048:1::6810:a40d , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software
cloudflare-nginx /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.viglink.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
__cfduid=d2391243a4caa1f8d7c537eb00a3d24be1496978567
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
CF-Cache-Status
HIT
Last-Modified
Tue, 10 Feb 2015 03:29:39 GMT
Server
cloudflare-nginx
x-amz-request-id
A1C34C1DD7B82119
ETag
"221d8352905f2c38b3cb2bd191d630b0"
Vary
Accept-Encoding
Content-Type
image/gif
Cache-Control
max-age=15, must-revalidate
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
36c0f7edf4292738-FRA
Content-Length
43
x-amz-id-2
wufWluWF4XAUux0r0eDgfRq2RWj48DVhcOKoZ20e2xyHhAf0zekEo8Sbeg57ncnZeK/EkDA0RO0=
5a999966-75a6-4b89-a92c-23702f4d9c94.js
cdn.clicktale.net/www09/ptc/
11 KB
4 KB
Script
General
Full URL
http://cdn.clicktale.net/www09/ptc/5a999966-75a6-4b89-a92c-23702f4d9c94.js
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1479.js?utv=201511192223
Protocol
HTTP/1.1
Server
2a02:26f0:78:18d::2db0 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
6fd0b292bad1e3f33e13b2c33f116238a25a036fb1a400efd5269d4c88e32289

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.clicktale.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=300
Connection
keep-alive
Content-Length
3611
Expires
Fri, 09 Jun 2017 03:27:47 GMT
Cookie set lightbox.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 603.
321 B
285 B
Script
General
Full URL
http://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1496978567361&lv=1
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
2400:cb00:2048:1::6810:4b27 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software
cloudflare-nginx /
Resource Hash
fa2569ee4980a341ef321fc5493e71b201ebcf80ba0bacb61cb4a455ae04dd99

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.lightboxcdn.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Content-MD5
vqT+wp4dQTstgwFUIIbLbA==
Transfer-Encoding
chunked
Connection
keep-alive
x-ms-lease-status
unlocked
Last-Modified
Thu, 04 May 2017 00:21:28 GMT
Server
cloudflare-nginx
Vary
Accept-Encoding
Content-Type
application/javascript
x-ms-request-id
199b4577-0001-0037-7b6d-cf243d000000
x-ms-version
2009-09-19
Set-Cookie
__cfduid=daecafd19e2aff09d90cb2c4cdeda90f71496978567; expires=Sat, 09-Jun-18 03:22:47 GMT; path=/; domain=.lightboxcdn.com; HttpOnly
CF-RAY
36c0f7ee16dc6349-FRA
ds.js
dw.cbsimg.net/js/cbsi/
18 KB
6 KB
Script
General
Full URL
http://dw.cbsimg.net/js/cbsi/ds.js
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1790.js?utv=201608011431
Protocol
HTTP/1.1
Server
95.101.246.112 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-246-112.deploy.akamaitechnologies.com
Software
Apache/2.4.25 /
Resource Hash
fe383d8e359f77ce8208b106e16c72148ce5694a0116003d70769562f0b63a15

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dw.cbsimg.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Tue, 04 Oct 2016 23:22:56 GMT
Server
Apache/2.4.25
ETag
"1911-53e1257261400"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=43200, s-maxage=1800
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6417
Expires
Fri, 09 Jun 2017 15:22:47 GMT
Cookie set tag.aspx
ml314.com/
23 KB
11 KB
Script
General
Full URL
http://ml314.com/tag.aspx?952017
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=201703151525
Protocol
HTTP/1.1
Server
34.249.129.150 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-249-129-150.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
2ccd728594ce65fa7e6651109e3bbd61877e548c4dab5480cafa6965f358a4e0

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
ml314.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:45 GMT
Content-Encoding
gzip
Last-Modified
Thu, 08 Jun 2017 05:13:16 GMT
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Set-Cookie
AWSELB=C7FF65F30CC113EEFA706B66F27E091147E9236E170C15403A3BA5537B317AD14EF76318455CF89006EE1CEE8CB52CE4D051151B49DEEA58E108F3282DEE2188E889DEA620;PATH=/;MAX-AGE=3600
Cache-Control
public, max-age=63632581996 no-cache="set-cookie"
Connection
keep-alive
Content-Length
11039
Expires
Fri, 09 Jun 2017 05:13:16 GMT
Cookie set cbsinteractive.js
tru.am/scripts/custom/
2 KB
902 B
Script
General
Full URL
http://tru.am/scripts/custom/cbsinteractive.js
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=201701252008
Protocol
HTTP/1.1
Server
2400:cb00:2048:1::6819:a222 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software
cloudflare-nginx /
Resource Hash
442f24793a0a9be8127fdb8b38a1c3b6b2b2aa856e805e0d8649c894a1e63334

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
tru.am
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Last-Modified
Wed, 15 Mar 2017 22:08:38 GMT
Server
cloudflare-nginx
ETag
"45c91fab7b6897c91fa98f2982d39b4a"
Vary
Accept-Encoding
Content-Type
text/javascript
Set-Cookie
__cfduid=dda662d51cbe5fde3c99582ac4384a11e1496978567; expires=Sat, 09-Jun-18 03:22:47 GMT; path=/; domain=.tru.am; HttpOnly
Cache-Control
public, max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
36c0f7ee152d0f69-FRA
Expires
Fri, 09 Jun 2017 07:22:47 GMT
st.v3.js
www.everestjs.net/static/
16 KB
16 KB
Script
General
Full URL
https://www.everestjs.net/static/st.v3.js
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1792.js?utv=201607282020
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.245.232 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-245-232.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
fe2f1dc40370624a89e41b7bfccbc86f35045eb658322c1009f94ea71409f353

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
www.everestjs.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Last-Modified
Fri, 11 Nov 2016 06:33:16 GMT
Server
Apache
ETag
"14701a8-405e-54100aa4c9cdc"
Content-Type
text/javascript
Cache-Control
max-age=56473
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
16478
Expires
Fri, 09 Jun 2017 19:04:00 GMT
commentcount.js
cdn.livefyre.com/libs/commentcount/v1.0/
9 KB
3 KB
Script
General
Full URL
http://cdn.livefyre.com/libs/commentcount/v1.0/commentcount.js
Requested by
Host: zdnet2.cbsistatic.com
URL: http://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
HTTP/1.1
Server
52.84.28.208 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-84-28-208.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
019a6fe5052688eca2cc5395598e6aaf0f43e972026f3232bc3ec4a0e1abe54e

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.livefyre.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Sun, 14 May 2017 03:22:11 GMT
Content-Encoding
gzip
Last-Modified
Thu, 27 Apr 2017 22:13:21 GMT
Server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:1001/gname:deployment/uname:deployment/gid:1001/mode:33188/mtime:1493331186/atime:1493331200/ctime:1493331186
Age
2246437
ETag
"2a3a4c21fd31270aa47b71534b8cf5c7"
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Via
1.1 591e4cd98bc438a13e141b991f9397b3.cloudfront.net (CloudFront)
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3287
X-Amz-Cf-Id
rgc8UsuGDUcylQoWhETQtg4LnVRJJeQFKhxXWPI2qkoZUTWBY6B3HA==
Livefyre.js
cdn.livefyre.com/
1004 B
548 B
Script
General
Full URL
http://cdn.livefyre.com/Livefyre.js
Requested by
Host: zdnet2.cbsistatic.com
URL: http://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
HTTP/1.1
Server
52.84.28.208 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-84-28-208.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c6b0d5270d518be3e51ce481af9aa04b812d825ae0a400333a0b4c181390e75d

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.livefyre.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Sat, 03 Jun 2017 02:33:49 GMT
Content-Encoding
gzip
Last-Modified
Thu, 01 Jun 2017 23:50:26 GMT
Server
AmazonS3
Age
2939
ETag
"f55d7c6dd4a1419eca4e6feb2517c1eb"
X-Cache
Hit from cloudfront
Content-Type
application/javascript; charset=utf-8
Via
1.1 49ccc390fa499ab821b632cf67d38720.cloudfront.net (CloudFront)
Cache-Control
max-age=3600, no-transform, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
548
X-Amz-Cf-Id
3mR6zBeY0xwxCjeH1X3uC0Ck2qCjzdkGWXv1BvAatEVE7LYrDhTu2w==
Cookie set cygnus
as.casalemedia.com/
1 KB
857 B
XHR
General
Full URL
http://as.casalemedia.com/cygnus?v=7&fn=headertag_parse&s=182823&r=%7B%22id%22%3A18287580%2C%22site%22%3A%7B%22page%22%3A%22http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F%22%2C%22ref%22%3A%22%22%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%221%22%2C%20%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%20%7B%22sid%22%3A%22201%22%2C%22siteID%22%3A182823%7D%7D%2C%7B%22id%22%3A%222%22%2C%20%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%20%7B%22sid%22%3A%22219%22%2C%22siteID%22%3A183315%7D%7D%2C%7B%22id%22%3A%223%22%2C%20%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%20%7B%22sid%22%3A%22208%22%2C%22siteID%22%3A182824%7D%7D%2C%7B%22id%22%3A%224%22%2C%20%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%20%7B%22sid%22%3A%22222%22%2C%22siteID%22%3A182825%7D%7D%2C%7B%22id%22%3A%225%22%2C%20%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%20%7B%22sid%22%3A%22210%22%2C%22siteID%22%3A182826%7D%7D%2C%7B%22id%22%3A%226%22%2C%20%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%20%7B%22sid%22%3A%22209%22%2C%22siteID%22%3A182828%7D%7D%2C%7B%22id%22%3A%227%22%2C%20%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%20%7B%22sid%22%3A%22202%22%2C%22siteID%22%3A182829%7D%7D%2C%7B%22id%22%3A%228%22%2C%20%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%20%7B%22sid%22%3A%22220%22%2C%22siteID%22%3A183316%7D%7D%5D%7D
Requested by
Host: js.indexww.com
URL: http://js.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Server
95.100.248.168 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-100-248-168.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
5a1318561f33ce1e72266caa414ce25c39463998160451ca1ecaf9571b79e636

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
as.casalemedia.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8
Accept
*/*
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Connection
keep-alive
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin
http://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Set-Cookie
CMID=WToUh7lQJ8QAAHh2kcoAAAAk;domain=casalemedia.com;path=/;expires=Sat, 09 Jun 2018 03:22:47 GMT CMPS=1137;domain=casalemedia.com;path=/;expires=Thu, 07 Sep 2017 03:22:47 GMT CMST=WToUh1k6FIcB;domain=casalemedia.com;path=/;expires=Sat, 10 Jun 2017 03:22:47 GMT CMSC=WToUhw**;domain=casalemedia.com;path=/; CMDD=AALBpQE*;domain=casalemedia.com;path=/;expires=Sat, 10 Jun 2017 03:22:47 GMT
Content-Type
text/javascript
Content-Length
857
Expires
Fri, 09 Jun 2017 03:22:47 GMT
Cookie set id
dpm.demdex.net/
2 KB
719 B
Script
General
Full URL
http://dpm.demdex.net/id?d_visid_ver=1.5.6&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&d_cb=s_c_il%5B2%5D._setMarketingCloudFields
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=201703281836
Protocol
HTTP/1.1
Server
54.154.158.135 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-154-158-135.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
61c4d6be40fe3111339268ac5ced5b247564944794b318489488848f0cf945b2

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dpm.demdex.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

DCS
irl1-prod-dcs-bbbb787b.edge-irl1.demdex.com 5.11.1.20170606140807 3ms
Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
X-TID
fS4GimWcSkA=
Vary
Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Set-Cookie
demdex=81798148289666930272139155021439591401;Path=/;Domain=.demdex.net;Expires=Wed, 06-Dec-2017 03:22:47 GMT
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
application/javascript; charset=UTF-8
Content-Length
719
Expires
Thu, 01 Jan 2009 00:00:00 GMT
Cookie set anonc.js
dw.cbsi.com/
73 B
73 B
Script
General
Full URL
http://dw.cbsi.com/anonc.js
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=201703281836
Protocol
HTTP/1.1
Server
216.239.120.246 San Francisco, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
7d3f595b53702d39fd426f8dc498b559dcf5c854774ea55ff2307a81b0ec2a26

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dw.cbsi.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Server
Apache/2.4.25
Etag
exrvK1k6FIftgT1Rt4g.1.dw_anonc
P3P
CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"
Set-Cookie
XCLGFbrowser=exrvK1k6FIftgT1Rt4g; expires=Wed, 09-Jun-2027 03:22:47 GMT; domain=.cbsi.com; path=/
Cache-control
private, max-age=43200, s-max-age=0
Connection
Keep-Alive
Content-Type
application/javascript
Keep-Alive
timeout=5, max=28
Content-Length
73
Expires
Mon, 05 Jan 1970 12:12:12 GMT
user.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 603.
770 KB
136 KB
Script
General
Full URL
http://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=636294540878687886
Requested by
Host: www.lightboxcdn.com
URL: http://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1496978567361&lv=1
Protocol
HTTP/1.1
Server
2400:cb00:2048:1::6810:4b27 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software
cloudflare-nginx /
Resource Hash
f9905feecaa5edb2374765f678339d7f1dd5b38220756f2797f4f9fe6b3fa0f0

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.lightboxcdn.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
__cfduid=daecafd19e2aff09d90cb2c4cdeda90f71496978567
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Content-MD5
/epURF3WXReBSM16foSdpw==
Transfer-Encoding
chunked
Connection
keep-alive
x-ms-lease-status
unlocked
Last-Modified
Thu, 04 May 2017 00:21:29 GMT
Server
cloudflare-nginx
Vary
Accept-Encoding
Content-Type
application/javascript
x-ms-request-id
b084f09b-0001-002e-656d-cf0855000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
CF-RAY
36c0f7eea6ef6349-FRA
Expires
Sat, 09 Jun 2018 03:22:47 GMT
ta-pagesocial-sdk.js
tru.am/scripts/
28 KB
11 KB
Script
General
Full URL
http://tru.am/scripts/ta-pagesocial-sdk.js
Requested by
Host: tru.am
URL: http://tru.am/scripts/custom/cbsinteractive.js
Protocol
HTTP/1.1
Server
2400:cb00:2048:1::6819:a222 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software
cloudflare-nginx /
Resource Hash
85a45358aad2071d1964c65da9afd84c51828674480e6b27033a7bdae7ed89d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
tru.am
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
__cfduid=dda662d51cbe5fde3c99582ac4384a11e1496978567
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Last-Modified
Thu, 08 Dec 2016 21:05:21 GMT
Server
cloudflare-nginx
ETag
"74a258227367266cc4a6a1ca5d750889"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
public, max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
36c0f7eeb5450f69-FRA
Expires
Fri, 09 Jun 2017 07:22:47 GMT
optimizely-414394b3fc-rev.js
zdnet2.cbsistatic.com/fly/js/managers/
56 B
56 B
Script
General
Full URL
http://zdnet2.cbsistatic.com/fly/js/managers/optimizely-414394b3fc-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: http://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
HTTP/1.1
Server
72.247.178.24 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-24.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
374a55cc3bf0627f248a371049442af63aeb64047aa8b557c3ef0786facec0c1

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet2.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Last-Modified
Mon, 13 Feb 2017 17:39:23 GMT
Server
nginx
Content-Type
application/x-javascript
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
56
Expires
Fri, 16 Jun 2017 03:22:47 GMT
Cookie set jpt
secure.adnxs.com/
74 B
74 B
XHR
General
Full URL
http://secure.adnxs.com/jpt?id=9732476&size=728x90&referrer=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&callback=pbjs.recordApnxDemand&callback_uid=_1&psa=0
Requested by
Host: js.indexww.com
URL: http://js.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Server
185.33.223.209 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
Software
nginx/1.11.5 /
Resource Hash
57dd94f0d9fbed3b1e0437e4af6f807a1e57f06a200cd1755ad767c787b6652f
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
secure.adnxs.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8
Accept
*/*
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
X-Proxy-Origin
148.251.45.170; 148.251.45.170; 314.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.232:80
AN-X-Request-Uuid
e29f45ad-9794-42b9-8567-fe2be80683dc
Server
nginx/1.11.5
Connection
keep-alive
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
http://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Set-Cookie
anj=dTM7k!M4/8DYRWSF']wIg2C'!i^8kz!]tbPB*SQLOsH`E.g3VsOnaQF; Path=/; Max-Age=7776000; Expires=Thu, 07-Sep-2017 03:22:49 GMT; Domain=.adnxs.com; HttpOnly icu=ChII84w0EAoYASABKAEwianoyQUQianoyQUYAA..; Path=/; Max-Age=7776000; Expires=Thu, 07-Sep-2017 03:22:49 GMT; Domain=.adnxs.com; HttpOnly sess=1; Path=/; Max-Age=86400; Expires=Sat, 10-Jun-2017 03:22:49 GMT; Domain=.adnxs.com; HttpOnly uuid2=5146995273050302651; Path=/; Max-Age=7776000; Expires=Thu, 07-Sep-2017 03:22:49 GMT; Domain=.adnxs.com; HttpOnly
Content-Type
application/javascript; charset=utf-8
Content-Length
74
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Cookie set jpt
secure.adnxs.com/
74 B
74 B
XHR
General
Full URL
http://secure.adnxs.com/jpt?id=9732476&size=300x250&referrer=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&callback=pbjs.recordApnxDemand&callback_uid=_2&psa=0
Requested by
Host: js.indexww.com
URL: http://js.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Server
185.33.223.209 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
Software
nginx/1.11.5 /
Resource Hash
f293ac1569326623ef7bca32e8bd83b11ccf473a4f9f128d6a7eae2c4632f2c2
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
secure.adnxs.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8
Accept
*/*
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
X-Proxy-Origin
148.251.45.170; 148.251.45.170; 314.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.240:80
AN-X-Request-Uuid
f0265125-6b39-4221-9543-d1d43189cf3b
Server
nginx/1.11.5
Connection
keep-alive
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
http://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Set-Cookie
anj=dTM7k!M4/8DYRWSF']wIg2C'!i^8kz!]tbPB*SQLOsH`E.g3VsOnaQF; Path=/; Max-Age=7776000; Expires=Thu, 07-Sep-2017 03:22:49 GMT; Domain=.adnxs.com; HttpOnly icu=ChII84w0EAoYASABKAEwianoyQUQianoyQUYAA..; Path=/; Max-Age=7776000; Expires=Thu, 07-Sep-2017 03:22:49 GMT; Domain=.adnxs.com; HttpOnly sess=1; Path=/; Max-Age=86400; Expires=Sat, 10-Jun-2017 03:22:49 GMT; Domain=.adnxs.com; HttpOnly uuid2=7855931964978448993; Path=/; Max-Age=7776000; Expires=Thu, 07-Sep-2017 03:22:49 GMT; Domain=.adnxs.com; HttpOnly
Content-Type
application/javascript; charset=utf-8
Content-Length
74
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Cookie set jpt
secure.adnxs.com/
74 B
74 B
XHR
General
Full URL
http://secure.adnxs.com/jpt?id=9732476&size=300x250&referrer=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&callback=pbjs.recordApnxDemand&callback_uid=_3&psa=0
Requested by
Host: js.indexww.com
URL: http://js.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Server
185.33.223.206 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
Software
nginx/1.11.10 /
Resource Hash
f0e45c803d6191aed0f5c110e06994de455b59fc49b47fcf503a5fc37789f3e6
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
secure.adnxs.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8
Accept
*/*
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
X-Proxy-Origin
148.251.45.170; 148.251.45.170; 301.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.144:80
AN-X-Request-Uuid
8f681e8f-c258-4e72-81b0-edb9623f4b53
Server
nginx/1.11.10
Connection
keep-alive
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
http://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Set-Cookie
anj=dTM7k!M4/8DYRWSF']wIg2C'!i^8kz!]tbPB*SQLOsH`E.g3VsOnaQF; Path=/; Max-Age=7776000; Expires=Thu, 07-Sep-2017 03:22:49 GMT; Domain=.adnxs.com; HttpOnly icu=ChII84w0EAoYASABKAEwianoyQUQianoyQUYAA..; Path=/; Max-Age=7776000; Expires=Thu, 07-Sep-2017 03:22:49 GMT; Domain=.adnxs.com; HttpOnly sess=1; Path=/; Max-Age=86400; Expires=Sat, 10-Jun-2017 03:22:49 GMT; Domain=.adnxs.com; HttpOnly uuid2=130007134848082827; Path=/; Max-Age=7776000; Expires=Thu, 07-Sep-2017 03:22:49 GMT; Domain=.adnxs.com; HttpOnly
Content-Type
application/javascript; charset=utf-8
Content-Length
74
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Cookie set jpt
secure.adnxs.com/
74 B
74 B
XHR
General
Full URL
http://secure.adnxs.com/jpt?id=9732476&size=300x250&referrer=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&callback=pbjs.recordApnxDemand&callback_uid=_4&psa=0
Requested by
Host: js.indexww.com
URL: http://js.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Server
185.33.223.206 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
Software
nginx/1.11.10 /
Resource Hash
01d932e46452da81f2eecc596f48fe168d2501f59727e2d7077c94d782523a56
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
secure.adnxs.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8
Accept
*/*
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
X-Proxy-Origin
148.251.45.170; 148.251.45.170; 301.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.145:80
AN-X-Request-Uuid
d822e2b4-12b1-4f45-a95c-1295a399dcc3
Server
nginx/1.11.10
Connection
keep-alive
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
http://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Set-Cookie
anj=dTM7k!M4/8DYRWSF']wIg2C'!i^8kz!]tbPB*SQLOsH`E.g3VsOnaQF; Path=/; Max-Age=7776000; Expires=Thu, 07-Sep-2017 03:22:49 GMT; Domain=.adnxs.com; HttpOnly icu=ChII84w0EAoYASABKAEwianoyQUQianoyQUYAA..; Path=/; Max-Age=7776000; Expires=Thu, 07-Sep-2017 03:22:49 GMT; Domain=.adnxs.com; HttpOnly sess=1; Path=/; Max-Age=86400; Expires=Sat, 10-Jun-2017 03:22:49 GMT; Domain=.adnxs.com; HttpOnly uuid2=5594024194703696418; Path=/; Max-Age=7776000; Expires=Thu, 07-Sep-2017 03:22:49 GMT; Domain=.adnxs.com; HttpOnly
Content-Type
application/javascript; charset=utf-8
Content-Length
74
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Cookie set jpt
secure.adnxs.com/
74 B
74 B
XHR
General
Full URL
http://secure.adnxs.com/jpt?id=9732476&size=728x90&referrer=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&callback=pbjs.recordApnxDemand&callback_uid=_5&psa=0
Requested by
Host: js.indexww.com
URL: http://js.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Server
185.33.223.206 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
Software
nginx/1.11.10 /
Resource Hash
d050d8de22dbdfe67594caa8dc7dfcd69ea8fe36d8c62a337f19ecaecd9f3c2a
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
secure.adnxs.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8
Accept
*/*
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
X-Proxy-Origin
148.251.45.170; 148.251.45.170; 301.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.134:80
AN-X-Request-Uuid
afd03003-0fb7-4aa2-882f-8fd8b4e2d896
Server
nginx/1.11.10
Connection
keep-alive
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
http://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Set-Cookie
anj=dTM7k!M4/8DYRWSF']wIg2C'!i^8kz!]tbPB*SQLOsH`E.g3VsOnaQF; Path=/; Max-Age=7776000; Expires=Thu, 07-Sep-2017 03:22:49 GMT; Domain=.adnxs.com; HttpOnly icu=ChII84w0EAoYASABKAEwianoyQUQianoyQUYAA..; Path=/; Max-Age=7776000; Expires=Thu, 07-Sep-2017 03:22:49 GMT; Domain=.adnxs.com; HttpOnly sess=1; Path=/; Max-Age=86400; Expires=Sat, 10-Jun-2017 03:22:49 GMT; Domain=.adnxs.com; HttpOnly uuid2=2412272586286122582; Path=/; Max-Age=7776000; Expires=Thu, 07-Sep-2017 03:22:49 GMT; Domain=.adnxs.com; HttpOnly
Content-Type
application/javascript; charset=utf-8
Content-Length
74
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Cookie set /
www.zdnet.com/components/breaking-news/xhr/
690 B
321 B
XHR
General
Full URL
http://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner
Requested by
Host: zdnet3.cbsistatic.com
URL: http://zdnet3.cbsistatic.com/fly/883-fly/js/main.default.js
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
a37420641266de82fdaca370cedb70d4681e439f5c0e62ba43daf23e36ebabc3

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.zdnet.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
application/json, text/javascript, */*; q=0.01
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
X-Requested-With
XMLHttpRequest
Cookie
fly_geo={"countryCode": "de"}; fly_device=desktop; ak_bmsc=D847596FDE7F1DA8E5BED09D02CED00E48F7B204AE48000086143A59543DF46F~plOCH8ln5qywrfqLKbXdYIwVxSTBhZMDAoQD04BMWkRVjDg8UNpebmtX+v9TYDY1oEDaIHjlGOe+pKYgqKzaWZM8fLSggYHWAPhqgI5DelV5xxkO+4KifM9ThlXmRMcCvOOiE9a1EyioqmaVS7tKIGiwRxIgvAX5CYRhWj8SxZCQU7esEXHfOcELiIehrr8XxnOyPYF3rSLVIza5pkne4QnTkJJsUjl7z6kHisFLxMqxw=; fly_default_edition=eu; bm_mi=B6AD4036A5556108520CF4ABAFF8A102~XIT/mGH5U4U1uotE4zVV0dpIPbQh+5a7SlqwB7+IHQUIi1lgrkfn+UYy9iY5fmHNiITGg/lBYNFDBZOTxItf+ftgiqRRF7AdgfL4r920am8JLY8lDAj77ZV3IKGnTPKedza8wlHvlGFvAeofhRLLvOhGg5rR3u0vAeYmtzM81O7IX/ZS5/q1AGJh8Ot3H0bUcSQ0eIA1Kgvp51CcTZu+AyYNtwOSDAE2/E/4DQXxb/drm72WXAANnGBHOsGoQsgrLYji/I4P1Neg7ZNmANQ2V+Lh7XAjkGymsred/G/YvrbNYRDtYGODDxzhUEAUp+X+xt9yNGGfgv2HXeet4SlAS0XVqYW5Dj69jkr5ahfrq4Tr+wr7zXKlUeVGLBPddsNS; utag_main=v_id:015c8ae0307e000b0f9380ce6a6705069006406100b08$_sn:1$_ss:1$_pn:1%3Bexp-session$_st:1496980367294$ses_id:1496978567294%3Bexp-session$linktag:undefined%3Bexp-session; zdnet_ad=%7B%22type%22%3A%22gpt%22%2C%22region%22%3A%22aw%22%2C%22session%22%3A%22a%22%2C%22subSession%22%3A%223%22%7D; first_page_today=false; AMCV_10D31225525FF5790A490D4D%40AdobeOrg=T; LDCLGFbrowser=f5a1f307-3cf9-48ce-ab44-a17282f6bdf8
Connection
keep-alive
Cache-Control
no-cache
Accept
application/json, text/javascript, */*; q=0.01
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Fri, 09 Jun 2017 02:10:00 GMT
Server
nginx
Connection
keep-alive
Vary
Accept-Encoding
X-Tx-Id
529eff1a-7aa9-46e2-8fd0-8028abb7c6c0
Content-Type
application/json
Cache-Control
max-age=5400, private
Set-Cookie
fly_default_edition=eu; expires=Fri, 16-Jun-2017 03:22:47 GMT; path=/; domain=.zdnet.com bm_sv=2B1B2EA5077D8F97ABAF2D2F99F81818~x2/QV5JcNQ1/5PYlSDaA5E85xPS6ajclSZqd8XaMwg9rQr7LFhPrSn1Ttt2yu/zK8fL/Vb2ZbAtMFHy+v1R/ccrhbQZSV+QEwULUaHMGseThR9i8FTvqKUN72NKoaX3D9YwttRRZfQUy9q7plnrdx/vLuBWWUXUJS+5D0+fQFo8=; Domain=.zdnet.com; Path=/; Max-Age=7200; HttpOnly
Accept-Ranges
bytes
Content-Length
321
Expires
Fri, 09 Jun 2017 03:40:00 GMT
the-maskapt.jpg
zdnet4.cbsistatic.com/hub/i/2014/10/04/7068430f-4be9-11e4-b6a0-d4ae52e95e57/4c549ce567ae0ad63103800b8c7ab0c9/
1002 KB
1003 KB
Image
General
Full URL
http://zdnet4.cbsistatic.com/hub/i/2014/10/04/7068430f-4be9-11e4-b6a0-d4ae52e95e57/4c549ce567ae0ad63103800b8c7ab0c9/the-maskapt.jpg
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
776cd5b2e2140b2a5dd6f2d5a1ace401d389a8fc996b5de828b2b1a56ebc3de4

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet4.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Oct 2014 05:43:35 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
image/jpeg
Access-Control-Allow-Origin
http://origin.img.hub.zdnet.com
Cache-Control
max-age=5184000
Transfer-Encoding
chunked
Connection
keep-alive Transfer-Encoding
Expires
Tue, 08 Aug 2017 03:22:47 GMT
BannerServer
cl.netseer.com/dsatserving2/servlet/ Frame 603.
0
0

Cookie set match
cmi.netseer.com/
Redirect Chain
  • http://cm.g.doubleclick.net/pixel?google_nid=netseer1&google_cm=&google_sc=&google_hm=dXNyM2ZlZDgzMTdlM2Y2ZmZkMw%3D%3D&google_tc=
  • http://cmi.netseer.com/match?ex=10&google_gid=CAESENfx3sPJWvZZA3YlujEiNCU&google_cver=1
42 B
42 B
Image
General
Full URL
http://cmi.netseer.com/match?ex=10&google_gid=CAESENfx3sPJWvZZA3YlujEiNCU&google_cver=1
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
52.206.49.191 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-206-49-191.compute-1.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cmi.netseer.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
netseer_v3_vi=H4sIAAAAAAAAADOyKi0uMk5LTbEwNjRPNU4zS0tLMbYyNLE0szS3MDUzNzMz0TE0s3KNCHEN8nP0QZIxtzAHAGj-fAw9AAAA
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Set-Cookie
netseer_v3_vi=H4sIAAAAAAAAADOyKi0uMk5LTbEwNjRPNU4zS0tLMbYyNLE0szS3MDUzNzMz0TE0sHJ2dA129UurMC4O8Aovi4pyNI7MKc1yzfRzDkVSbGlioGNoZuUaEeIa5OfogyRjbmEOAPKNYxtqAAAA; Domain=.netseer.com; Expires=Tue, 08-Aug-2017 03:22:47 GMT; Path=/
Date
Fri, 09 Jun 2017 03:22:47 GMT
Server
Apache-Coyote/1.1
Connection
keep-alive
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Length
42
Content-Type
image/gif

Redirect headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:47 GMT
Server
HTTP server (unknown)
P3P
policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Location
http://cmi.netseer.com/match?ex=10&google_gid=CAESENfx3sPJWvZZA3YlujEiNCU&google_cver=1
Cache-Control
no-cache, must-revalidate
Set-Cookie
id=229d400ddb3e00f2||t=1496978567|et=730|cs=002213fd4879f78427fa004ba7; expires=Sun, 09-Jun-2019 03:22:47 GMT; path=/; domain=.doubleclick.net test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT IDE=AHWqTUmrXzdPSRjH827E0j67M3SfTqbVbP0GtvpiHxysKnQdkC44bsZxiA; expires=Sun, 09-Jun-2019 03:22:47 GMT; path=/; domain=.doubleclick.net; HttpOnly
Content-Type
text/html; charset=UTF-8
Content-Length
292
X-XSS-Protection
1; mode=block
Expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/
Redirect Chain
  • http://us-u.openx.net/w/1.0/sd?id=537073006&val=usr3fed8317e3f6ffd3
  • http://us-u.openx.net/w/1.0/sd?cc=1&id=537073006&val=usr3fed8317e3f6ffd3
43 B
43 B
Image
General
Full URL
http://us-u.openx.net/w/1.0/sd?cc=1&id=537073006&val=usr3fed8317e3f6ffd3
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
173.241.240.143 New York, United States, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US),
Reverse DNS
ox-173-241-240-143.xa.dc.openx.org
Software
OXGW/11.82.3 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
us-u.openx.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
i=279c3da1-6b86-4b47-81ee-1c10f316d2a1|1496978567
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:47 GMT
Server
OXGW/11.82.3
Vary
Accept
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, max-age=0, no-cache
Content-Type
image/gif
Content-Length
43
Expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location
http://us-u.openx.net/w/1.0/sd?cc=1&id=537073006&val=usr3fed8317e3f6ffd3
Date
Fri, 09 Jun 2017 03:22:47 GMT
Server
OXGW/11.82.3
Set-Cookie
i=279c3da1-6b86-4b47-81ee-1c10f316d2a1|1496978567; Version=1; Expires=Sat, 09-Jun-2018 03:22:47 GMT; Max-Age=31536000; Domain=.openx.net; Path=/
Content-Length
0
P3P
CP="CUR ADM OUR NOR STA NID"
Cookie set match
cmi.netseer.com/
Redirect Chain
  • http://ads.yahoo.com/cms/v1?esig=1~da31edb5d54623b380c5f13de554040184d2c151&nwid=10000651871&sigv=1
  • http://cmi.netseer.com/match?ex=16&xid=WdycZS7boI5uJ6osqbQBfvVg
42 B
42 B
Image
General
Full URL
http://cmi.netseer.com/match?ex=16&xid=WdycZS7boI5uJ6osqbQBfvVg
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
52.206.49.191 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-206-49-191.compute-1.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cmi.netseer.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
netseer_v3_vi=H4sIAAAAAAAAADOyKi0uMk5LTbEwNjRPNU4zS0tLMbYyNLE0szS3MDUzNzMz0TE0s3KNCHEN8nP0QZIxtzAHAGj-fAw9AAAA
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Set-Cookie
netseer_v3_vi=H4sIAAAAAAAAADOyKi0uMk5LTbEwNjRPNU4zS0tLMbYyNLE0szS3MDUzNzMz0TE0swpPqUyOCjZPyvc0LfUyyy8uTAp0SisLS0dSaWlpAgBHKPUoTQAAAA; Domain=.netseer.com; Expires=Tue, 08-Aug-2017 03:22:47 GMT; Path=/
Date
Fri, 09 Jun 2017 03:22:47 GMT
Server
Apache-Coyote/1.1
Connection
keep-alive
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Length
42
Content-Type
image/gif

Redirect headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Server
ATS
Age
0
P3P
policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Location
http://cmi.netseer.com/match?ex=16&xid=WdycZS7boI5uJ6osqbQBfvVg
Set-Cookie
B=0fgpvsdcjk547&b=3&s=8d; expires=Sat, 09-Jun-2018 03:22:47 GMT; path=/; domain=.yahoo.com
Cache-Control
private
Connection
keep-alive
Content-Type
text/plain; charset=utf-8
Content-Length
0
Cookie set /
www.zdnet.com/newsletter/xhr/widget-login/
2 KB
570 B
XHR
General
Full URL
http://www.zdnet.com/newsletter/xhr/widget-login/?topic=security
Requested by
Host: zdnet3.cbsistatic.com
URL: http://zdnet3.cbsistatic.com/fly/883-fly/js/main.default.js
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
15e3aaa814ef983144a212a909fda1e258b8e220784c4f5ef5656f5eab1ca55f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.zdnet.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
application/json, text/javascript, */*; q=0.01
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
X-Requested-With
XMLHttpRequest
Cookie
fly_geo={"countryCode": "de"}; fly_device=desktop; ak_bmsc=D847596FDE7F1DA8E5BED09D02CED00E48F7B204AE48000086143A59543DF46F~plOCH8ln5qywrfqLKbXdYIwVxSTBhZMDAoQD04BMWkRVjDg8UNpebmtX+v9TYDY1oEDaIHjlGOe+pKYgqKzaWZM8fLSggYHWAPhqgI5DelV5xxkO+4KifM9ThlXmRMcCvOOiE9a1EyioqmaVS7tKIGiwRxIgvAX5CYRhWj8SxZCQU7esEXHfOcELiIehrr8XxnOyPYF3rSLVIza5pkne4QnTkJJsUjl7z6kHisFLxMqxw=; fly_default_edition=eu; bm_mi=B6AD4036A5556108520CF4ABAFF8A102~XIT/mGH5U4U1uotE4zVV0dpIPbQh+5a7SlqwB7+IHQUIi1lgrkfn+UYy9iY5fmHNiITGg/lBYNFDBZOTxItf+ftgiqRRF7AdgfL4r920am8JLY8lDAj77ZV3IKGnTPKedza8wlHvlGFvAeofhRLLvOhGg5rR3u0vAeYmtzM81O7IX/ZS5/q1AGJh8Ot3H0bUcSQ0eIA1Kgvp51CcTZu+AyYNtwOSDAE2/E/4DQXxb/drm72WXAANnGBHOsGoQsgrLYji/I4P1Neg7ZNmANQ2V+Lh7XAjkGymsred/G/YvrbNYRDtYGODDxzhUEAUp+X+xt9yNGGfgv2HXeet4SlAS0XVqYW5Dj69jkr5ahfrq4Tr+wr7zXKlUeVGLBPddsNS; utag_main=v_id:015c8ae0307e000b0f9380ce6a6705069006406100b08$_sn:1$_ss:1$_pn:1%3Bexp-session$_st:1496980367294$ses_id:1496978567294%3Bexp-session$linktag:undefined%3Bexp-session; zdnet_ad=%7B%22type%22%3A%22gpt%22%2C%22region%22%3A%22aw%22%2C%22session%22%3A%22a%22%2C%22subSession%22%3A%223%22%7D; first_page_today=false; AMCV_10D31225525FF5790A490D4D%40AdobeOrg=T; LDCLGFbrowser=f5a1f307-3cf9-48ce-ab44-a17282f6bdf8; netseer_cm_v1=10:1496978567515&11:1496978567515&14:1496978567515&16:1496978567515&18:1496978567515&27:1496978567515&31:1496978567515&39:1496978567515&41:1496978567515
Connection
keep-alive
Cache-Control
no-cache
Accept
application/json, text/javascript, */*; q=0.01
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Server
nginx
Connection
keep-alive
Vary
Accept-Encoding
X-Tx-Id
24a2b739-6205-43c7-8d56-da222ff45ef2
Content-Type
application/json
Cache-Control
max-age=0, no-cache, no-store
Set-Cookie
fly_session=ojth16absa2dqg9l0sfgb2res3; path=/; domain=.zdnet.com fly_default_edition=eu; expires=Fri, 16-Jun-2017 03:22:47 GMT; path=/; domain=.zdnet.com bm_sv=3C1BF47F4A98EE985EE7BCF93D5CEBA1~x2/QV5JcNQ1/5PYlSDaA5DcE7uWW+PsQPwX1zS6HAcxDpX3XdTsq1lvSsShHVRUwjIdREbgSY8aeWh18wNFS3im1eDej/RaGzhXGDNOQIxovsj8J0j0V/yrgu44nRPJWXOjGOPiPO3vwb0NF8k9zyw==; Domain=.zdnet.com; Path=/; Max-Age=7200; HttpOnly
Accept-Ranges
bytes
Content-Length
570
Expires
Fri, 09 Jun 2017 03:22:47 GMT
Cookie set /
www.zdnet.com/mds/xhr/right-rail/
9 KB
1 KB
XHR
General
Full URL
http://www.zdnet.com/mds/xhr/right-rail/?promo=2150&count=3&siteId=2&rsid=cnetzdnetglobalsite&sl=en&sc=eu&pagetype=article&topicname=security&topicbrcrm=editorial&assetguid=27081696-34e5-11e4-9e6a-00505685119a&assettitle=washington+post%2C+guardian+links+used+to+infect+the+mask+malware+victims&assettype=content_article&devicetype=desktop&viewguid=93e230e0-1346-4244-983d-5885f92e829c&upId=968348887&template=right-rail
Requested by
Host: zdnet3.cbsistatic.com
URL: http://zdnet3.cbsistatic.com/fly/883-fly/js/main.default.js
Protocol
HTTP/1.1
Server
72.247.178.24 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-24.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
52e5457a115897b2c06299769eb4077f60ee95331b10c6ba69b2cf2ad4a858c6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.zdnet.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
application/json, text/javascript, */*; q=0.01
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
X-Requested-With
XMLHttpRequest
Cookie
fly_geo={"countryCode": "de"}; fly_device=desktop; ak_bmsc=D847596FDE7F1DA8E5BED09D02CED00E48F7B204AE48000086143A59543DF46F~plOCH8ln5qywrfqLKbXdYIwVxSTBhZMDAoQD04BMWkRVjDg8UNpebmtX+v9TYDY1oEDaIHjlGOe+pKYgqKzaWZM8fLSggYHWAPhqgI5DelV5xxkO+4KifM9ThlXmRMcCvOOiE9a1EyioqmaVS7tKIGiwRxIgvAX5CYRhWj8SxZCQU7esEXHfOcELiIehrr8XxnOyPYF3rSLVIza5pkne4QnTkJJsUjl7z6kHisFLxMqxw=; fly_default_edition=eu; bm_mi=B6AD4036A5556108520CF4ABAFF8A102~XIT/mGH5U4U1uotE4zVV0dpIPbQh+5a7SlqwB7+IHQUIi1lgrkfn+UYy9iY5fmHNiITGg/lBYNFDBZOTxItf+ftgiqRRF7AdgfL4r920am8JLY8lDAj77ZV3IKGnTPKedza8wlHvlGFvAeofhRLLvOhGg5rR3u0vAeYmtzM81O7IX/ZS5/q1AGJh8Ot3H0bUcSQ0eIA1Kgvp51CcTZu+AyYNtwOSDAE2/E/4DQXxb/drm72WXAANnGBHOsGoQsgrLYji/I4P1Neg7ZNmANQ2V+Lh7XAjkGymsred/G/YvrbNYRDtYGODDxzhUEAUp+X+xt9yNGGfgv2HXeet4SlAS0XVqYW5Dj69jkr5ahfrq4Tr+wr7zXKlUeVGLBPddsNS; utag_main=v_id:015c8ae0307e000b0f9380ce6a6705069006406100b08$_sn:1$_ss:1$_pn:1%3Bexp-session$_st:1496980367294$ses_id:1496978567294%3Bexp-session$linktag:undefined%3Bexp-session; zdnet_ad=%7B%22type%22%3A%22gpt%22%2C%22region%22%3A%22aw%22%2C%22session%22%3A%22a%22%2C%22subSession%22%3A%223%22%7D; first_page_today=false; AMCV_10D31225525FF5790A490D4D%40AdobeOrg=T; LDCLGFbrowser=f5a1f307-3cf9-48ce-ab44-a17282f6bdf8; netseer_cm_v1=10:1496978567515&11:1496978567515&14:1496978567515&16:1496978567515&18:1496978567515&27:1496978567515&31:1496978567515&39:1496978567515&41:1496978567515
Connection
keep-alive
Cache-Control
no-cache
Accept
application/json, text/javascript, */*; q=0.01
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Server
nginx
Connection
keep-alive
Vary
Accept-Encoding
X-Tx-Id
2fc39649-98c4-47b4-8c6e-2c8d4f0be2e6
Content-Type
application/json
Cache-Control
max-age=0, no-cache, no-store
Set-Cookie
fly_default_edition=eu; expires=Fri, 16-Jun-2017 03:22:47 GMT; path=/; domain=.zdnet.com bm_sv=9BCB90A528222A1B7DAA2B11511C8152~nqNizGUKJ7vPZZ1E78YWiz86RD40SU65UNf43oGnIdxe4xpz8/TKDudLTY3hjfNsDUCPeZGHCkaTgk8QOK0q7/wzQnPcsfuHwDJOgXlFnChIOY6v6L9noVJMtlJhfVcU2W4NLqZacgkbb9HLYy08z+AVRy5tkSOXpVNPVktWhQE=; Domain=.zdnet.com; Path=/; Max-Age=7200; HttpOnly
Accept-Ranges
bytes
Content-Length
1293
Expires
Fri, 09 Jun 2017 03:22:47 GMT
Cookie set utsync.ashx
ml314.com/
620 B
425 B
Script
General
Full URL
https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=50070&ct=js&pi=&fp=&clid=&ps=&cl=&mlt=&data=&&cp=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&pv=1496978567524_m0de7mgdy&bl=en-us&cb=4097336&return=http%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D22052%26dpuuid%3D%5BPersonID%5D%26redir%3D&ht=&d=&dc=&si=1496978567524_m0de7mgdy&cid=&s=1600x1200&rp=
Requested by
Host: ml314.com
URL: http://ml314.com/tag.aspx?952017
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.148.123 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-251-148-123.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
3db67d33437ca898cf1d37aa35b12b7c180e0b4c4907960eeadbbb890b173443

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
ml314.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
AWSELB=C7FF65F30CC113EEFA706B66F27E091147E9236E170C15403A3BA5537B317AD14EF76318455CF89006EE1CEE8CB52CE4D051151B49DEEA58E108F3282DEE2188E889DEA620
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:46 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
p3P
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Set-Cookie
u=aHR0cDovL3d3dy56ZG5ldC5jb20vYXJ0aWNsZS93YXNoaW5ndG9uLXBvc3QtZ3VhcmRpYW4tbGlua3MtdXNlZC10by1pbmZlY3QtdGhlLW1hc2stbWFsd2FyZS12aWN0aW1zLw==; domain=ml314.com; expires=Fri, 09-Jun-2017 03:23:01 GMT; path=/ pi=5978151335970770985; domain=ml314.com; expires=Sat, 09-Jun-2018 03:22:46 GMT; path=/ tp=3%3b6%2f8%2f2017+11%3a22%3a46+PM%3b0; domain=ml314.com; expires=Fri, 23-Jun-2017 03:22:46 GMT; path=/
Cache-Control
private
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
425
Expires
0
Cookie set ud.ashx
in.ml314.com/
20 B
138 B
Script
General
Full URL
https://in.ml314.com/ud.ashx?topiclimit=&cb=952017
Requested by
Host: ml314.com
URL: http://ml314.com/tag.aspx?952017
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.208.40.88 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-208-40-88.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
in.ml314.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:58 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Set-Cookie
AWSELB=DBBF05DB0471A2F071B8CA33F4C3AD38DC83EEE48B5B3CB7879680C9749B36E174560ED74225CD0FB9943963C6FAF205418B93B288507CC0288E747D447CB1CCBC874CDA2D;PATH=/;MAX-AGE=3600
Cache-Control
public no-cache="set-cookie"
Connection
keep-alive
Content-Length
138
Expires
Sat, 10 Jun 2017 03:22:59 GMT
advertisement-d41d8cd98f-rev.js
zdnet2.cbsistatic.com/fly/js/utils/
0
0
Script
General
Full URL
http://zdnet2.cbsistatic.com/fly/js/utils/advertisement-d41d8cd98f-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: http://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
HTTP/1.1
Server
72.247.178.24 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-24.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet2.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Last-Modified
Mon, 08 May 2017 10:16:40 GMT
Server
nginx
Content-Type
application/x-javascript
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
0
Expires
Fri, 16 Jun 2017 03:22:47 GMT
loader.js
cdn.taboola.com/libtrc/cbsinteractive-zdnet/
202 KB
18 KB
Script
General
Full URL
http://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Requested by
Host: zdnet2.cbsistatic.com
URL: http://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
HTTP/1.1
Server
151.101.114.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8dad3047e712df9676f35b1101bb1a42a951d5468a190f581aae72f61d46216d

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.taboola.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

x-amz-version-id
Q3L_YIsIDd0Ji.GDJygu.R8NdZxeGZ_g
Content-Encoding
gzip
ETag
"93879831ff0621a90c582503e32596d3"
Age
104
X-Cache
HIT
x-amz-replication-status
PENDING
Connection
keep-alive
Content-Length
18487
x-amz-id-2
TQ9HZF//tZyI1FKA/6Vz+4Q8OTXJqypD5M8qj767J31C/sFo4VAAnKuCcnIXCkIcBaaxEEV90cw=
X-Served-By
cache-hhn1536-HHN
Last-Modified
Wed, 07 Jun 2017 09:31:44 GMT
Server
AmazonS3
X-Timer
S1496978568.591751,VS0,VE0
Date
Fri, 09 Jun 2017 03:22:47 GMT
Vary
Accept-Encoding
x-amz-request-id
1ECAACE00732D437
Via
1.1 varnish
Cache-Control
private,max-age=14401
Accept-Ranges
bytes
Content-Type
application/javascript; charset=utf-8
X-Cache-Hits
1
Cookie set event
cbsi.demdex.net/
2 KB
663 B
Script
General
Full URL
http://cbsi.demdex.net/event?d_mid=82019002344760642192159551723785266833&d_nsid=0&d_ld=_ts%3D1496978567456&d_rtbd=json&d_jsonv=1&d_dst=1&d_cb=demdexRequestCallback_0_1496978567456&c_hash=&c_host=www.zdnet.com&c_hostname=www.zdnet.com&c_pathname=article%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&c_protocol=http%3A
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=201703281836
Protocol
HTTP/1.1
Server
54.229.75.228 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-229-75-228.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
a0f90576ff3ebff7c2265be9437f3b5f730b108ebd6b0dc6af35e2c1bb0aced9

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cbsi.demdex.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
demdex=81798148289666930272139155021439591401
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

DCS
irl1-prod-dcs-dfbb781f.edge-irl1.demdex.com 5.11.1.20170606140807 5ms
Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
X-TID
TM9xrlC7S7U=
Vary
Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Set-Cookie
demdex=81798148289666930272139155021439591401;Path=/;Domain=.demdex.net;Expires=Wed, 06-Dec-2017 03:22:47 GMT
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
transfer-encoding
chunked
Connection
keep-alive
Content-Type
application/javascript; charset=UTF-8
Expires
Thu, 01 Jan 2009 00:00:00 GMT
Cookie set page_views
tru.am/
212 B
190 B
Script
General
Full URL
http://tru.am/page_views?clientID=1082&version=13&canonical=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&ogURL=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&callback=reqwest_1496978567552
Requested by
Host: tru.am
URL: http://tru.am/scripts/ta-pagesocial-sdk.js
Protocol
HTTP/1.1
Server
2400:cb00:2048:1::6819:a222 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software
cloudflare-nginx /
Resource Hash
9db741d0cacec2a70cb9b1df4b7e5f5d7bb6997ac51bf7a47eaf516e6d0cc45a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
tru.am
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
__cfduid=dda662d51cbe5fde3c99582ac4384a11e1496978567
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
cloudflare-nginx
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
text/javascript
Cache-Control
no-cache, private, max-age=0
Content-Disposition
filename=f.txt
Set-Cookie
mid=593a1487f12912000712e8b0; Expires=Sun, 09 Jun 2019 03:22:47 GMT; Max-Age=63072000
CF-RAY
36c0f7efe5770f69-FRA
Content-Length
190
Expires
Thu, 01 Jan 1970 00:00:00 UTC
Cookie set 328981956.js
cdn.optimizely.com/js/
232 KB
72 KB
Script
General
Full URL
http://cdn.optimizely.com/js/328981956.js
Requested by
Host: zdnet2.cbsistatic.com
URL: http://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
HTTP/1.1
Server
95.101.241.136 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-241-136.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
1f5390c537c67f8a7fda0a6263886acc9b8c830d55e285354d5f21cb336e0e38

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.optimizely.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

x-amz-version-id
2CUPxX8tk8fLG_J9VXrT5mCg7Cgd3Sd8
Content-Encoding
gzip
ETag
"652c863eb9451a6545d86bf3caa8460d"
x-amz-request-id
129CEBDD8F04A5E1
x-amz-meta-revision
2075
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
73843
x-amz-id-2
Ug278WLlQamUDW3RO+EH5lOOOTX8YO/RpLnwZMQHoxdWX6igK5axqmmy5u0l//UDqoxgijwx2Oo=
Last-Modified
Fri, 19 May 2017 19:31:57 GMT
Server
AmazonS3
Date
Fri, 09 Jun 2017 03:22:47 GMT
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET, HEAD
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
x-amz-meta-revision
Cache-Control
max-age=126
Set-Cookie
cdn=http%3a%2f%2fakamai%3adsd%40cdn.optimizely.com%2fjs%2f328981956.js; path=/; domain=.optimizely.com
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
*
fb_digioh.2.1.5.css
www.lightboxcdn.com/static/
4 KB
1 KB
Stylesheet
General
Full URL
http://www.lightboxcdn.com/static/fb_digioh.2.1.5.css?cb=636294540878687886
Requested by
Host: www.lightboxcdn.com
URL: http://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=636294540878687886
Protocol
HTTP/1.1
Server
2400:cb00:2048:1::6810:4b27 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software
cloudflare-nginx /
Resource Hash
45f46e110ecb68a95d93cae5f2246b038bcb4e33601436f36167a8e1ff33de67

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.lightboxcdn.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
__cfduid=daecafd19e2aff09d90cb2c4cdeda90f71496978567
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Content-MD5
SPXkOHRrmvkdtUVAkMsWtg==
Transfer-Encoding
chunked
Connection
keep-alive
x-ms-lease-status
unlocked
Last-Modified
Tue, 24 Jan 2017 15:29:10 GMT
Server
cloudflare-nginx
Vary
Accept-Encoding
Content-Type
text/css
x-ms-request-id
e9690290-0001-001e-5b6d-cf527f000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
CF-RAY
36c0f7ef87226349-FRA
Expires
Sat, 09 Jun 2018 03:22:47 GMT
MzYwNDYxOjI3MDgxNjk2LTM0ZTUtMTFlNC05ZTZhLTAwNTA1Njg1MTE5YQ==.json
zdnet.bootstrap.fyre.co/api/v1.1/public/comments/ncomments/
198 B
238 B
Script
General
Full URL
http://zdnet.bootstrap.fyre.co/api/v1.1/public/comments/ncomments/MzYwNDYxOjI3MDgxNjk2LTM0ZTUtMTFlNC05ZTZhLTAwNTA1Njg1MTE5YQ==.json?&callback=LFCommentCount77618
Requested by
Host: cdn.livefyre.com
URL: http://cdn.livefyre.com/libs/commentcount/v1.0/commentcount.js
Protocol
HTTP/1.1
Server
34.207.48.84 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-207-48-84.compute-1.amazonaws.com
Software
Varnish /
Resource Hash
3cca45013cadb3fa01fb7ab7539a57f674a96053d123cf59dd9488c0bc76d77b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet.bootstrap.fyre.co
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Age
0 0
X-Cache
MISS
Connection
keep-alive
Content-Length
238
X-JSONP
yes
X-Served-By
vf39.prod.livefyre.com
Server
Varnish
Vary
Origin
X-Varnish
1876813798
Via
1.1 varnish
Cache-Control
no-store, max-age=5, private
X-Server
jsonp_template_backend
Accept-Ranges
bytes
Content-Type
application/javascript
/
graph.facebook.com/
727 B
482 B
Script
General
Full URL
http://graph.facebook.com/?id=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&callback=jQuery18304907232375099648_1496978567046&_=1496978567607
Requested by
Host: zdnet3.cbsistatic.com
URL: http://zdnet3.cbsistatic.com/fly/883-fly/js/main.default.js
Protocol
HTTP/1.1
Server
2a03:2880:f01c:20e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
86f51762f807d1e9ad87a085adc9c36b417bfac14df90d259ea0e997ee818770

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
graph.facebook.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
X-FB-Debug
Bf7SNuYrRyXv6tUQtcW2j0/Le9MVv/7LnJ8bB7IoK1P5P6jBJW9iMzfTx9AyWQ1373ToskySqa3nfTjdbMH/SA==
Content-Encoding
gzip
x-fb-trace-id
CaXGibvI3CR
ETag
"e7273e44f884fc0e7859cb35e651b09f8cfaed64"
Vary
Accept-Encoding
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
private, no-cache, no-store, must-revalidate
Date
Fri, 09 Jun 2017 03:22:47 GMT
x-fb-rev
3076384
Connection
keep-alive
Content-Length
482
facebook-api-version
v2.3
Expires
Sat, 01 Jan 2000 00:00:00 GMT
share
www.linkedin.com/countserv/count/
197 B
191 B
Script
General
Full URL
https://www.linkedin.com/countserv/count/share?url=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&callback=jQuery18304907232375099648_1496978567047&_=1496978567608
Requested by
Host: zdnet3.cbsistatic.com
URL: http://zdnet3.cbsistatic.com/fly/883-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:109:c00c:104::b93f:9001 , United States, ASN14413 (LINKEDIN - LinkedIn Corporation, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
97d64971e73a0444a29cc478c7d89bc9d614c0bca95ee3d066fdfd1a539b69fc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/countserv/count/share?url=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&callback=jQuery18304907232375099648_1496978567047&_=1496978567608
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.linkedin.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Fri, 09 Jun 2017 03:22:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200
x-li-uuid
Mzu7eRNWxhQAL/C1vioAAA==
server
Apache-Coyote/1.1
pragma
no-cache
x-li-pop
prod-tln1
x-frame-options
sameorigin
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
x-xss-protection
1; mode=block
cache-control
no-cache, no-store
set-cookie
lidc="b=TGST06:g=404:u=1:i=1496978567:t=1497064967:s=AQGgV1qBghbEL-prO_RjEfegVvAFsHih"; Expires=Sat, 10 Jun 2017 03:22:47 GMT; domain=.linkedin.com; Path=/
x-li-proto
http/2
x-li-fabric
prod-ltx1
expires
Thu, 01 Jan 1970 00:00:00 GMT
MzYwNDYxOjI3MDgxNjk2LTM0ZTUtMTFlNC05ZTZhLTAwNTA1Njg1MTE5YQ==.json
zdnet.bootstrap.fyre.co/api/v1.1/public/comments/ncomments/
198 B
238 B
Script
General
Full URL
http://zdnet.bootstrap.fyre.co/api/v1.1/public/comments/ncomments/MzYwNDYxOjI3MDgxNjk2LTM0ZTUtMTFlNC05ZTZhLTAwNTA1Njg1MTE5YQ==.json?&callback=LFCommentCount13567
Requested by
Host: cdn.livefyre.com
URL: http://cdn.livefyre.com/libs/commentcount/v1.0/commentcount.js
Protocol
HTTP/1.1
Server
34.207.48.84 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-207-48-84.compute-1.amazonaws.com
Software
Varnish /
Resource Hash
2a2de5beb8a808b1f2c288afde53eca0e8dba3e979750967f88ab04972cac70b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet.bootstrap.fyre.co
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Age
0 0
X-Cache
MISS
Connection
keep-alive
Content-Length
238
X-JSONP
yes
X-Served-By
vf39.prod.livefyre.com
Server
Varnish
Vary
Origin
X-Varnish
1876813799
Via
1.1 varnish
Cache-Control
no-store, max-age=5, private
X-Server
jsonp_template_backend
Accept-Ranges
bytes
Content-Type
application/javascript
Cookie set pixel_61e19a54
www.zdnet.com/akam/10/
0
0
XHR
General
Full URL
http://www.zdnet.com/akam/10/pixel_61e19a54
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/akam/10/61e19a54
Protocol
HTTP/1.1
Server
72.247.178.24 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-24.deploy.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate
Host
www.zdnet.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Accept
*/*
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
fly_geo={"countryCode": "de"}; fly_device=desktop; ak_bmsc=D847596FDE7F1DA8E5BED09D02CED00E48F7B204AE48000086143A59543DF46F~plOCH8ln5qywrfqLKbXdYIwVxSTBhZMDAoQD04BMWkRVjDg8UNpebmtX+v9TYDY1oEDaIHjlGOe+pKYgqKzaWZM8fLSggYHWAPhqgI5DelV5xxkO+4KifM9ThlXmRMcCvOOiE9a1EyioqmaVS7tKIGiwRxIgvAX5CYRhWj8SxZCQU7esEXHfOcELiIehrr8XxnOyPYF3rSLVIza5pkne4QnTkJJsUjl7z6kHisFLxMqxw=; fly_default_edition=eu; bm_mi=B6AD4036A5556108520CF4ABAFF8A102~XIT/mGH5U4U1uotE4zVV0dpIPbQh+5a7SlqwB7+IHQUIi1lgrkfn+UYy9iY5fmHNiITGg/lBYNFDBZOTxItf+ftgiqRRF7AdgfL4r920am8JLY8lDAj77ZV3IKGnTPKedza8wlHvlGFvAeofhRLLvOhGg5rR3u0vAeYmtzM81O7IX/ZS5/q1AGJh8Ot3H0bUcSQ0eIA1Kgvp51CcTZu+AyYNtwOSDAE2/E/4DQXxb/drm72WXAANnGBHOsGoQsgrLYji/I4P1Neg7ZNmANQ2V+Lh7XAjkGymsred/G/YvrbNYRDtYGODDxzhUEAUp+X+xt9yNGGfgv2HXeet4SlAS0XVqYW5Dj69jkr5ahfrq4Tr+wr7zXKlUeVGLBPddsNS; utag_main=v_id:015c8ae0307e000b0f9380ce6a6705069006406100b08$_sn:1$_ss:1$_pn:1%3Bexp-session$_st:1496980367294$ses_id:1496978567294%3Bexp-session$linktag:undefined%3Bexp-session; zdnet_ad=%7B%22type%22%3A%22gpt%22%2C%22region%22%3A%22aw%22%2C%22session%22%3A%22a%22%2C%22subSession%22%3A%223%22%7D; first_page_today=false; LDCLGFbrowser=f5a1f307-3cf9-48ce-ab44-a17282f6bdf8; netseer_cm_v1=10:1496978567515&11:1496978567515&14:1496978567515&16:1496978567515&18:1496978567515&27:1496978567515&31:1496978567515&39:1496978567515&41:1496978567515; _ccmsi=1496978567524_m0de7mgdy|1496978567525; AMCVS_10D31225525FF5790A490D4D%40AdobeOrg=1; AMCV_10D31225525FF5790A490D4D%40AdobeOrg=-1248264605%7CMCMID%7C82019002344760642192159551723785266833%7CMCAAMLH-1497583367%7C6%7CMCAAMB-1497583367%7CcIBAx_aQzFEHcPoEv0GwcQ%7CMCOPTOUT-1496985767s%7CNONE
Connection
keep-alive
Content-Length
3230
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Type
text/html
Set-Cookie
fly_default_edition=eu; expires=Fri, 16-Jun-2017 03:22:47 GMT; path=/; domain=.zdnet.com ak_bmsc=D847596FDE7F1DA8E5BED09D02CED00E48F7B204AE48000086143A59543DF46F~plXZKFAij3QAbkt6jxmrkKWszan+vnWLn6ek9Ik86dHiw8zV3SnQDYtS8nW9/hE2t34wBymBrfZk+GPatxCgEO8zwDNSKx9kMZ6kNF8ujLMZG28xjAa0arny0gfg7ZpBDrpC58q9sgtUW/lXI5DugNWt3gd+rXsvzVVIwVt7f3mXqE2g98IKrZXfm1UDdyCjyEQwuMUU0ZEJzd5JN0PsCMRceNrV1EcS7UEx2ekM4XxDHntTHb9wVJ02lCg5SRmThE; expires=Fri, 09 Jun 2017 05:22:46 GMT; max-age=7199; path=/; domain=.zdnet.com; HttpOnly
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
0
Expires
Fri, 09 Jun 2017 03:22:47 GMT
Livefyre.min.js
cdn.livefyre.com/libs/Livefyre/v1.1.1/builds/329/
57 KB
19 KB
Script
General
Full URL
http://cdn.livefyre.com/libs/Livefyre/v1.1.1/builds/329/Livefyre.min.js
Requested by
Host: cdn.livefyre.com
URL: http://cdn.livefyre.com/Livefyre.js
Protocol
HTTP/1.1
Server
52.84.28.208 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-84-28-208.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
abfae2bdd085e7a30062f6b96e16dd90c55ba817eecdc5a921b50b04e1b0a535

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.livefyre.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 02 Jun 2017 00:33:49 GMT
Content-Encoding
gzip
Last-Modified
Thu, 01 Jun 2017 23:50:24 GMT
Server
AmazonS3
Age
614939
ETag
"0330116095fdea09e9563863336cfef1"
X-Cache
Hit from cloudfront
Content-Type
application/javascript; charset=utf-8
Via
1.1 49ccc390fa499ab821b632cf67d38720.cloudfront.net (CloudFront)
Cache-Control
max-age=315360000, no-transform, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
19127
X-Amz-Cf-Id
m662Vkgl39krzzULlOpcBStGh5KJRACZGFJ_DObaILtphfSCAQ-eaQ==
ads
securepubads.g.doubleclick.net/gampad/
131 KB
15 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&correlator=690503467846389&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&json_a=1&eid=108809080%2C108809103%2C21060013&sc=0&sfv=1-0-8&iu_parts=8264%2Caw-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=1x1%2C1600x1000%2C980x45%2C401x11%2C728x90%7C970x66%7C970x250%2C300x450%2C300x250%7C300x600%7C300x1050%2C11x11%2C300x250%2C300x250%2C641x321%2C728x90%7C970x66%7C970x250%2C371x771&ists=4096&prev_scp=%7Cpos%3Dtop%7Cpos%3Dtop%7Cpos%3Dtop%7Cpos%3Dtop%26IOM%3D728x90_5%26ix_id%3Db1a0bebc-9ddc-5a2e-a3e9-fa35a769a11a_5%7Cpos%3Dtop%7Cpos%3Dtop%7Cpos%3Dtop%26strnativekey%3D8ec3a4f3%7Cpos%3Dmiddle%7Cpos%3Dbottom%7Cpos%3Dtop%7Cpos%3Dbottom%7Cpos%3Dtop&eri=1&cust_params=buyingcycle%3Ddiscover%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%26env%3Dprod%26firstpg%3D1%26vguid%3D93e230e0-1346-4244-983d-5885f92e829c%26session%3Da%26subses%3D3&cookie_enabled=1&abxe=1&lmt=1496978565&dt=1496978567668&frm=20&biw=1583&bih=1132&oid=3&adxs=0%2C0%2C428%2C0%2C428%2C1007%2C1042%2C207%2C1042%2C1042%2C207%2C428%2C1007&adys=161%2C0%2C28%2C0%2C449%2C849%2C569%2C1980%2C2784%2C3064%2C1367%2C5548%2C1983&adks=2577263354%2C3113356553%2C2426749405%2C3800986708%2C89476764%2C973953724%2C1740190363%2C626185548%2C777763426%2C1434303317%2C2779441031%2C1702138152%2C3009519373&gut=v2&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=5&u_nmime=7&u_sd=1&flash=25.0.0&url=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&dssz=61&icsg=0&std=0&vrg=121&vrp=121&ga_vid=519849922.1496978568&ga_sid=1496978568&ga_hid=790477278
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
cafe /
Resource Hash
6f9fd333e3457ca928903ff87fe7035fdf5675a00efaff3047c6c22604b0c95e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/gampad/ads?gdfp_req=1&correlator=690503467846389&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&json_a=1&eid=108809080%2C108809103%2C21060013&sc=0&sfv=1-0-8&iu_parts=8264%2Caw-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=1x1%2C1600x1000%2C980x45%2C401x11%2C728x90%7C970x66%7C970x250%2C300x450%2C300x250%7C300x600%7C300x1050%2C11x11%2C300x250%2C300x250%2C641x321%2C728x90%7C970x66%7C970x250%2C371x771&ists=4096&prev_scp=%7Cpos%3Dtop%7Cpos%3Dtop%7Cpos%3Dtop%7Cpos%3Dtop%26IOM%3D728x90_5%26ix_id%3Db1a0bebc-9ddc-5a2e-a3e9-fa35a769a11a_5%7Cpos%3Dtop%7Cpos%3Dtop%7Cpos%3Dtop%26strnativekey%3D8ec3a4f3%7Cpos%3Dmiddle%7Cpos%3Dbottom%7Cpos%3Dtop%7Cpos%3Dbottom%7Cpos%3Dtop&eri=1&cust_params=buyingcycle%3Ddiscover%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%26env%3Dprod%26firstpg%3D1%26vguid%3D93e230e0-1346-4244-983d-5885f92e829c%26session%3Da%26subses%3D3&cookie_enabled=1&abxe=1&lmt=1496978565&dt=1496978567668&frm=20&biw=1583&bih=1132&oid=3&adxs=0%2C0%2C428%2C0%2C428%2C1007%2C1042%2C207%2C1042%2C1042%2C207%2C428%2C1007&adys=161%2C0%2C28%2C0%2C449%2C849%2C569%2C1980%2C2784%2C3064%2C1367%2C5548%2C1983&adks=2577263354%2C3113356553%2C2426749405%2C3800986708%2C89476764%2C973953724%2C1740190363%2C626185548%2C777763426%2C1434303317%2C2779441031%2C1702138152%2C3009519373&gut=v2&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=5&u_nmime=7&u_sd=1&flash=25.0.0&url=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&dssz=61&icsg=0&std=0&vrg=121&vrp=121&ga_vid=519849922.1496978568&ga_sid=1496978568&ga_hid=790477278
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Fri, 09 Jun 2017 03:22:48 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
15278
x-xss-protection
1; mode=block
google-lineitem-id
-2,500296089,166050729,166050969,500296089,131328849,500296089,246996849,500296089,500296089,245231529,500296089,236907969
pragma
no-cache
server
cafe
google-creative-id
-2,120028132569,43583969169,43583970849,120028132809,31224235809,120028133049,79555432089,120027819609,119967648249,120082589289,119960265609,72087703209
content-type
text/javascript; charset=UTF-8
cache-control
no-cache, must-revalidate
set-cookie
test_cookie=CheckForPermission; expires=Fri, 09-Jun-2017 03:37:47 GMT; path=/; domain=.doubleclick.net
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
headerstats
as.casalemedia.com/
43 B
43 B
XHR
General
Full URL
http://as.casalemedia.com/headerstats?s=182823&u=http%253A%252F%252Fwww.zdnet.com%252Farticle%252Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%252F&type=RT&r=139456743211190&t0=1496978567434&t1=1496978567649&INDX.t=215&INDX.to=0&INDX.ts=500&INDX.p.b1a0bebc-9ddc-5a2e-a3e9-fa35a769a11a.IOM=728x90_5&INDX.p.b1a0bebc-9ddc-5a2e-a3e9-fa35a769a11a.ix_id=b1a0bebc-9ddc-5a2e-a3e9-fa35a769a11a_5&APNX.t=108&APNX.to=0&APNX.ts=500
Requested by
Host: js.indexww.com
URL: http://js.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Server
95.100.248.168 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-100-248-168.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
as.casalemedia.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8
Accept
*/*
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:47 GMT
Server
Apache
Content-Type
image/gif
Access-Control-Allow-Origin
http://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
43
Expires
Fri, 09 Jun 2017 03:22:47 GMT
load.js
widget.perfectmarket.com/cbsinteractive-zdnet/
13 KB
5 KB
Script
General
Full URL
http://widget.perfectmarket.com/cbsinteractive-zdnet/load.js
Requested by
Host: cdn.taboola.com
URL: http://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
HTTP/1.1
Server
151.101.113.181 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
widget.perfectmarket.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

x-amz-version-id
rwr9L97XovW8QPypI62jHvd7E2HiNZm2
Content-Encoding
gzip
ETag
"fc0de48a0976cde02ddee0bd49a81832"
Age
40
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
4742
x-amz-id-2
3FXjb4YzL+xIb07hdzOpe4GxjsaS5Y5KlC1g5ypddUQnlWCYPz5teRHw1B0HXb70Wo6oTXBvY6A=
X-Served-By
cache-lax8642-LAX, cache-hhn1525-HHN
Last-Modified
Thu, 20 Oct 2016 17:48:07 GMT
Server
AmazonS3
X-Timer
S1496978568.885521,VS0,VE1
Fastly-Debug-Digest
b48e29d08e276422c497f5a21111adc487136634d3bfe520a4b9a9fec9cce35a
Date
Fri, 09 Jun 2017 03:22:47 GMT
Vary
Accept-Encoding
x-amz-request-id
82D3D4E6B00841D8
Via
1.1 varnish 1.1 varnish
Cache-Control
max-age=300
Accept-Ranges
bytes
Content-Type
binary/octet-stream
X-Cache-Hits
3, 1
impl.257-18-RELEASE.js
cdn.taboola.com/libtrc/
332 KB
92 KB
Script
General
Full URL
http://cdn.taboola.com/libtrc/impl.257-18-RELEASE.js
Requested by
Host: cdn.taboola.com
URL: http://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
HTTP/1.1
Server
151.101.114.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c93338a0c4a2d71229f64639dceda2bc38420d6cb4d4c507a7b896affd108f16

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.taboola.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

x-amz-version-id
7jldk1eOMmOReym2w_c.b6n_YtIXdSIa
Content-Encoding
gzip
ETag
"2c18b43e0a0bc58c9c2d6694c1099495"
Age
29
X-Cache
HIT
x-amz-replication-status
PENDING
Connection
keep-alive
Content-Length
94458
x-amz-id-2
gr3nLNzWkvHk1cGtTDGTRb3WbVgwtpD7dVY3euSp7+4KjJ96JR2NVfm2jIk4Qqdi8FFopOHHitk=
X-Served-By
cache-hhn1536-HHN
Last-Modified
Wed, 07 Jun 2017 07:53:04 GMT
Server
AmazonS3
X-Timer
S1496978568.889744,VS0,VE0
Date
Fri, 09 Jun 2017 03:22:47 GMT
Vary
Accept-Encoding
x-amz-request-id
3A9DF80B6D8DF011
Via
1.1 varnish
Cache-Control
private,max-age=31536000
Accept-Ranges
bytes
Content-Type
application/javascript; charset=utf-8
X-Cache-Hits
133
beacon.js
b.scorecardresearch.com/
1 KB
901 B
Script
General
Full URL
http://b.scorecardresearch.com/beacon.js
Requested by
Host: cdn.taboola.com
URL: http://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
HTTP/1.1
Server
95.100.248.105 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-100-248-105.deploy.akamaitechnologies.com
Software
/
Resource Hash
d0fd74148f4cbe78bd0e6328dc5ce5955f0a0ecdb1eb2919da4a7e596ac65912

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
b.scorecardresearch.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=1209600
Connection
keep-alive
Content-Length
901
Expires
Fri, 23 Jun 2017 03:22:47 GMT
20486
tags.bluekai.com/site/
0
0

395886.gif
idsync.rlcdn.com/
0
0

match
ps.eyeota.net/
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&bid=gdo9o51&newuser=1
  • https://ps.eyeota.net/match?bid=gdo9o51&newuser=1&google_gid=CAESEC1H-HKfRJOKyLEEirkPvJg&google_cver=1
70 B
70 B
Image
General
Full URL
https://ps.eyeota.net/match?bid=gdo9o51&newuser=1&google_gid=CAESEC1H-HKfRJOKyLEEirkPvJg&google_cver=1
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.57.223.246 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-57-223-246.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
ps.eyeota.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
mako_uid=15c8ae03316-78150000010f508f
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 UTC
Content-Length
70
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Fri, 09 Jun 2017 03:22:48 GMT
server
HTTP server (unknown)
status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ps.eyeota.net/match?bid=gdo9o51&newuser=1&google_gid=CAESEC1H-HKfRJOKyLEEirkPvJg&google_cver=1
cache-control
no-cache, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="38,37,36,35",quic=":443"; ma=2592000; v="38,37,36,35"
content-length
311
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
csync.ashx
ml314.com/
Redirect Chain
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151335970770985%26eid=50220&mm_bnc&mm_bct
  • https://ml314.com/csync.ashx?fp=d79c593a-1487-4700-9ef2-546e83189443&person_id=5978151335970770985&eid=50220
43 B
43 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=d79c593a-1487-4700-9ef2-546e83189443&person_id=5978151335970770985&eid=50220
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.148.123 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-251-148-123.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
ml314.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
AWSELB=C7FF65F30CC113EEFA706B66F27E091147E9236E170C15403A3BA5537B317AD14EF76318455CF89006EE1CEE8CB52CE4D051151B49DEEA58E108F3282DEE2188E889DEA620; u=aHR0cDovL3d3dy56ZG5ldC5jb20vYXJ0aWNsZS93YXNoaW5ndG9uLXBvc3QtZ3VhcmRpYW4tbGlua3MtdXNlZC10by1pbmZlY3QtdGhlLW1hc2stbWFsd2FyZS12aWN0aW1zLw==; pi=5978151335970770985; tp=3%3b6%2f8%2f2017+11%3a22%3a46+PM%3b0
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:46 GMT
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Fri, 09 Jun 2017 23:22:46 GMT

Redirect headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
MT3 1.15.7.0 2e0cad3 RELEASE cdg-pixel-x7
Connection
keep-alive
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location
https://ml314.com/csync.ashx?fp=d79c593a-1487-4700-9ef2-546e83189443&person_id=5978151335970770985&eid=50220
Cache-Control
no-cache
Set-Cookie
uuidc=bZjUVoazP2Ujb1ycqDzl3v7c1OXADjbQ84ogial4tYvbXFH3aAW/3HCKKyXvJmMjqsQwO3QShiA2rP+ocuA6IBw3pwRODSrIkZbdQDp/Kbc=; Expires=Sat, 07-Jul-18 03:22:48 GMT; Domain=.mathtag.com; Path=/
Content-Type
image/gif
Content-Length
0
Expires
Fri, 09 Jun 2017 03:22:47 GMT
Cookie set ibs:dpid=22052&dpuuid=5978151335970770985&redir=
dpm.demdex.net/
42 B
42 B
Image
General
Full URL
http://dpm.demdex.net/ibs:dpid=22052&dpuuid=5978151335970770985&redir=
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
54.154.158.135 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-154-158-135.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dpm.demdex.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
demdex=81798148289666930272139155021439591401
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

DCS
irl1-prod-dcs-fbe0076d.edge-irl1.demdex.com 5.11.1.20170606140807 2ms
Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:47 GMT
X-TID
2liNqogBR9k=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Set-Cookie
demdex=81798148289666930272139155021439591401;Path=/;Domain=.demdex.net;Expires=Wed, 06-Dec-2017 03:22:47 GMT dpm=81798148289666930272139155021439591401;Path=/;Domain=.dpm.demdex.net;Expires=Wed, 06-Dec-2017 03:22:47 GMT
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 2009 00:00:00 GMT
b.gif
b2b.cbsimg.net/
Redirect Chain
  • http://intent.cbsi.com/redir?tag=medi-right-rail&siteId=2&rsid=cnetzdnetglobalsite&pagetype=article&sl=en&sc=eu&topicguid=&assetguid=27081696-34e5-11e4-9e6a-00505685119a&assettype=content_article&f...
  • http://b2b.cbsimg.net/b.gif
43 B
57 B
Image
General
Full URL
http://b2b.cbsimg.net/b.gif
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
95.100.248.112 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-100-248-112.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
b2b.cbsimg.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Wed, 31 Jul 2013 20:12:09 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
image/gif
Access-Control-Expose-Headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Cache-Control
public, max-age=24429901
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Range
Content-Length
57

Redirect headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
Apache/2.4.25
Vary
*
Location
http://b2b.cbsimg.net/b.gif
Cache-control
no-cache, must-revalidate, no-transform
Connection
Keep-Alive
Keep-Alive
timeout=5, max=67
Content-Length
0
Expires
Mon, 05 Jan 1970 12:12:12 GMT
c.gif
dw.cbsi.com/clear/
42 B
42 B
Image
General
Full URL
http://dw.cbsi.com/clear/c.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=27081696-34e5-11e4-9e6a-00505685119a&assettitle=washington%20post%2C%20guardian%20links%20used%20to%20infect%20the%20mask%20malware%20victims&assettype=content_article&pubdate=2014-02-10%2018%3A03%3A05&viewguid=93e230e0-1346-4244-983d-5885f92e829c&devicetype=desktop&sitetype=responsive%20web&author=violet%20blue&authorid=80fecb98-8175-11e2-9d12-0018fe8a00b0&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&ts=1496978567466&ld=www.zdnet.com&ldc=f5a1f307-3cf9-48ce-ab44-a17282f6bdf8&brflv=25.0.0&brwinsz=1598x1132&brscrsz=1600x1200&brlang=en-US&tcset=utf8&im=dsjs&clgf=exrvK1k6FIftgT1Rt4g&srcurl=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&title=Washington%20Post%2C%20Guardian%20links%20used%20to%20infect%20The%20Mask%20malware%20victims%20%7C%20ZDNet
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
216.239.120.246 San Francisco, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dw.cbsi.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
XCLGFbrowser=exrvK1k6FIftgT1Rt4g
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
Apache/2.4.25
Vary
*
Content-Type
image/gif
Cache-control
no-cache, must-revalidate, no-transform
Connection
Keep-Alive
Keep-Alive
timeout=5, max=41
Content-Length
42
Expires
Mon, 05 Jan 1970 12:12:12 GMT
Cookie set id
om.cbsi.com/
155 B
155 B
Script
General
Full URL
http://om.cbsi.com/id?d_visid_ver=1.5.6&callback=s_c_il%5B2%5D._setAnalyticsFields&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&mid=82019002344760642192159551723785266833
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=201703281836
Protocol
HTTP/1.1
Server
66.235.148.133 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
*.d2.sc.omtrdc.net
Software
Omniture DC/2.0.0 /
Resource Hash
3f3cd0dcfc18194138af49d208581065fea168171b9fe77143327904e9ebb61d

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
om.cbsi.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
XCLGFbrowser=exrvK1k6FIftgT1Rt4g
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
Omniture DC/2.0.0
xserver
www4
Vary
Origin
X-C
ms-5.2.1
P3P
CP="This is not a P3P policy"
Access-Control-Allow-Origin
*
Set-Cookie
s_vi=[CS]v1|2C9D0A4405312D21-600001008000086D[CE]; Expires=Sun, 9 Jun 2019 03:22:48 GMT; Domain=cbsi.com; Path=/
Connection
Keep-Alive
Content-Type
application/x-javascript
Keep-Alive
timeout=15
Content-Length
155
utag.v.js
tags.tiqcdn.com/utag/tiqapp/
2 B
2 B
Script
General
Full URL
http://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=cbsi/zdnetglobalsite/201705252122&cb=1496978567834
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/4193) /
Resource Hash
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
tags.tiqcdn.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Last-Modified
Thu, 14 Apr 2016 16:59:33 GMT
Server
ECS (fcn/4193)
Etag
"144534940"
X-Cache
HIT
Content-Type
text/javascript
Cache-Control
max-age=1800
Accept-Ranges
bytes
Content-Length
2
Expires
Fri, 09 Jun 2017 03:52:48 GMT
e.gif
dw.cbsi.com/levt/ria/
0
0

Cookie set ping
api.viglink.com/api/
302 B
302 B
XHR
General
Full URL
http://api.viglink.com/api/ping
Requested by
Host: cdn.viglink.com
URL: http://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Server
52.31.65.152 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-31-65-152.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
766ab54cb14ef1453fc5faa9bea447e4c85c95a0dba39f7cc57c403761edc3ca

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate
Host
api.viglink.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Accept
*/*
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
__cfduid=d2391243a4caa1f8d7c537eb00a3d24be1496978567
Connection
keep-alive
Content-Length
197
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:47 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
http://www.zdnet.com
Set-Cookie
vglnk.Agent.p=932a1305f3a37ba8b0ea282b50710e21; Domain=.viglink.com; Expires=Mon, 07-Jun-2027 03:22:47 GMT; Path=/
Cache-Control
no-cache no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
302
Expires
Thu, 01 Jan 1970 00:00:00 GMT
pmk-201618008.1.js
widget.perfectmarket.com/cbsinteractive-zdnet/
323 KB
89 KB
Script
General
Full URL
http://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Requested by
Host: widget.perfectmarket.com
URL: http://widget.perfectmarket.com/cbsinteractive-zdnet/load.js
Protocol
HTTP/1.1
Server
151.101.113.181 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
widget.perfectmarket.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

x-amz-version-id
bVoOWfmxkMrYwv2s6Uu9D96fE._5IBqu
Content-Encoding
gzip
ETag
"da73fb2066df9f51d08b6688cfb35441"
Age
11587517
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
91236
x-amz-id-2
Ky2TumkKY9xdnbnT9a/4O4xdxCQRZ2mNYlqd84WEt5KZ2/65WgTJPJNWadcNPWvRWMIYtL1m5d4=
X-Served-By
cache-lax8642-LAX, cache-hhn1525-HHN
Last-Modified
Thu, 20 Oct 2016 17:47:53 GMT
Server
AmazonS3
X-Timer
S1496978568.061018,VS0,VE0
Fastly-Debug-Digest
ebd869ae8d01143835563eb782d20659d53c2446080e69429c731a34e2148388
Date
Fri, 09 Jun 2017 03:22:48 GMT
Vary
Accept-Encoding
x-amz-request-id
EF7A513B501B6307
Via
1.1 varnish 1.1 varnish
Cache-Control
max-age=31536000
Accept-Ranges
bytes
Content-Type
text/javascript
X-Cache-Hits
709, 8
Cookie set tap.php
pixel.rubiconproject.com/
Redirect Chain
  • http://pixel.rubiconproject.com/tap.php?v=6073&nid=2100&expires=30&put=usr3fed8317e3f6ffd3
  • http://pixel.rubiconproject.com/tap.php?cookie_redirect=1&v=6073&nid=2100&expires=30&put=usr3fed8317e3f6ffd3
42 B
42 B
Image
General
Full URL
http://pixel.rubiconproject.com/tap.php?cookie_redirect=1&v=6073&nid=2100&expires=30&put=usr3fed8317e3f6ffd3
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
62.67.193.85 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
Rubicon Project /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pixel.rubiconproject.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
c=1
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
Rubicon Project
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie
rpb=6073%3D1; Domain=.rubiconproject.com; Expires=Sun, 09-Jul-2017 03:22:48 GMT; Path=/ rpx=6073%3D65179%2C0%2C1%2C%2C; Domain=.pixel.rubiconproject.com; Expires=Sun, 09-Jul-2017 03:22:48 GMT; Path=/ put_2100=usr3fed8317e3f6ffd3; Domain=.rubiconproject.com; Expires=Sun, 09-Jul-2017 02:59:59 GMT; Path=/ khaos=J3PADZWS-27-F14D; Domain=.rubiconproject.com; Expires=Fri, 08-Dec-2017 15:22:48 GMT; Path=/
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
X-RPHost
1YMVwklWn2dW2iG9mePYWQ
Expires
0

Redirect headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
Rubicon Project
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
/tap.php?cookie_redirect=1&v=6073&nid=2100&expires=30&put=usr3fed8317e3f6ffd3
Cache-Control
no-cache, no-store, must-revalidate
Set-Cookie
c=1; Path=/
Content-Length
0
Expires
0
adsense.js
asset.pagefair.com/adimages/
0
0
Script
General
Full URL
http://asset.pagefair.com/adimages/adsense.js
Requested by
Host: asset.pagefair.com
URL: http://asset.pagefair.com/measure.min.js?_=1496978567335
Protocol
HTTP/1.1
Server
23.111.9.30 Phoenix, United States, ASN54104 (AS-NETDNA - netDNA, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
asset.pagefair.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Fri, 14 Apr 2017 09:32:51 GMT
Server
NetDNA-cache/2.2
x-amz-request-id
1AC514AB62EE223B
ETag
"fad38c838e15141e61b1a05e027e6923"
X-Cache
HIT
Content-Type
application/x-javascript
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
31
x-amz-id-2
tJwTknzCBVKtcHvfvBbE1X31s60rJP9BfxkTqM0dodFqeEGxgg2l9TqVFpNX8j/l1ka8AkXWHho=
textlink-ads.jpg
asset.pagefair.net/adimages/
518 B
229 B
Image
General
Full URL
http://asset.pagefair.net/adimages/textlink-ads.jpg
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
23.111.11.222 Phoenix, United States, ASN54104 (AS-NETDNA - netDNA, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
87bc265dda5e31597442c420def76eeadb5c516d016213a47f570c65d5558b72

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
asset.pagefair.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Fri, 14 Apr 2017 09:32:52 GMT
Server
NetDNA-cache/2.2
x-amz-request-id
D10113B565524EA0
ETag
"eb7e55f5218440a225c580fdcd7ccbde"
X-Cache
HIT
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
229
x-amz-id-2
LrcI2f7mXiDX+oPtPeUh+4f7fwUCXQiOo/S0B0eaTGste0x8GGEYm8P4VAgf15q1JG2RXX+/uCE=
textlink-ads.jpg
asset.pagefair.com/adimages/
518 B
229 B
Image
General
Full URL
http://asset.pagefair.com/adimages/textlink-ads.jpg
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
23.111.9.30 Phoenix, United States, ASN54104 (AS-NETDNA - netDNA, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
87bc265dda5e31597442c420def76eeadb5c516d016213a47f570c65d5558b72

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
asset.pagefair.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Fri, 14 Apr 2017 09:32:51 GMT
Server
NetDNA-cache/2.2
x-amz-request-id
F47212EF877EE2D9
ETag
"eb7e55f5218440a225c580fdcd7ccbde"
X-Cache
HIT
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
229
x-amz-id-2
XkRmxMHtLe/QQ/JmEdn/5usw01gPbFXCeJbItWjC0JV0XS7ePnqo+drwGzpruyNm94FhKc0mF78=
b2
b.scorecardresearch.com/
Redirect Chain
  • http://b.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1496978567955&ns_c=UTF-8&cv=3.1&c8=Washington%20Post%2C%20Guardian%20links%20used%20to%20infect%20The%20Mask%20malware%20victi...
  • http://b.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1496978567955&ns_c=UTF-8&cv=3.1&c8=Washington%20Post%2C%20Guardian%20links%20used%20to%20infect%20The%20Mask%20malware%20vict...
0
0
Image
General
Full URL
http://b.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1496978567955&ns_c=UTF-8&cv=3.1&c8=Washington%20Post%2C%20Guardian%20links%20used%20to%20infect%20The%20Mask%20malware%20victims%20%7C%20ZDNet&c7=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&c9=
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
95.100.248.105 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-100-248-105.deploy.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
b.scorecardresearch.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
UID=18B95a100248101b79f8a3g1496978568; UIDR=1496978568
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:48 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:48 GMT
Location
http://b.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1496978567955&ns_c=UTF-8&cv=3.1&c8=Washington%20Post%2C%20Guardian%20links%20used%20to%20infect%20The%20Mask%20malware%20victims%20%7C%20ZDNet&c7=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&c9=
Set-Cookie
UID=18B95a100248101b79f8a3g1496978568; expires=Thu, 30-May-2019 03:22:48 GMT; path=/; domain=.scorecardresearch.com UIDR=1496978568; expires=Thu, 30-May-2019 03:22:48 GMT; path=/; domain=.scorecardresearch.com
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
livefyre.min.js
cdn.livefyre.com/libs/fyre.conv/v3.0.0/
81 KB
29 KB
Script
General
Full URL
http://cdn.livefyre.com/libs/fyre.conv/v3.0.0/livefyre.min.js
Requested by
Host: cdn.livefyre.com
URL: http://cdn.livefyre.com/libs/Livefyre/v1.1.1/builds/329/Livefyre.min.js
Protocol
HTTP/1.1
Server
52.84.28.208 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-84-28-208.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6cbe3154f8586c03565905d4eaf762939059b621d8824c116828db6ea78b95ee

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.livefyre.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 14:18:34 GMT
Content-Encoding
gzip
Last-Modified
Thu, 01 Jun 2017 22:23:23 GMT
Server
AmazonS3
Age
16
ETag
"17b0d997ab232f49b88dca08125393f5"
X-Cache
Hit from cloudfront
Content-Type
application/javascript; charset=utf-8
Via
1.1 6fc7555dbae0576a76e65e3a627b516a.cloudfront.net (CloudFront)
Cache-Control
max-age=120, no-transform, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
29367
X-Amz-Cf-Id
Xlsdh-b0PW7e8DbqQmnKH1bkaNgeq1pZuHbp4oiWnOWRi5c8eFRmgQ==
Cookie set Pug
image2.pubmatic.com/AdServer/
Redirect Chain
  • http://cmi.netseer.com/redirect?ex=18&t=3&cookie=2&cr=1
  • http://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwMDEmdGw9MTI5NjAw&piggybackCookie=usr3fe26b3d7c60ed93
42 B
42 B
Image
General
Full URL
http://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwMDEmdGw9MTI5NjAw&piggybackCookie=usr3fe26b3d7c60ed93
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
198.47.127.15 Redwood City, United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
image2.pubmatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:48 GMT
X-lat
Pug22042:0:365
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie
PUBRETARGET=dummy; domain=pubmatic.com; expires=Fri, 09-Jun-2017 03:22:48 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; expires=Thu, 07-Sep-2017 03:22:48 GMT; path=/
Cache-Control
no-store, no-cache, private
Connection
close
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Server
Apache-Coyote/1.1
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location
http://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwMDEmdGw9MTI5NjAw&piggybackCookie=usr3fe26b3d7c60ed93
Connection
keep-alive
Set-Cookie
netseer_v3_vi=H4sIAAAAAAAAADOyKi0uMk5LNTJLMk4xTzYzSE2xNLYyNLE0szS3MDWzMDYw0zG0sHKNCHEN8nP0QZIxM7YEAKwdgEU9AAAA; Domain=.netseer.com; Expires=Tue, 08-Aug-2017 03:22:48 GMT; Path=/
Content-Type
text/plain; charset=UTF-8
Content-Length
0
domains
api.viglink.com/api/
41 B
41 B
XHR
General
Full URL
http://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: http://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Server
52.31.65.152 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-31-65-152.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
cfd1fee1357b64ce24bbe60515db7f5d4419d451300eacd7adedd5abb14d50eb

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate
Host
api.viglink.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Accept
*/*
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
__cfduid=d2391243a4caa1f8d7c537eb00a3d24be1496978567; vglnk.Agent.p=932a1305f3a37ba8b0ea282b50710e21
Connection
keep-alive
Content-Length
576
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:47 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
http://www.zdnet.com
Cache-Control
no-cache no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
41
Expires
Thu, 01 Jan 1970 00:00:00 GMT
setuid
ib.adnxs.com/
Redirect Chain
  • http://cm.netseer.com/pixelmatch?user_id=7041121888677254550&ex=14&ui=1&t=3
  • http://ib.adnxs.com/setuid?entity=19&code=usr3fe26b3d7c60ed93
0
0
Image
General
Full URL
http://ib.adnxs.com/setuid?entity=19&code=usr3fe26b3d7c60ed93
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
185.33.223.209 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
Software
nginx/1.11.5 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
ib.adnxs.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
sess=1; uuid2=7041121888677254550
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:50 GMT
X-Proxy-Origin
148.251.45.170; 148.251.45.170; 314.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.149:80
AN-X-Request-Uuid
f3c0d42c-b97e-4de1-a65f-fc726a73d328
Server
nginx/1.11.5
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Date
Fri, 09 Jun 2017 03:22:47 GMT
Server
Apache-Coyote/1.1
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location
http://ib.adnxs.com/setuid?entity=19&code=usr3fe26b3d7c60ed93
Connection
keep-alive
Set-Cookie
netseer_v3_vi=H4sIAAAAAAAAAE3KuRGAMAwEwIYI9J5OLgdsFwBD_6RsvDbe5_a9DKfPuiBrtg-NRhcTdMGhMUpC1ZQkqiwjU34Jwg9HXtc5SAAAAA; Domain=.netseer.com; Expires=Tue, 08-Aug-2017 03:22:48 GMT; Path=/
Content-Type
text/plain; charset=UTF-8
Content-Length
0
imgad
tpc.googlesyndication.com/pagead/
112 KB
113 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKDT_86NzAEQARgBMghgwLIaTBDoWw
Requested by
Host: zdnet3.cbsistatic.com
URL: http://zdnet3.cbsistatic.com/fly/883-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
ed0b9e327e842ad65d014d3543eb95ff28a5c0b6833c6536dc71eed264238707
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/imgad?id=CICAgKDT_86NzAEQARgBMghgwLIaTBDoWw
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Sat, 03 Jun 2017 08:50:08 GMT
x-content-type-options
nosniff
server
cafe
age
498760
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/jpeg
status
200
cache-control
public, max-age=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
115196
x-xss-protection
1; mode=block
expires
Sat, 10 Jun 2017 08:50:08 GMT
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/ Frame 603.
24 KB
10 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
fb80487775677e61280ccbce05f36a3d6ce72cb2df59c58d07c365472d3793d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/js/r20170605/r20110914/activeview/osd_listener.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Tue, 06 Jun 2017 00:41:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
268853
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
9846
x-xss-protection
1; mode=block
server
cafe
etag
5368213822475282120
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 20 Jun 2017 00:41:55 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
70 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
osd.js
pagead2.googlesyndication.com/pagead/
77 KB
29 KB
Script
General
Full URL
http://pagead2.googlesyndication.com/pagead/osd.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Server
2a00:1450:4001:824::2002 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
557007834448c888efaa01c2c1d25155130fea075308b3bdb1ea87662b82a2ae
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pagead2.googlesyndication.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 02:27:17 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
cafe
Age
3331
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
ETag
5277057430624346146
Content-Type
text/javascript; charset=UTF-8
Cache-Control
public, max-age=3600
Content-Disposition
attachment; filename="f.txt"
Timing-Allow-Origin
*
Content-Length
29297
X-XSS-Protection
1; mode=block
Expires
Fri, 09 Jun 2017 03:27:17 GMT
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/ Frame 603.
24 KB
10 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
fb80487775677e61280ccbce05f36a3d6ce72cb2df59c58d07c365472d3793d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/js/r20170605/r20110914/activeview/osd_listener.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Tue, 06 Jun 2017 00:41:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
268853
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
9846
x-xss-protection
1; mode=block
server
cafe
etag
5368213822475282120
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 20 Jun 2017 00:41:55 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
70 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/ Frame 603.
24 KB
10 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
fb80487775677e61280ccbce05f36a3d6ce72cb2df59c58d07c365472d3793d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/js/r20170605/r20110914/activeview/osd_listener.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Tue, 06 Jun 2017 00:41:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
268853
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
9846
x-xss-protection
1; mode=block
server
cafe
etag
5368213822475282120
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 20 Jun 2017 00:41:55 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
70 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
container.html
tpc.googlesyndication.com/safeframe/1-0-8/html/ Frame 603.
0
0

osd_listener.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/ Frame 603.
24 KB
10 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
fb80487775677e61280ccbce05f36a3d6ce72cb2df59c58d07c365472d3793d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/js/r20170605/r20110914/activeview/osd_listener.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Tue, 06 Jun 2017 00:41:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
268853
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
9846
x-xss-protection
1; mode=block
server
cafe
etag
5368213822475282120
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 20 Jun 2017 00:41:55 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
70 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
container.html
tpc.googlesyndication.com/safeframe/1-0-8/html/ Frame 603.
0
0

infeed.min.js
cdn.bttrack.com/js/infeed/1.1/20bc0442-8bec-43f8-9992-08be6e6a3591/31850205/ Frame 603.
83 KB
31 KB
Script
General
Full URL
https://cdn.bttrack.com/js/infeed/1.1/20bc0442-8bec-43f8-9992-08be6e6a3591/31850205/infeed.min.js?bustframe=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.84.34.90 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-84-34-90.ewr50.r.cloudfront.net
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
b439a395e8449d0f327a74d6f67d903899874fb579f12ed42954935abde9d819

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
cdn.bttrack.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

X-ServerName
NATIVE01
Date
Thu, 08 Jun 2017 13:56:10 GMT
Content-Encoding
gzip
X-AspNet-Version
4.0.30319
Age
48397
X-Powered-By
ASP.NET
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
P3P
policyref="http://www.bidtellect.com/w3c/p3p.xml", CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Connection
keep-alive
X-AspNetMvc-Version
5.2
Server
Microsoft-IIS/8.5
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Via
1.1 7fa7088cca668218fbd8b325f55fba9b.cloudfront.net (CloudFront)
Cache-Control
private
X-Amz-Cf-Id
rRf67IDjHM-2byH_NCalkHUudREUJfEeaomedWoKkb2jdSZ6UWZPMg==
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/ Frame 603.
0
0

moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
70 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
31850205
bttrack.com/Pixel/Check/ Frame 603.
35 B
35 B
Image
General
Full URL
http://bttrack.com/Pixel/Check/31850205?438440700
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Server
192.132.33.27 , United States, ASN18568 (BIDTELLECT - Bidtellect Inc., US),
Reverse DNS
Software
Microsoft-IIS/8.5 /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
bttrack.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

X-ServerName
NLB1
Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:47 GMT
X-AspNetMvc-Version
5.2
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
P3P
policyref="http://www.bidtellect.com/w3c/p3p.xml", CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Cache-Control
private,no-cache
Content-Type
image/gif
Content-Length
35
Expires
-1
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/ Frame 603.
0
0

moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
70 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/ Frame 603.
24 KB
10 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
fb80487775677e61280ccbce05f36a3d6ce72cb2df59c58d07c365472d3793d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/js/r20170605/r20110914/activeview/osd_listener.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Tue, 06 Jun 2017 00:41:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
268853
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
9846
x-xss-protection
1; mode=block
server
cafe
etag
5368213822475282120
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 20 Jun 2017 00:41:55 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
70 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
format.js
cdn.teads.tv/media/ Frame 603.
93 KB
29 KB
Script
General
Full URL
https://cdn.teads.tv/media/format.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.186.168 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-186-168.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
fecab180f1b65fe9a7426a2ce8c95c83198d0faf2c5c26e2394c150c677476b3

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
cdn.teads.tv
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Mon, 05 Jun 2017 13:44:22 GMT
Server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:0/uname:root/gid:997/mode:33188/mtime:1496667859/atime:1496667869/md5:370061ab0d79b1bd02cb46989579aae8/ctime:1496667859
x-amz-request-id
491646A884C779BF
ETag
"69e1a30e47cc276446814a4d03aad520"
Vary
Accept-Encoding
Content-Type
application/javascript;charset=utf-8
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
29971
x-amz-id-2
QRFycmwCAPa2zaqu5wFX5jRTpvDo1KSBcofkD3zLWuREqj7kuS1R9IEUs1k8LfyRRgQiTFtGxjQ=
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/ Frame 603.
24 KB
10 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
fb80487775677e61280ccbce05f36a3d6ce72cb2df59c58d07c365472d3793d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/js/r20170605/r20110914/activeview/osd_listener.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Tue, 06 Jun 2017 00:41:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
268853
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
9846
x-xss-protection
1; mode=block
server
cafe
etag
5368213822475282120
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 20 Jun 2017 00:41:55 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
70 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/ Frame 603.
24 KB
10 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
fb80487775677e61280ccbce05f36a3d6ce72cb2df59c58d07c365472d3793d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/js/r20170605/r20110914/activeview/osd_listener.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Tue, 06 Jun 2017 00:41:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
268853
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
9846
x-xss-protection
1; mode=block
server
cafe
etag
5368213822475282120
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 20 Jun 2017 00:41:55 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
70 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
adKit.min.js
rev.cbsi.com/common/js/ Frame 603.
6 KB
2 KB
Script
General
Full URL
https://rev.cbsi.com/common/js/adKit.min.js?1021365231
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.246.112 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-246-112.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
576e8bf4510a62d7cdcfedd8b749f3039d0c5aa8b2bdfe2e38a44645e0f982e4

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
rev.cbsi.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Mon, 07 Nov 2016 21:14:51 GMT
Server
Apache
ETag
"61acd092be7016e54f2dac81f3076225:1478553291"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2158
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/ Frame 603.
24 KB
10 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
fb80487775677e61280ccbce05f36a3d6ce72cb2df59c58d07c365472d3793d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/js/r20170605/r20110914/activeview/osd_listener.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Tue, 06 Jun 2017 00:41:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
268853
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
9846
x-xss-protection
1; mode=block
server
cafe
etag
5368213822475282120
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 20 Jun 2017 00:41:55 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
70 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
view
securepubads.g.doubleclick.net/pcs/ Frame 603.
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv3woqx7a6QbPeZEQUoumMVqMy2LwHqlJIF3O1Qc8NA-lcqi0xrrtVg-QzkcOAOMJC5PbLC_0NabDzUnMzyNZTFlCTBhKvCmoHtoA_Hrra7XoEHpU8SSCfgvbTxJeYKvXQHrh85pO99Tc9_59cLpWR3xgF1CIechgOrKAfwuTsImLphDc8xhIkaDeIJ1C6GWAMWZp8kZIRI2ra4a2QT_COeYEP8DPJ4_BTNwG4pemay6xNlcHb5KdgQ&sig=Cg0ArKJSzKa0-y3XwqhZEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pcs/view?xai=AKAOjsv3woqx7a6QbPeZEQUoumMVqMy2LwHqlJIF3O1Qc8NA-lcqi0xrrtVg-QzkcOAOMJC5PbLC_0NabDzUnMzyNZTFlCTBhKvCmoHtoA_Hrra7XoEHpU8SSCfgvbTxJeYKvXQHrh85pO99Tc9_59cLpWR3xgF1CIechgOrKAfwuTsImLphDc8xhIkaDeIJ1C6GWAMWZp8kZIRI2ra4a2QT_COeYEP8DPJ4_BTNwG4pemay6xNlcHb5KdgQ&sig=Cg0ArKJSzKa0-y3XwqhZEAE&urlfix=1&adurl=
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
cookie
test_cookie=CheckForPermission
:scheme
https
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 09 Jun 2017 03:22:48 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
set-cookie
id=22b48009db3e0031||t=1496978568|et=730|cs=002213fd4862cd4b5a8f28709a; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/; domain=.doubleclick.net test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT IDE=AHWqTUk6a-yaRWaStmjmfiExFPK44zgstd-SSB9KlJdK3nakMYpxacRGyA; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/; domain=.doubleclick.net; HttpOnly
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 09 Jun 2017 03:22:48 GMT
img;p=11087208027914;a=11087207966804;idfa=;idfa_lat=;aaid=;aaid_lat=;cache=1098127065
ad.atdmt.com/i/ Frame 603.
42 B
51 B
Image
General
Full URL
https://ad.atdmt.com/i/img;p=11087208027914;a=11087207966804;idfa=;idfa_lat=;aaid=;aaid_lat=;cache=1098127065
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a03:2880:f01c:9:face:b00c:0:1 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Request headers

:path
/i/img;p=11087208027914;a=11087207966804;idfa=;idfa_lat=;aaid=;aaid_lat=;cache=1098127065
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
ad.atdmt.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 09 Jun 2017 03:22:48 GMT
x-atlas-debug
AYJtwMJL4SPE2Hb4WdIXa3W-kRbZdBV1oaXuj8gYCaWqDUKFCp2xeEMNYiCMeuoBfnIhc4xIGkinYdwsWOeijmse
p3p
CP="NOI DSP COR CUR ADM DEV TAIo PSAo PSDo OUR BUS UNI PUR COM NAV INT DEM STA PRE OTC"
status
200
cache-control
private, no-cache, no-store, must-revalidate
set-cookie
ATN=1.1496978568.3453762414841927163.AYIId6r5lFbIbullPRE; expires=Sunday, 09-Jun-2019 03:22:48 GMT; path=/; domain=.atdmt.com; HttpOnly
content-type
image/gif
content-length
42
expires
0
view
securepubads.g.doubleclick.net/pcs/ Frame 603.
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsut7zY3FhwRGMiDDScWUiVJ8S-D0Dn1ZmhJOv6puWbFJFCb_OngqBkt9pYm31UVJO1zSEGF6yxVwasbFcDxvno4fNSmwcpGuw0K_rpgPFaN5yWvLF4DGYu2ZQ2gD6yn3hstzw0CLvewxdEdTRgQePuv0AbEbPArgLVLW2HcbBxFa0bVg12yGDT4SLdDZoRXZxogua1ckV12eaWCJ8Br-IWmdZROe8steoox3PCBL6gDSOoYbSZZXuw&sig=Cg0ArKJSzBQSfxV4wAnXEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pcs/view?xai=AKAOjsut7zY3FhwRGMiDDScWUiVJ8S-D0Dn1ZmhJOv6puWbFJFCb_OngqBkt9pYm31UVJO1zSEGF6yxVwasbFcDxvno4fNSmwcpGuw0K_rpgPFaN5yWvLF4DGYu2ZQ2gD6yn3hstzw0CLvewxdEdTRgQePuv0AbEbPArgLVLW2HcbBxFa0bVg12yGDT4SLdDZoRXZxogua1ckV12eaWCJ8Br-IWmdZROe8steoox3PCBL6gDSOoYbSZZXuw&sig=Cg0ArKJSzBQSfxV4wAnXEAE&urlfix=1&adurl=
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
cookie
test_cookie=CheckForPermission
:scheme
https
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 09 Jun 2017 03:22:48 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
set-cookie
id=22a63e0adb3e0026||t=1496978568|et=730|cs=002213fd481b16ee1f4b0f41ef; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/; domain=.doubleclick.net test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT IDE=AHWqTUlB2se_Sh9XdQEG2UJ29TGhkNeDcAhhlsyfi6HJGlku1DOj1-qajA; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/; domain=.doubleclick.net; HttpOnly
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 09 Jun 2017 03:22:48 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 603.
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvYWv5g6HWRM9OERdd4nNXVXNpxBmegobfimWFCg7m7zx2nk8Mb5sceZ84CqvjNANH3OtECsCQqLkHob2oz7qhztTr1rR2-KY59VqZdkOv-kXcYTwZXCJuGL9iwcQKKE-R4ayjJ9mfOnp5OYaMd4ln_Eo_AWKcu9e11x8-AXpgUOM9gK1hBKGsOalKXUsaL5rmiMhbZsXV-ANHLL7O28Pd8Ul2jEEQdFadZNI0t2feElA4QfRKS77o&sig=Cg0ArKJSzCNqlfCW2TTxEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pcs/view?xai=AKAOjsvYWv5g6HWRM9OERdd4nNXVXNpxBmegobfimWFCg7m7zx2nk8Mb5sceZ84CqvjNANH3OtECsCQqLkHob2oz7qhztTr1rR2-KY59VqZdkOv-kXcYTwZXCJuGL9iwcQKKE-R4ayjJ9mfOnp5OYaMd4ln_Eo_AWKcu9e11x8-AXpgUOM9gK1hBKGsOalKXUsaL5rmiMhbZsXV-ANHLL7O28Pd8Ul2jEEQdFadZNI0t2feElA4QfRKS77o&sig=Cg0ArKJSzCNqlfCW2TTxEAE&urlfix=1&adurl=
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
cookie
test_cookie=CheckForPermission
:scheme
https
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 09 Jun 2017 03:22:48 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
set-cookie
id=22b2050cdb3e0036||t=1496978568|et=730|cs=002213fd48ad9972c7db34902a; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/; domain=.doubleclick.net test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT IDE=AHWqTUn8X6f801whIs4Y6-nA6U1Az6bSaTLUpPWfCm3Kx8lfJset08YgvA; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/; domain=.doubleclick.net; HttpOnly
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 09 Jun 2017 03:22:48 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 603.
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstsOqiOM1msTPjkWCoObyatNX1fFu4JcIF63cAGOA-j8KOLTX9geniyHUzMqnuSH3RIZOneqtPb1t74b7Pp2MWVgRSoYQ4ME-mPnfPYNRdcTCybl1SSgOHtHpkNBk32D5E9WXbrl99O4iKXiS1UH6vNABsPjj0nWxkXdMT1uiGI--NwopkhBfC61GdtIxZnSfz8EqZu9JD8R3sUPxahtQ7xJyyBvDureLVH05NxMVEojDTcJH3S5g&sig=Cg0ArKJSzH-xdLI4et60EAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pcs/view?xai=AKAOjstsOqiOM1msTPjkWCoObyatNX1fFu4JcIF63cAGOA-j8KOLTX9geniyHUzMqnuSH3RIZOneqtPb1t74b7Pp2MWVgRSoYQ4ME-mPnfPYNRdcTCybl1SSgOHtHpkNBk32D5E9WXbrl99O4iKXiS1UH6vNABsPjj0nWxkXdMT1uiGI--NwopkhBfC61GdtIxZnSfz8EqZu9JD8R3sUPxahtQ7xJyyBvDureLVH05NxMVEojDTcJH3S5g&sig=Cg0ArKJSzH-xdLI4et60EAE&urlfix=1&adurl=
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
cookie
test_cookie=CheckForPermission
:scheme
https
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 09 Jun 2017 03:22:48 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
set-cookie
id=225be409db3e000a||t=1496978568|et=730|cs=002213fd4883bf4ccfacb8e175; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/; domain=.doubleclick.net test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT IDE=AHWqTUkuGUcyVMqXQXQ_0d97BIGEbED3YVzDWjaNRE_A4RrmEcWGf6QqcQ; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/; domain=.doubleclick.net; HttpOnly
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 09 Jun 2017 03:22:48 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 603.
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvcpsee2Lp2W7ExuucuJ8fOV9cb6Qj7eZO510xzdWlpo_nGd5Dkbe4BAdEqvHSWRdBgH8USNfYgf9iy-6XBz0kcwL6tcoGhQlMDx3xE4SXp8C6EqKHsFu7l9xSCHkt96VqkPEPqTGnoZut34yb1O6_fXNnf6i3c4R_dy_ZJBHji6m9Qx2C7UMqOq7pDMfI4ZS0hM80GjNHpHzOidP_U9XFN7B9suFzgFxje4nHz9BsFPgNiazGvMog&sig=Cg0ArKJSzI5GR6o6fbclEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pcs/view?xai=AKAOjsvcpsee2Lp2W7ExuucuJ8fOV9cb6Qj7eZO510xzdWlpo_nGd5Dkbe4BAdEqvHSWRdBgH8USNfYgf9iy-6XBz0kcwL6tcoGhQlMDx3xE4SXp8C6EqKHsFu7l9xSCHkt96VqkPEPqTGnoZut34yb1O6_fXNnf6i3c4R_dy_ZJBHji6m9Qx2C7UMqOq7pDMfI4ZS0hM80GjNHpHzOidP_U9XFN7B9suFzgFxje4nHz9BsFPgNiazGvMog&sig=Cg0ArKJSzI5GR6o6fbclEAE&urlfix=1&adurl=
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
cookie
test_cookie=CheckForPermission
:scheme
https
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 09 Jun 2017 03:22:48 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
set-cookie
id=22c1810adb3e0098||t=1496978568|et=730|cs=002213fd486bc40c2b72564fa7; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/; domain=.doubleclick.net test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT IDE=AHWqTUkqsFBa0A8MrtNvcin9wAMc3jHCmYjjBdpM-27qvp6DKF6oVu2WaA; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/; domain=.doubleclick.net; HttpOnly
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 09 Jun 2017 03:22:48 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 603.
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsueGxzFKrgoBFuhbo84mLCE5o7q74B1-TP-uNeloJrW5BmbsdwUXvwaCzJgAVuUKs9OGv4lJaPq9UYmMAw7IumMFzJuIqwCQe1uslj5i48j6EId6PguM71JPwplR74g-eT7zNWrVz3Yo_5prZCJMmk_ce4PXgMV5Q20us7it9PJWzcgZVcC863e49CfYE-G1ZnVQO-DLKY2tZWQwhHWT_LC_vmYG7-e5CpQa7bgdtkRS1mZNlV8xM9v&sig=Cg0ArKJSzOge47HpT4K8EAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pcs/view?xai=AKAOjsueGxzFKrgoBFuhbo84mLCE5o7q74B1-TP-uNeloJrW5BmbsdwUXvwaCzJgAVuUKs9OGv4lJaPq9UYmMAw7IumMFzJuIqwCQe1uslj5i48j6EId6PguM71JPwplR74g-eT7zNWrVz3Yo_5prZCJMmk_ce4PXgMV5Q20us7it9PJWzcgZVcC863e49CfYE-G1ZnVQO-DLKY2tZWQwhHWT_LC_vmYG7-e5CpQa7bgdtkRS1mZNlV8xM9v&sig=Cg0ArKJSzOge47HpT4K8EAE&urlfix=1&adurl=
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
cookie
test_cookie=CheckForPermission
:scheme
https
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 09 Jun 2017 03:22:48 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
set-cookie
id=22f2a50bdb3e00fa||t=1496978568|et=730|cs=002213fd48f4f282e1e8e26553; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/; domain=.doubleclick.net test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT IDE=AHWqTUl7zbUiStH9IzxlRG2LPFmnniHEwgdCS4y4jlpQRWwdeCnRsUSkug; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/; domain=.doubleclick.net; HttpOnly
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 09 Jun 2017 03:22:48 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 603.
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstUIdTSeYWcTjwLhxeGg86LYcalp6ck46Qe3PkcWHJl4CntizpC6zYjFL27Hqaqqy9YOryAqs81BhV3uJ81TXUKlUhThcOv3oFZOH-NGrUkksImZg27VTH9aEkcTlwUjUnbMDBt1GlG-I11VdTT83omsDOvtUuS4IbebB8TgZVbmaabALcWYAojqEcTMbu1fa9Xcei5ZmroMGntE7bBm7e-7Ag7SVNqIk9HuOBrRU0SYIjM3FYg0Z2L&sig=Cg0ArKJSzI6fMazcfW-vEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pcs/view?xai=AKAOjstUIdTSeYWcTjwLhxeGg86LYcalp6ck46Qe3PkcWHJl4CntizpC6zYjFL27Hqaqqy9YOryAqs81BhV3uJ81TXUKlUhThcOv3oFZOH-NGrUkksImZg27VTH9aEkcTlwUjUnbMDBt1GlG-I11VdTT83omsDOvtUuS4IbebB8TgZVbmaabALcWYAojqEcTMbu1fa9Xcei5ZmroMGntE7bBm7e-7Ag7SVNqIk9HuOBrRU0SYIjM3FYg0Z2L&sig=Cg0ArKJSzI6fMazcfW-vEAE&urlfix=1&adurl=
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
cookie
test_cookie=CheckForPermission
:scheme
https
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 09 Jun 2017 03:22:48 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
set-cookie
id=22e7d90adb3e006a||t=1496978568|et=730|cs=002213fd48081d46ff0964919c; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/; domain=.doubleclick.net test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT IDE=AHWqTUmrObin9o6UinWND0tIq11BFx89Z_gv_BYkWCXLppS9gcHtE_MjOg; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/; domain=.doubleclick.net; HttpOnly
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 09 Jun 2017 03:22:48 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 603.
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst3x796QwnZqAv37Sm-p8RXuDSOODh6_GMwa_7OUHkDvzIgHLtNLD65wreB0c6fxeCre1RR4B6kjGxcsLriZQEFqK-tZ-f1scK3e3pGVyoxAsNJ6omtg3pK5PI9gyw1ii_4Ra-LzIaDLlaKZp7JqhDwF4b2TZORsKWZAJvYu6HD8HvBvMo-uq-UwG-fodVETMoN55THgtNhMbWFZLu80eohtbOFZXqBWwytJVLHgUfxbVB9jyk&sig=Cg0ArKJSzIu6v73m9syXEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pcs/view?xai=AKAOjst3x796QwnZqAv37Sm-p8RXuDSOODh6_GMwa_7OUHkDvzIgHLtNLD65wreB0c6fxeCre1RR4B6kjGxcsLriZQEFqK-tZ-f1scK3e3pGVyoxAsNJ6omtg3pK5PI9gyw1ii_4Ra-LzIaDLlaKZp7JqhDwF4b2TZORsKWZAJvYu6HD8HvBvMo-uq-UwG-fodVETMoN55THgtNhMbWFZLu80eohtbOFZXqBWwytJVLHgUfxbVB9jyk&sig=Cg0ArKJSzIu6v73m9syXEAE&urlfix=1&adurl=
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
cookie
test_cookie=CheckForPermission
:scheme
https
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 09 Jun 2017 03:22:48 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
set-cookie
id=22a9530bdb3e004a||t=1496978568|et=730|cs=002213fd484a444d7e0490c638; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/; domain=.doubleclick.net test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT IDE=AHWqTUkPQPOVAWj-Pp7cKjvlXybI1aIWH-_ZPHAUqMFc48IlM0jo7oAgxg; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/; domain=.doubleclick.net; HttpOnly
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 09 Jun 2017 03:22:48 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 603.
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssy-h9LrSbuVi3XJqoEnvvurH-bsjZy5ZMw9vscsQ2T7M9tzSOvskuCqxnlP2e5qBM2seSaRfIyBF3ZXsSs5X6RBp4Dg0UztPzJud5xWCEy9Wz40yVMTCXSX9Jcb4127eOgswAxka8kDszEwQqd1qKQy-GEsMgLpuPYUIj6CdESZ3lYvdkISXk92vouyN83nDbD7FYWBV317m9OsZzRfgAAZjBn3h2M2_74SKul1SHC0TT3KgSxSPt1&sig=Cg0ArKJSzA6-DkHre4pTEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pcs/view?xai=AKAOjssy-h9LrSbuVi3XJqoEnvvurH-bsjZy5ZMw9vscsQ2T7M9tzSOvskuCqxnlP2e5qBM2seSaRfIyBF3ZXsSs5X6RBp4Dg0UztPzJud5xWCEy9Wz40yVMTCXSX9Jcb4127eOgswAxka8kDszEwQqd1qKQy-GEsMgLpuPYUIj6CdESZ3lYvdkISXk92vouyN83nDbD7FYWBV317m9OsZzRfgAAZjBn3h2M2_74SKul1SHC0TT3KgSxSPt1&sig=Cg0ArKJSzA6-DkHre4pTEAE&urlfix=1&adurl=
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
cookie
test_cookie=CheckForPermission
:scheme
https
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 09 Jun 2017 03:22:48 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
set-cookie
id=22989d09db3e00ad||t=1496978568|et=730|cs=002213fd4809f8b2ba1c8412df; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/; domain=.doubleclick.net test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT IDE=AHWqTUmc2-Xkh4DlLLEXk5jnub3y1w7HowJ9p9k7je4YVipQA0YLbM_FIQ; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/; domain=.doubleclick.net; HttpOnly
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 09 Jun 2017 03:22:48 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 603.
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss0PHI2W92XclUY5hApMDvcA8_NyL9YDSJIhUX-OOJ08KKb-LKpmdXgtQVzetCKgMrr4BOFr2ZuCOV9S9oGmEbOwZufpnUiZt_j5F_N7c9N1UOAtjeYGLAnaVMlvwK-rX7pq6phBKyllcT46zB0ATcobxxL7oimEypGKteW-KEh-T0iDCl3FJSojW_CGKu-dAjgphRflhHqZG6zTV1ovMfwyJD4mMCvMkCAgaODFTT-Afr-WriAbBg&sig=Cg0ArKJSzFWbYPyFRB7oEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pcs/view?xai=AKAOjss0PHI2W92XclUY5hApMDvcA8_NyL9YDSJIhUX-OOJ08KKb-LKpmdXgtQVzetCKgMrr4BOFr2ZuCOV9S9oGmEbOwZufpnUiZt_j5F_N7c9N1UOAtjeYGLAnaVMlvwK-rX7pq6phBKyllcT46zB0ATcobxxL7oimEypGKteW-KEh-T0iDCl3FJSojW_CGKu-dAjgphRflhHqZG6zTV1ovMfwyJD4mMCvMkCAgaODFTT-Afr-WriAbBg&sig=Cg0ArKJSzFWbYPyFRB7oEAE&urlfix=1&adurl=
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
cookie
test_cookie=CheckForPermission
:scheme
https
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 09 Jun 2017 03:22:48 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
set-cookie
id=2237a90adb3e00ba||t=1496978568|et=730|cs=002213fd486761c29bf264fb5c; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/; domain=.doubleclick.net test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT IDE=AHWqTUmbyIMwwK2GQeDJdWifsKHZLEO9LVneI6TQ_-GepNedDcsspMWeNA; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/; domain=.doubleclick.net; HttpOnly
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 09 Jun 2017 03:22:48 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
70 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
70 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
70 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
70 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
70 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
70 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
70 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
70 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
70 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
Cookie set id
dpm.demdex.net/
2 KB
730 B
Script
General
Full URL
http://dpm.demdex.net/id?d_visid_ver=1.5.6&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&d_mid=82019002344760642192159551723785266833&d_blob=cIBAx_aQzFEHcPoEv0GwcQ&d_cid_ic=AVID%012C9D0A4405312D21-600001008000086D&d_cb=s_c_il%5B2%5D._setAudienceManagerFields
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=201703281836
Protocol
HTTP/1.1
Server
52.48.142.133 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-48-142-133.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
8cfad77917fa7711f25b846dbb579a95e57970d90261770863e8ce130c5eb17b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dpm.demdex.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

DCS
irl1-prod-dcs-7ce205ea.edge-irl1.demdex.com 5.11.1.20170606140807 5ms
Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
X-TID
rm+fHgK9TRc=
Vary
Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Set-Cookie
demdex=35714883694003665103108200718919644587;Path=/;Domain=.demdex.net;Expires=Wed, 06-Dec-2017 03:22:48 GMT
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
transfer-encoding
chunked
Connection
keep-alive
Content-Type
application/javascript; charset=UTF-8
Expires
Thu, 01 Jan 2009 00:00:00 GMT
truncated
/ Frame 603.
211 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cf660310e240e7704bced856c6e0fd7ac17d46ae733cd7707a6abdbba33dfe8f

Request headers

Response headers

n.js
geo.moatads.com/ Frame 603.
78 B
78 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=0&ue=0&uu=0&qm=0&qn=6OZw%3DoHB%2CEF%3FKC1I%3Cq.bWoCSV2W0Su*TDXlCfX2iR2%25(GyHN%3DI(%2C%3Ba15lK1t!9Zp%7Bl.I6%3DT103etW6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo8rY2baurI!tzm!jVSn%3CV%3CTZ8!J%3BatASYUby%3D(tN%23V.x1.qUD%60aFjL%2FX%252%3B(OC)Lp%22%3Fj3VYUex8k%40%22%7Cu7pRB%5Bz%26(K%2BxP%25l7g%26kyM8F4%2BKCCRP)Et%5B%40(X%7C01%5B_)vVS%2F%2F.hX%3Dt%3C!T%5D%3DNMV8t8fvb%26%225gRo%2BG%22IQ3qC%60I4%3CeZl%5DM%3ArRaxDmPN0%2FdEGm(tVDU%3CVZvoJU4b6W%3AGHBx%3Df%5E7j%22R%5EIc%2CDT%24F%26(%26u3Rs%3C%5ECPR9%6013s%40.Y_hmP%3BgsJ%24Ym%24%2FjkkeL07ta_*JRLRV%3BO5FN6tRAlTJ%3F_v%3D(tN%23V.xm9%25KMD4YP%60T11K%3E(7b%5DQ%22_KF5%5D5%2F%5BGI%3F4Y_hO%3Dn%3CG.3pG%24cz98Zpe4tE0b15%7CQjw%60.%7Bi%24J)%2C4i8ocS!%5BFZKU37B%2BMm1TVGX%5E8Y.NI%22mCN&qp=10000&qq=000001100000&qr=0&gz=0&hh=0&hn=0&qt=0&i=CBSDFPCW2&hp=1&zMoatPS=top&zMoatSECT=Section%20Not%20Defined&zMoatPT=article&zMoatFT=Not%20Specified&zMoatW=980&zMoatH=45&zMoatVGUID=93e230e0-1346-4244-983d-5885f92e829c&zMoatSN=a&zMoatAID=Value%20Not%20Defined&zMoatIMP=Value%20Not%20Defined&zMoatCP=Value%20Not%20Defined&zMoatAType=content_article&zMoatTest=zdnet&cm=14&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&bq=0&f=0&j=&o=3&t=1496978568298&de=720493403899&m=0&ar=c7fbce5-clean&q=2&cb=0&cu=1496978568298&ll=2&lm=0&ln=1&r=25.0.0&em=0&en=1&d=29759169%3A148224849%3A166050729%3A43583969169&qs=1&zGSRC=1&gu=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&bo=23586489&bp=23600769&bd=top&dfp=0%2C1&la=23600769&zMoatNotCnet=true&zMoatSZ=980x45&zMoatSZPS=980x45%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&fd=1&ac=1&it=500&fs=116135&na=450474908&cs=0&callback=MoatSuperV24.gna142257
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.198.184.115 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-198-184-115.compute-1.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash
4f22a9c52f1baca3dfa041a6d09206be845ba4ed692db2ab42a3ab0364fa8392

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
geo.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
nginx/1.7.9
Connection
keep-alive
Content-Length
78
Content-Type
text/html; charset=UTF-8
Cookie set a.js
stats.pagefair.com/stats/page_view_event/3393B7A52D1447DD/
25 B
25 B
XHR
General
Full URL
http://stats.pagefair.com/stats/page_view_event/3393B7A52D1447DD/a.js?wl_div_hid_t0=0&div_hid_t0=0&s_blk=0&wl_i_blk=0&i_blk=0&is_ab=0&is_wl=1&new_monthly=1&new_daily=1&_=1496978568348
Requested by
Host: zdnet3.cbsistatic.com
URL: http://zdnet3.cbsistatic.com/fly/883-fly/js/main.default.js
Protocol
HTTP/1.1
Server
52.203.183.164 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-203-183-164.compute-1.amazonaws.com
Software
nginx /
Resource Hash
2671d72b96d6d9a1b8bbc1429048505ea6dbc3514daf22ab6dd6dfc8a70ce8d3

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
stats.pagefair.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
text/plain, */*; q=0.01
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Accept
text/plain, */*; q=0.01
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
P3P
CP="NID DSP ALL COR"
Access-Control-Allow-Origin
http://www.zdnet.com
Set-Cookie
m_uniq=True; Domain=.pagefair.com; expires=Fri, 30-Jun-2017 23:59:58 GMT; Max-Age=1888630; Path=/ d_uniq=True; Domain=.pagefair.com; expires=Fri, 09-Jun-2017 23:59:58 GMT; Max-Age=74230; Path=/
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript
Access-Control-Allow-Headers
Authorization,Content-Type,Accept,Origin,User-Agent,Cache-Control,Keep-Alive,X-Requested-With,If-Modified-Since,X-CSRF-TOKEN
Content-Length
25
analytics.js
www.google-analytics.com/
Redirect Chain
  • http://www.google-analytics.com/analytics.js
  • https://www.google-analytics.com/analytics.js
29 KB
12 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::200e , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
Golfe2 /
Resource Hash
21a8144e29cf2f60d7361fa7bd962e302b324573faecadeb4992e450954b532d
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

:path
/analytics.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.google-analytics.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 31 May 2017 23:40:38 GMT
server
Golfe2
age
413
date
Fri, 09 Jun 2017 03:15:55 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
12349
expires
Fri, 09 Jun 2017 05:15:55 GMT

Redirect headers

Location
https://www.google-analytics.com/analytics.js
Non-Authoritative-Reason
HSTS
beacon.js
b.scorecardresearch.com/
1 KB
901 B
Script
General
Full URL
http://b.scorecardresearch.com/beacon.js
Requested by
Host: widget.perfectmarket.com
URL: http://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
HTTP/1.1
Server
95.100.248.105 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-100-248-105.deploy.akamaitechnologies.com
Software
/
Resource Hash
d0fd74148f4cbe78bd0e6328dc5ce5955f0a0ecdb1eb2919da4a7e596ac65912

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
b.scorecardresearch.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
UID=18B95a100248101b79f8a3g1496978568; UIDR=1496978568
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=1209600
Connection
keep-alive
Content-Length
901
Expires
Fri, 23 Jun 2017 03:22:48 GMT
truncated
/ Frame 603.
209 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
89fa2ea2afae7159dced7d2806ff0a7c5bb7398ade6240dcd2a02e0b5eb47cec

Request headers

Response headers

n.js
geo.moatads.com/ Frame 603.
78 B
78 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=0&ue=0&uu=0&qm=0&qn=6OZw%3DoHB%2CEF%3FKC1I%3Cq.bWoCSV2W0Su*TDXlCfX2iR2%25(GyHN%3DI(%2C%3Ba15lK1t!9Zp%7Bl.I6%3DT103etW6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo8rY2baurI!tzm!jVSn%3CV%3CTZ8!J%3BatASYUby%3D(tN%23V.x1.qUD%60aFjL%2FX%252%3B(OC)Lp%22%3Fj3VYUex8k%40%22%7Cu7pRB%5Bz%26(K%2BxP%25l7g%26kyM8F4%2BKCCRP)Et%5B%40(X%7C01%5B_)vVS%2F%2F.hX%3Dt%3C!T%5D%3DNMV8t8fvb%26%225gRo%2BG%22IQ3qC%60I4%3CeZl%5DM%3ArRaxDmPN0%2FdEGm(tVDU%3CVZvoJU4b6W%3AGHBx%3Df%5E7j%22R%5EIc%2CDT%24F%26(%26u3Rs%3C%5ECPR9%6013s%40.Y_hmP%3BgsJ%24Ym%24%2FjkkeL07ta_*JRLRV%3BO5FN6tRAlTJ%3F_v%3D(tN%23V.xm9%25KMD4YP%60T11K%3E(7b%5DQ%22_KF5%5D5%2F%5BGI%3F4Y_hO%3Dn%3CG.3pG%24cz98Zpe4tE0b15%7CQjw%60.%7Bi%24J)%2C4i8ocS!%5BFZKU37B%2BMm1TVGX%5E8Y.NI%22mCN&qp=10000&qq=000001100000&qr=0&gz=0&hh=0&hn=0&qt=0&i=CBSDFPCW2&hp=1&zMoatPS=top&zMoatSECT=Section%20Not%20Defined&zMoatPT=article&zMoatFT=Not%20Specified&zMoatW=401&zMoatH=11&zMoatVGUID=93e230e0-1346-4244-983d-5885f92e829c&zMoatSN=a&zMoatAID=Value%20Not%20Defined&zMoatIMP=Value%20Not%20Defined&zMoatCP=Value%20Not%20Defined&zMoatAType=content_article&zMoatTest=zdnet&cm=12&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&bq=0&f=0&j=&o=3&t=1496978568405&de=869138756128&m=0&ar=c7fbce5-clean&q=6&cb=0&cu=1496978568405&ll=2&lm=0&ln=1&r=25.0.0&em=0&en=1&d=29759169%3A148224849%3A166050969%3A43583970849&qs=1&zGSRC=1&gu=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&bo=23586489&bp=23600769&bd=top&dfp=0%2C1&la=23600769&zMoatNotCnet=true&zMoatSZ=401x11&zMoatSZPS=401x11%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&fd=1&ac=1&it=500&fs=116135&na=1996971892&cs=0&callback=MoatSuperV24.gna907375
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.86.159.215 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-159-215.compute-1.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash
a75f8c822d3d0e6d621ce24a5e059d2f18be39eab454591889cffcc65da5fe87

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
geo.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
nginx/1.7.9
Connection
keep-alive
Content-Length
78
Content-Type
text/html; charset=UTF-8
truncated
/ Frame 603.
214 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e5b3ecb9fe86f37f7f3c5a95b350d24e5504bd426f53ac7a64287c39f53f9c3a

Request headers

Response headers

n.js
geo.moatads.com/ Frame 603.
79 B
79 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=0&ue=0&uu=0&qm=0&qn=6OZw%3DoHB%2CEF%3FKC1I%3Cq.bWoCSV2W0Su*TDXlCfX2iR2%25(GyHN%3DI(%2C%3Ba15lK1t!9Zp%7Bl.I6%3DT103etW6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo8rY2baurI!tzm!jVSn%3CV%3CTZ8!J%3BatASYUby%3D(tN%23V.x1.qUD%60aFjL%2FX%252%3B(OC)Lp%22%3Fj3VYUex8k%40%22%7Cu7pRB%5Bz%26(K%2BxP%25l7g%26kyM8F4%2BKCCRP)Et%5B%40(X%7C01%5B_)vVS%2F%2F.hX%3Dt%3C!T%5D%3DNMV8t8fvb%26%225gRo%2BG%22IQ3qC%60I4%3CeZl%5DM%3ArRaxDmPN0%2FdEGm(tVDU%3CVZvoJU4b6W%3AGHBx%3Df%5E7j%22R%5EIc%2CDT%24F%26(%26u3Rs%3C%5ECPR9%6013s%40.Y_hmP%3BgsJ%24Ym%24%2FjkkeL07ta_*JRLRV%3BO5FN6tRAlTJ%3F_v%3D(tN%23V.xm9%25KMD4YP%60T11K%3E(7b%5DQ%22_KF5%5D5%2F%5BGI%3F4Y_hO%3Dn%3CG.3pG%24cz98Zpe4tE0b15%7CQjw%60.%7Bi%24J)%2C4i8ocS!%5BFZKU37B%2BMm1TVGX%5E8Y.NI%22mCN&qp=10000&qq=000001100000&qr=0&gz=0&hh=0&hn=0&qt=0&i=CBSDFPCW2&hp=1&zMoatPS=top&zMoatSECT=Section%20Not%20Defined&zMoatPT=article&zMoatFT=Not%20Specified&zMoatW=11&zMoatH=11&zMoatVGUID=93e230e0-1346-4244-983d-5885f92e829c&zMoatSN=a&zMoatAID=Value%20Not%20Defined&zMoatIMP=Value%20Not%20Defined&zMoatCP=Value%20Not%20Defined&zMoatAType=content_article&zMoatTest=zdnet&cm=23&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&bq=0&f=0&j=&o=3&t=1496978568429&de=247638995352&m=0&ar=c7fbce5-clean&q=10&cb=0&cu=1496978568429&ll=2&lm=0&ln=1&r=25.0.0&em=0&en=1&d=64478409%3A340900209%3A246996849%3A79555432089&qs=1&zGSRC=1&gu=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&bo=23586489&bp=23600769&bd=top&dfp=0%2C1&la=23600769&zMoatNotCnet=true&zMoatSZ=11x11&zMoatSZPS=11x11%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&fd=1&ac=1&it=500&fs=116135&na=2094308000&cs=0&callback=MoatSuperV24.gna299714
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.196.245.179 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-196-245-179.compute-1.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash
3d5819dcf4319ac59a25f43c4e800cd94b3d7d01b2e94fc04bea62ea65956620

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
geo.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
nginx/1.7.9
Connection
keep-alive
Content-Length
79
Content-Type
text/html; charset=UTF-8
truncated
/ Frame 603.
208 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4c86666729bdcffa8e50b6cb524856726cf0e63b4d11b9e2d25794b754a79356

Request headers

Response headers

n.js
geo.moatads.com/ Frame 603.
78 B
78 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=0&ue=0&uu=0&qm=0&qn=6OZw%3DoHB%2CEF%3FKC1I%3Cq.bWoCSV2W0Su*TDXlCfX2iR2%25(GyHN%3DI(%2C%3Ba15lK1t!9Zp%7Bl.I6%3DT103etW6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo8rY2baurI!tzm!jVSn%3CV%3CTZ8!J%3BatASYUby%3D(tN%23V.x1.qUD%60aFjL%2FX%252%3B(OC)Lp%22%3Fj3VYUex8k%40%22%7Cu7pRB%5Bz%26(K%2BxP%25l7g%26kyM8F4%2BKCCRP)Et%5B%40(X%7C01%5B_)vVS%2F%2F.hX%3Dt%3C!T%5D%3DNMV8t8fvb%26%225gRo%2BG%22IQ3qC%60I4%3CeZl%5DM%3ArRaxDmPN0%2FdEGm(tVDU%3CVZvoJU4b6W%3AGHBx%3Df%5E7j%22R%5EIc%2CDT%24F%26(%26u3Rs%3C%5ECPR9%6013s%40.Y_hmP%3BgsJ%24Ym%24%2FjkkeL07ta_*JRLRV%3BO5FN6tRAlTJ%3F_v%3D(tN%23V.xm9%25KMD4YP%60T11K%3E(7b%5DQ%22_KF5%5D5%2F%5BGI%3F4Y_hO%3Dn%3CG.3pG%24cz98Zpe4tE0b15%7CQjw%60.%7Bi%24J)%2C4i8ocS!%5BFZKU37B%2BMm1TVGX%5E8Y.NI%22mCN&qp=10000&qq=000001100000&qr=0&gz=0&hh=0&hn=0&qt=0&i=CBSDFPCW2&hp=1&zMoatPS=middle&zMoatSECT=Section%20Not%20Defined&zMoatPT=article&zMoatFT=Not%20Specified&zMoatW=300&zMoatH=250&zMoatVGUID=93e230e0-1346-4244-983d-5885f92e829c&zMoatSN=a&zMoatAID=Value%20Not%20Defined&zMoatIMP=Value%20Not%20Defined&zMoatCP=Value%20Not%20Defined&zMoatAType=content_article&zMoatTest=zdnet&cm=11&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&bq=0&f=0&j=&o=3&t=1496978568456&de=47425658186&m=0&ar=c7fbce5-clean&q=14&cb=0&cu=1496978568456&ll=2&lm=0&ln=1&r=25.0.0&em=0&en=1&d=55040169%3A484753449%3A500296089%3A120027819609&qs=1&zGSRC=1&gu=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&bo=23586489&bp=23600769&bd=middle&dfp=0%2C1&la=23600769&zMoatNotCnet=true&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20middle&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&fd=1&ac=1&it=500&fs=116135&na=592321997&cs=0&callback=MoatSuperV24.gna770175
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.199.132.64 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-199-132-64.compute-1.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash
7f771e8ef93cae707e7884535c864a92f2241eebd5bcd8e7e5ff69c4d9f2a4b3

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
geo.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
nginx/1.7.9
Connection
keep-alive
Content-Length
78
Content-Type
text/html; charset=UTF-8
truncated
/ Frame 603.
211 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
64826792ac5d95d95d51f7b9fedba4c74240816ebdc48ff5e481b905ffd40498

Request headers

Response headers

n.js
geo.moatads.com/ Frame 603.
79 B
79 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=0&ue=0&uu=0&qm=0&qn=6OZw%3DoHB%2CEF%3FKC1I%3Cq.bWoCSV2W0Su*TDXlCfX2iR2%25(GyHN%3DI(%2C%3Ba15lK1t!9Zp%7Bl.I6%3DT103etW6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo8rY2baurI!tzm!jVSn%3CV%3CTZ8!J%3BatASYUby%3D(tN%23V.x1.qUD%60aFjL%2FX%252%3B(OC)Lp%22%3Fj3VYUex8k%40%22%7Cu7pRB%5Bz%26(K%2BxP%25l7g%26kyM8F4%2BKCCRP)Et%5B%40(X%7C01%5B_)vVS%2F%2F.hX%3Dt%3C!T%5D%3DNMV8t8fvb%26%225gRo%2BG%22IQ3qC%60I4%3CeZl%5DM%3ArRaxDmPN0%2FdEGm(tVDU%3CVZvoJU4b6W%3AGHBx%3Df%5E7j%22R%5EIc%2CDT%24F%26(%26u3Rs%3C%5ECPR9%6013s%40.Y_hmP%3BgsJ%24Ym%24%2FjkkeL07ta_*JRLRV%3BO5FN6tRAlTJ%3F_v%3D(tN%23V.xm9%25KMD4YP%60T11K%3E(7b%5DQ%22_KF5%5D5%2F%5BGI%3F4Y_hO%3Dn%3CG.3pG%24cz98Zpe4tE0b15%7CQjw%60.%7Bi%24J)%2C4i8ocS!%5BFZKU37B%2BMm1TVGX%5E8Y.NI%22mCN&qp=10000&qq=000001100000&qr=0&gz=0&hh=0&hn=0&qt=0&i=CBSDFPCW2&hp=1&zMoatPS=top&zMoatSECT=Section%20Not%20Defined&zMoatPT=article&zMoatFT=Not%20Specified&zMoatW=641&zMoatH=321&zMoatVGUID=93e230e0-1346-4244-983d-5885f92e829c&zMoatSN=a&zMoatAID=Value%20Not%20Defined&zMoatIMP=Value%20Not%20Defined&zMoatCP=Value%20Not%20Defined&zMoatAType=content_article&zMoatTest=zdnet&cm=11&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&bq=0&f=0&j=&o=3&t=1496978568480&de=667088983955&m=0&ar=c7fbce5-clean&q=18&cb=0&cu=1496978568480&ll=2&lm=0&ln=1&r=25.0.0&em=0&en=1&d=29759169%3A148224849%3A245231529%3A120082589289&qs=1&zGSRC=1&gu=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&bo=23586489&bp=23600769&bd=top&dfp=0%2C1&la=23600769&zMoatNotCnet=true&zMoatSZ=641x321&zMoatSZPS=641x321%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&fd=1&ac=1&it=500&fs=116135&na=814998155&cs=0&callback=MoatSuperV24.gna341462
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.86.159.215 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-159-215.compute-1.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash
2af9dc2a580e92ba9fe0fccd715db8520a72069235dd7adefb437d6ed6348103

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
geo.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
nginx/1.7.9
Connection
keep-alive
Content-Length
79
Content-Type
text/html; charset=UTF-8
truncated
/ Frame 603.
208 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0b66df7f0294f95106d32fddf0ef54ba4e5a2eee3f1a4aa4d14e5c3712d38e35

Request headers

Response headers

n.js
geo.moatads.com/ Frame 603.
79 B
79 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=0&ue=0&uu=0&qm=0&qn=6OZw%3DoHB%2CEF%3FKC1I%3Cq.bWoCSV2W0Su*TDXlCfX2iR2%25(GyHN%3DI(%2C%3Ba15lK1t!9Zp%7Bl.I6%3DT103etW6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo8rY2baurI!tzm!jVSn%3CV%3CTZ8!J%3BatASYUby%3D(tN%23V.x1.qUD%60aFjL%2FX%252%3B(OC)Lp%22%3Fj3VYUex8k%40%22%7Cu7pRB%5Bz%26(K%2BxP%25l7g%26kyM8F4%2BKCCRP)Et%5B%40(X%7C01%5B_)vVS%2F%2F.hX%3Dt%3C!T%5D%3DNMV8t8fvb%26%225gRo%2BG%22IQ3qC%60I4%3CeZl%5DM%3ArRaxDmPN0%2FdEGm(tVDU%3CVZvoJU4b6W%3AGHBx%3Df%5E7j%22R%5EIc%2CDT%24F%26(%26u3Rs%3C%5ECPR9%6013s%40.Y_hmP%3BgsJ%24Ym%24%2FjkkeL07ta_*JRLRV%3BO5FN6tRAlTJ%3F_v%3D(tN%23V.xm9%25KMD4YP%60T11K%3E(7b%5DQ%22_KF5%5D5%2F%5BGI%3F4Y_hO%3Dn%3CG.3pG%24cz98Zpe4tE0b15%7CQjw%60.%7Bi%24J)%2C4i8ocS!%5BFZKU37B%2BMm1TVGX%5E8Y.NI%22mCN&qp=10000&qq=000001100000&qr=0&gz=0&hh=0&hn=0&qt=0&i=CBSDFPCW2&hp=1&zMoatPS=bottom&zMoatSECT=Section%20Not%20Defined&zMoatPT=article&zMoatFT=Not%20Specified&zMoatW=728&zMoatH=90&zMoatVGUID=93e230e0-1346-4244-983d-5885f92e829c&zMoatSN=a&zMoatAID=Value%20Not%20Defined&zMoatIMP=Value%20Not%20Defined&zMoatCP=Value%20Not%20Defined&zMoatAType=content_article&zMoatTest=zdnet&cm=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&bq=0&f=0&j=&o=3&t=1496978568504&de=630729657592&m=0&ar=c7fbce5-clean&q=22&cb=0&cu=1496978568504&ll=2&lm=0&ln=1&r=25.0.0&em=0&en=1&d=55040169%3A484753449%3A500296089%3A119960265609&qs=1&zGSRC=1&gu=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&bo=23586489&bp=23600769&bd=bottom&dfp=0%2C1&la=23600769&zMoatNotCnet=true&zMoatSZ=728x90&zMoatSZPS=728x90%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&fd=1&ac=1&it=500&fs=116135&na=480198912&cs=0&callback=MoatSuperV24.gna997975
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.199.132.64 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-199-132-64.compute-1.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash
070734a9198f4d1994ee05f36ccaf0a4af0a94bb5f0a01bbcef5184ef58c17f2

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
geo.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
nginx/1.7.9
Connection
keep-alive
Content-Length
79
Content-Type
text/html; charset=UTF-8
truncated
/ Frame 603.
209 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bd9bb31494cf9e5778ec9844fa065b51e782c8e5b3b156f8e314e1154fe59199

Request headers

Response headers

n.js
geo.moatads.com/ Frame 603.
79 B
79 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=0&ue=0&uu=0&qm=0&qn=6OZw%3DoHB%2CEF%3FKC1I%3Cq.bWoCSV2W0Su*TDXlCfX2iR2%25(GyHN%3DI(%2C%3Ba15lK1t!9Zp%7Bl.I6%3DT103etW6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo8rY2baurI!tzm!jVSn%3CV%3CTZ8!J%3BatASYUby%3D(tN%23V.x1.qUD%60aFjL%2FX%252%3B(OC)Lp%22%3Fj3VYUex8k%40%22%7Cu7pRB%5Bz%26(K%2BxP%25l7g%26kyM8F4%2BKCCRP)Et%5B%40(X%7C01%5B_)vVS%2F%2F.hX%3Dt%3C!T%5D%3DNMV8t8fvb%26%225gRo%2BG%22IQ3qC%60I4%3CeZl%5DM%3ArRaxDmPN0%2FdEGm(tVDU%3CVZvoJU4b6W%3AGHBx%3Df%5E7j%22R%5EIc%2CDT%24F%26(%26u3Rs%3C%5ECPR9%6013s%40.Y_hmP%3BgsJ%24Ym%24%2FjkkeL07ta_*JRLRV%3BO5FN6tRAlTJ%3F_v%3D(tN%23V.xm9%25KMD4YP%60T11K%3E(7b%5DQ%22_KF5%5D5%2F%5BGI%3F4Y_hO%3Dn%3CG.3pG%24cz98Zpe4tE0b15%7CQjw%60.%7Bi%24J)%2C4i8ocS!%5BFZKU37B%2BMm1TVGX%5E8Y.NI%22mCN&qp=10000&qq=000001100000&qr=0&gz=0&hh=0&hn=0&qt=0&i=CBSDFPCW2&hp=1&zMoatPS=top&zMoatSECT=Section%20Not%20Defined&zMoatPT=article&zMoatFT=Not%20Specified&zMoatW=1600&zMoatH=1000&zMoatVGUID=93e230e0-1346-4244-983d-5885f92e829c&zMoatSN=a&zMoatAID=Value%20Not%20Defined&zMoatIMP=Value%20Not%20Defined&zMoatCP=Value%20Not%20Defined&zMoatAType=content_article&zMoatTest=zdnet&cm=9&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&bq=0&f=0&j=&o=3&t=1496978568529&de=581303396522&m=0&ar=c7fbce5-clean&q=26&cb=0&cu=1496978568529&ll=2&lm=0&ln=1&r=25.0.0&em=0&en=1&d=55040169%3A484753449%3A500296089%3A120028132569&qs=1&zGSRC=1&gu=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&bo=23586489&bp=23600769&bd=top&dfp=0%2C1&la=23600769&zMoatNotCnet=true&zMoatSZ=1600x1000&zMoatSZPS=1600x1000%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&fd=1&ac=1&it=500&fs=116135&na=1460906426&cs=0&callback=MoatSuperV24.gna871142
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.198.184.115 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-198-184-115.compute-1.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash
d571c476e3f5b5d9bfab9552be5fe8337f219e06194d8019aa2d5d2ae422af35

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
geo.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
nginx/1.7.9
Connection
keep-alive
Content-Length
79
Content-Type
text/html; charset=UTF-8
gpt.js
www.googletagservices.com/tag/js/ Frame 603.
3 KB
1 KB
Script
General
Full URL
http://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: rev.cbsi.com
URL: https://rev.cbsi.com/common/js/adKit.min.js?1021365231
Protocol
HTTP/1.1
Server
2a00:1450:4001:824::2002 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
b2d4f345ea445291da59ae9025de142ceaaecc64c21fdd203cb4078349db2471
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.googletagservices.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:09:04 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 08 Jun 2017 17:51:05 GMT
Server
sffe
Age
824
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
private, max-age=900, stale-while-revalidate=3600
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
1360
X-XSS-Protection
1; mode=block
Expires
Fri, 09 Jun 2017 03:09:04 GMT
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/ Frame 603.
24 KB
10 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
fb80487775677e61280ccbce05f36a3d6ce72cb2df59c58d07c365472d3793d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/js/r20170605/r20110914/activeview/osd_listener.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Tue, 06 Jun 2017 00:41:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
268853
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
9846
x-xss-protection
1; mode=block
server
cafe
etag
5368213822475282120
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 20 Jun 2017 00:41:55 GMT
truncated
/ Frame 603.
218 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9a3f1e89ac7e63ff0a22523be45f8375d5cd7033156396106665f85a6a7cb20c

Request headers

Response headers

n.js
geo.moatads.com/ Frame 603.
77 B
77 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=0&ue=0&uu=0&qm=0&qn=6OZw%3DoHB%2CEF%3FKC1I%3Cq.bWoCSV2W0Su*TDXlCfX2iR2%25(GyHN%3DI(%2C%3Ba15lK1t!9Zp%7Bl.I6%3DT103etW6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo8rY2baurI!tzm!jVSn%3CV%3CTZ8!J%3BatASYUby%3D(tN%23V.x1.qUD%60aFjL%2FX%252%3B(OC)Lp%22%3Fj3VYUex8k%40%22%7Cu7pRB%5Bz%26(K%2BxP%25l7g%26kyM8F4%2BKCCRP)Et%5B%40(X%7C01%5B_)vVS%2F%2F.hX%3Dt%3C!T%5D%3DNMV8t8fvb%26%225gRo%2BG%22IQ3qC%60I4%3CeZl%5DM%3ArRaxDmPN0%2FdEGm(tVDU%3CVZvoJU4b6W%3AGHBx%3Df%5E7j%22R%5EIc%2CDT%24F%26(%26u3Rs%3C%5ECPR9%6013s%40.Y_hmP%3BgsJ%24Ym%24%2FjkkeL07ta_*JRLRV%3BO5FN6tRAlTJ%3F_v%3D(tN%23V.xm9%25KMD4YP%60T11K%3E(7b%5DQ%22_KF5%5D5%2F%5BGI%3F4Y_hO%3Dn%3CG.3pG%24cz98Zpe4tE0b15%7CQjw%60.%7Bi%24J)%2C4i8ocS!%5BFZKU37B%2BMm1TVGX%5E8Y.NI%22mCN&qp=10000&qq=000001100000&qr=0&gz=0&hh=0&hn=0&qt=0&i=CBSDFPCW2&hp=1&zMoatPS=top&zMoatSECT=Section%20Not%20Defined&zMoatPT=article&zMoatFT=Not%20Specified&zMoatW=300&zMoatH=450&zMoatVGUID=93e230e0-1346-4244-983d-5885f92e829c&zMoatSN=a&zMoatAID=Value%20Not%20Defined&zMoatIMP=Value%20Not%20Defined&zMoatCP=Value%20Not%20Defined&zMoatAType=content_article&zMoatTest=zdnet&cm=7&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&bq=0&f=0&j=&o=3&t=1496978568613&de=426460007876&m=0&ar=c7fbce5-clean&q=30&cb=0&cu=1496978568613&ll=2&lm=0&ln=1&r=25.0.0&em=0&en=1&d=29759169%3A148224849%3A131328849%3A31224235809&qs=1&zGSRC=1&gu=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&bo=23586489&bp=23600769&bd=top&dfp=0%2C1&la=23600769&zMoatNotCnet=true&zMoatSZ=300x450&zMoatSZPS=300x450%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&fd=1&ac=1&it=500&fs=116135&na=984432520&cs=0&callback=MoatSuperV24.gna335965
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.199.132.64 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-199-132-64.compute-1.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash
1bf75dd72f22628a9b30baf624fb93fea6a635aa15ecfb7b6dda829ff1a61117

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
geo.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
nginx/1.7.9
Connection
keep-alive
Content-Length
77
Content-Type
text/html; charset=UTF-8
truncated
/ Frame 603.
209 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b75e2790752679bacd58f0bd5600fe108fc13bcc567fd607f5ff0a922c5dcd75

Request headers

Response headers

n.js
geo.moatads.com/ Frame 603.
78 B
78 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=0&ue=0&uu=0&qm=0&qn=6OZw%3DoHB%2CEF%3FKC1I%3Cq.bWoCSV2W0Su*TDXlCfX2iR2%25(GyHN%3DI(%2C%3Ba15lK1t!9Zp%7Bl.I6%3DT103etW6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo8rY2baurI!tzm!jVSn%3CV%3CTZ8!J%3BatASYUby%3D(tN%23V.x1.qUD%60aFjL%2FX%252%3B(OC)Lp%22%3Fj3VYUex8k%40%22%7Cu7pRB%5Bz%26(K%2BxP%25l7g%26kyM8F4%2BKCCRP)Et%5B%40(X%7C01%5B_)vVS%2F%2F.hX%3Dt%3C!T%5D%3DNMV8t8fvb%26%225gRo%2BG%22IQ3qC%60I4%3CeZl%5DM%3ArRaxDmPN0%2FdEGm(tVDU%3CVZvoJU4b6W%3AGHBx%3Df%5E7j%22R%5EIc%2CDT%24F%26(%26u3Rs%3C%5ECPR9%6013s%40.Y_hmP%3BgsJ%24Ym%24%2FjkkeL07ta_*JRLRV%3BO5FN6tRAlTJ%3F_v%3D(tN%23V.xm9%25KMD4YP%60T11K%3E(7b%5DQ%22_KF5%5D5%2F%5BGI%3F4Y_hO%3Dn%3CG.3pG%24cz98Zpe4tE0b15%7CQjw%60.%7Bi%24J)%2C4i8ocS!%5BFZKU37B%2BMm1TVGX%5E8Y.NI%22mCN&qp=10000&qq=000001100000&qr=0&gz=0&hh=0&hn=0&qt=0&i=CBSDFPCW2&hp=1&zMoatPS=bottom&zMoatSECT=Section%20Not%20Defined&zMoatPT=article&zMoatFT=Not%20Specified&zMoatW=300&zMoatH=250&zMoatVGUID=93e230e0-1346-4244-983d-5885f92e829c&zMoatSN=a&zMoatAID=Value%20Not%20Defined&zMoatIMP=Value%20Not%20Defined&zMoatCP=Value%20Not%20Defined&zMoatAType=content_article&zMoatTest=zdnet&cm=14&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&bq=0&f=0&j=&o=3&t=1496978568667&de=45414867996&m=0&ar=c7fbce5-clean&q=34&cb=0&cu=1496978568667&ll=2&lm=0&ln=1&r=25.0.0&em=0&en=1&d=55040169%3A484753449%3A500296089%3A119967648249&qs=1&zGSRC=1&gu=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&bo=23586489&bp=23600769&bd=bottom&dfp=0%2C1&la=23600769&zMoatNotCnet=true&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&fd=1&ac=1&it=500&fs=116135&na=1629319482&cs=0&callback=MoatSuperV24.gna385065
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.200.5.59 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-200-5-59.compute-1.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash
05ca65e9f294db291d7bca737b236986de41b4a6e55d5badac8903366c1de6fc

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
geo.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
nginx/1.7.9
Connection
keep-alive
Content-Length
78
Content-Type
text/html; charset=UTF-8
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
0
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
truncated
/ Frame 603.
212 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d9c20466cd436eb3f7b81dd84defbb40f831f187ae8bf604ce5e66bb9bf9cc29

Request headers

Response headers

n.js
geo.moatads.com/ Frame 603.
79 B
79 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=0&ue=0&uu=0&qm=0&qn=6OZw%3DoHB%2CEF%3FKC1I%3Cq.bWoCSV2W0Su*TDXlCfX2iR2%25(GyHN%3DI(%2C%3Ba15lK1t!9Zp%7Bl.I6%3DT103etW6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo8rY2baurI!tzm!jVSn%3CV%3CTZ8!J%3BatASYUby%3D(tN%23V.x1.qUD%60aFjL%2FX%252%3B(OC)Lp%22%3Fj3VYUex8k%40%22%7Cu7pRB%5Bz%26(K%2BxP%25l7g%26kyM8F4%2BKCCRP)Et%5B%40(X%7C01%5B_)vVS%2F%2F.hX%3Dt%3C!T%5D%3DNMV8t8fvb%26%225gRo%2BG%22IQ3qC%60I4%3CeZl%5DM%3ArRaxDmPN0%2FdEGm(tVDU%3CVZvoJU4b6W%3AGHBx%3Df%5E7j%22R%5EIc%2CDT%24F%26(%26u3Rs%3C%5ECPR9%6013s%40.Y_hmP%3BgsJ%24Ym%24%2FjkkeL07ta_*JRLRV%3BO5FN6tRAlTJ%3F_v%3D(tN%23V.xm9%25KMD4YP%60T11K%3E(7b%5DQ%22_KF5%5D5%2F%5BGI%3F4Y_hO%3Dn%3CG.3pG%24cz98Zpe4tE0b15%7CQjw%60.%7Bi%24J)%2C4i8ocS!%5BFZKU37B%2BMm1TVGX%5E8Y.NI%22mCN&qp=10000&qq=000001100000&qr=0&gz=0&hh=0&hn=0&qt=0&i=CBSDFPCW2&hp=1&zMoatPS=top&zMoatSECT=Section%20Not%20Defined&zMoatPT=article&zMoatFT=Not%20Specified&zMoatW=371&zMoatH=771&zMoatVGUID=93e230e0-1346-4244-983d-5885f92e829c&zMoatSN=a&zMoatAID=Value%20Not%20Defined&zMoatIMP=Value%20Not%20Defined&zMoatCP=Value%20Not%20Defined&zMoatAType=content_article&zMoatTest=zdnet&cm=8&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&bq=0&f=0&j=&o=3&t=1496978568742&de=572701393308&m=0&ar=c7fbce5-clean&q=38&cb=0&cu=1496978568742&ll=2&lm=0&ln=1&r=25.0.0&em=0&en=1&d=29759169%3A148224849%3A236907969%3A72087703209&qs=1&zGSRC=1&gu=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&bo=23586489&bp=23600769&bd=top&dfp=0%2C1&la=23600769&zMoatNotCnet=true&zMoatSZ=371x771&zMoatSZPS=371x771%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&fd=1&ac=1&it=500&fs=116135&na=481285173&cs=0&callback=MoatSuperV24.gna666232
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.86.159.215 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-159-215.compute-1.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash
9e69406d7c3cccbc1f8f9e30c5df0ef77b56370df0e3507d698796da6bc19c78

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
geo.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
nginx/1.7.9
Connection
keep-alive
Content-Length
79
Content-Type
text/html; charset=UTF-8
teads-format.min.js
cdn.teads.tv/media/format/v3/
596 KB
139 KB
Script
General
Full URL
http://cdn.teads.tv/media/format/v3/teads-format.min.js?2017693
Requested by
Host: cdn.teads.tv
URL: https://cdn.teads.tv/media/format.js
Protocol
HTTP/1.1
Server
95.100.186.168 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-186-168.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
5856c358cd7b45e8ed4a4cd710392afcd24f02b65c72c1507a7ac3cc08797f35

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.teads.tv
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Wed, 07 Jun 2017 12:24:07 GMT
Server
AmazonS3
x-amz-request-id
48C81925FF627A46
ETag
"55b967099fb4f209e172a3d1fdd4ef9e"
Vary
Accept-Encoding
Content-Type
text/javascript;charset=utf-8
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
142130
x-amz-id-2
iAO9AM3TonRhZrRUWYkhhHZZ47h1EqJ+nR13w8QyozUV6G2iyheA/r4DG5G9W30UYPwXMCVk+TQ=
Cookie set event
cbsi.demdex.net/
2 KB
670 B
Script
General
Full URL
http://cbsi.demdex.net/event?d_mid=82019002344760642192159551723785266833&d_nsid=0&d_ld=_ts%3D1496978568807&d_rtbd=json&d_jsonv=1&d_dst=1&d_cb=demdexRequestCallback_0_1496978568807&c_pageName=zdnet%3A%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&c_channel=editorial&c_server=www.zdnet.com&c_prop1=zdnet&c_eVar1=zdnet&c_hier1=editorial%7Carticle&c_prop2=D%3Dv2&c_eVar2=eu&c_list2=113c25b6-ec91-11e3-95d2-02911863765e%7C1055b0a2-ec91-11e3-95d2-02911863765e&c_prop3=D%3Dv3&c_eVar3=responsive%20web%7Cdesktop&c_list3=80fecb98-8175-11e2-9d12-0018fe8a00b0&c_prop4=D%3Dv4&c_prop5=D%3Dv5&c_eVar5=cnetzdnetglobalsite&c_prop6=D%3Dv6&c_eVar6=editorial%7Carticle&c_prop7=D%3Dv7&c_eVar7=D%3Dg&c_prop8=D%3Dv8&c_eVar8=Washington%20Post%2C%20Guardian%20links%20used%20to%20infect%20The%20Mask%20malware%20victims%20%7C%20ZDNet&c_prop9=D%3DUser-Agent&c_prop10=D%3Dv10&c_eVar10=article&c_prop11=D%3Dv11&c_eVar11=D%3Dch%2B%22%3A%22%2Bv10&c_eVar15=not%20authenticated%7Canon&c_prop20=D%3Dv20&c_eVar20=washington%20post%2C%20guardian%20links%20used%20to%20infect%20the%20mask%20malware%20victims&c_prop22=D%3Dv22&c_eVar22=content_article&c_prop23=D%3Dv23&c_eVar23=113c25b6-ec91-11e3-95d2-02911863765e&c_prop24=D%3Dv24&c_eVar24=93e230e0-1346-4244-983d-5885f92e829c&c_prop25=D%3Dv25&c_prop26=D%3Dv26&c_eVar26=bfccdd23-ed4a-11e3-95d2-02911863765e&c_prop28=D%3Dv28&c_prop30=D%3Dv30&c_eVar30=27081696-34e5-11e4-9e6a-00505685119a&c_prop31=D%3Dv31&c_prop33=D%3Dv33&c_prop34=D%3Dv34&c_prop35=D%3Dv35&c_eVar35=exrvK1k6FIftgT1Rt4g&c_prop48=D%3Dv48&c_eVar48=zdnet&c_eVar49=ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails&c_prop50=D%3Dv50&c_eVar50=11%3A00PM&c_prop51=D%3Dv51&c_eVar51=Thursday&c_prop52=D%3Dv52&c_eVar52=1&c_prop53=D%3Dv53&c_eVar53=New&c_prop54=D%3Dv54&c_eVar54=First%20Visit&c_prop65=D%3Dv65&c_eVar65=discover&c_prop69=D%3Dv69
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=201703281836
Protocol
HTTP/1.1
Server
54.229.75.228 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-229-75-228.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
683f12838aec7f724965c11f4f53b1ed7947959e6da96a18628418755e82e545

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cbsi.demdex.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
demdex=35714883694003665103108200718919644587
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

DCS
irl1-prod-dcs-82ef0814.edge-irl1.demdex.com 5.11.1.20170606140807 7ms
Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
X-TID
/vlHcbj+QR4=
Vary
Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Set-Cookie
demdex=35714883694003665103108200718919644587;Path=/;Domain=.demdex.net;Expires=Wed, 06-Dec-2017 03:22:48 GMT
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
transfer-encoding
chunked
Connection
keep-alive
Content-Type
application/javascript; charset=UTF-8
Expires
Thu, 01 Jan 2009 00:00:00 GMT
s93381041824565
om.cbsi.com/b/ss/cnetzdnetglobalsite,cbsicbsiall/1/JS-1.6.1/
43 B
43 B
Image
General
Full URL
http://om.cbsi.com/b/ss/cnetzdnetglobalsite,cbsicbsiall/1/JS-1.6.1/s93381041824565?AQB=1&ndh=1&pf=1&t=9%2F5%2F2017%203%3A22%3A48%205%200&mid=82019002344760642192159551723785266833&aid=2C9D0A4405312D21-600001008000086D&aamlh=6&ce=UTF-8&ns=cbsinteractive&pageName=zdnet%3A%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&g=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&cc=USD&ch=editorial&server=www.zdnet.com&aamb=cIBAx_aQzFEHcPoEv0GwcQ&c1=zdnet&v1=zdnet&h1=editorial%7Carticle&c2=D%3Dv2&v2=eu&l2=113c25b6-ec91-11e3-95d2-02911863765e%7C1055b0a2-ec91-11e3-95d2-02911863765e&c3=D%3Dv3&v3=responsive%20web%7Cdesktop&l3=80fecb98-8175-11e2-9d12-0018fe8a00b0&c4=D%3Dv4&c5=D%3Dv5&v5=cnetzdnetglobalsite&c6=D%3Dv6&v6=editorial%7Carticle&c7=D%3Dv7&v7=D%3Dg&c8=D%3Dv8&v8=Washington%20Post%2C%20Guardian%20links%20used%20to%20infect%20The%20Mask%20malware%20victims%20%7C%20ZDNet&c9=D%3DUser-Agent&c10=D%3Dv10&v10=article&c11=D%3Dv11&v11=D%3Dch%2B%22%3A%22%2Bv10&v15=not%20authenticated%7Canon&c20=D%3Dv20&v20=washington%20post%2C%20guardian%20links%20used%20to%20infect%20the%20mask%20malware%20victims&c22=D%3Dv22&v22=content_article&c23=D%3Dv23&v23=113c25b6-ec91-11e3-95d2-02911863765e&c24=D%3Dv24&v24=93e230e0-1346-4244-983d-5885f92e829c&c25=D%3Dv25&c26=D%3Dv26&v26=bfccdd23-ed4a-11e3-95d2-02911863765e&c28=D%3Dv28&c30=D%3Dv30&v30=27081696-34e5-11e4-9e6a-00505685119a&c31=D%3Dv31&c33=D%3Dv33&c34=D%3Dv34&c35=D%3Dv35&v35=exrvK1k6FIftgT1Rt4g&c48=D%3Dv48&v48=zdnet&v49=ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails&c50=D%3Dv50&v50=11%3A00PM&c51=D%3Dv51&v51=Thursday&c52=D%3Dv52&v52=1&c53=D%3Dv53&v53=New&c54=D%3Dv54&v54=First%20Visit&c65=D%3Dv65&v65=discover&c69=D%3Dv69&v85=false&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1598&bh=1132&AQE=1
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
66.235.148.65 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
*.d2.sc.omtrdc.net
Software
Omniture DC/2.0.0 /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
om.cbsi.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
X-C
ms-5.2.1
P3P
CP="This is not a P3P policy"
Connection
Keep-Alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 10 Jun 2017 03:22:48 GMT
Server
Omniture DC/2.0.0
xserver
www208
ETag
"593A1488-2876-3F0EC06A"
Vary
*
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Keep-Alive
timeout=15
Expires
Thu, 08 Jun 2017 03:22:48 GMT
livefyre_main.css
zor.fyre.co/wjs/v3.0.1496355585/css/
156 KB
20 KB
Stylesheet
General
Full URL
http://zor.fyre.co/wjs/v3.0.1496355585/css/livefyre_main.css
Requested by
Host: cdn.livefyre.com
URL: http://cdn.livefyre.com/libs/fyre.conv/v3.0.0/livefyre.min.js
Protocol
HTTP/1.1
Server
54.192.36.140 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-192-36-140.jfk1.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
55252b56196d9c050f2487112a0b6214037029dffbf48e4deab8d09125330756

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zor.fyre.co
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 01 Jun 2017 22:23:40 GMT
Content-Encoding
gzip
Last-Modified
Thu, 01 Jun 2017 22:20:59 GMT
Server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:1001/gname:deployment/uname:deployment/gid:1001/mode:33261/mtime:1496355640/atime:1496355640/ctime:1496355640
Age
622750
ETag
"ea073b1f7f04081c55cd2c94bec83957"
X-Cache
Hit from cloudfront
Content-Type
text/css
Via
1.1 9137d054c423ede4794f3621c7d50adb.cloudfront.net (CloudFront)
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
20110
X-Amz-Cf-Id
699fdppCjERlCt8d1JkuNLQ5XSrTsAsLl9Z2XvNDLBZx921nSoiG8g==
livefyre_base.js
zor.fyre.co/wjs/v3.0.1496355585/javascripts/
497 KB
166 KB
Script
General
Full URL
http://zor.fyre.co/wjs/v3.0.1496355585/javascripts/livefyre_base.js
Requested by
Host: cdn.livefyre.com
URL: http://cdn.livefyre.com/libs/fyre.conv/v3.0.0/livefyre.min.js
Protocol
HTTP/1.1
Server
54.192.36.140 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-192-36-140.jfk1.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
63efde2b33373b6e485fcca3b49d9e5b6c9ec423100ca50a4d1a5b8cf9b9af46

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zor.fyre.co
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 01 Jun 2017 22:23:30 GMT
Content-Encoding
gzip
Last-Modified
Thu, 01 Jun 2017 22:21:07 GMT
Server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:1001/gname:deployment/uname:deployment/gid:1001/mode:33188/mtime:1496355640/atime:1496355640/ctime:1496355640
Age
622760
ETag
"09c522441691271c787c4247316a51e7"
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Via
1.1 6f4c292df8fb7b5bd5bfa8aff66748aa.cloudfront.net (CloudFront)
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
169926
X-Amz-Cf-Id
NK_cmdMYWEiaFYiVa17--pUdx3EtTzBpHKLnC2eCUwJpqWTY3KjG4g==
collect
www.google-analytics.com/r/
Redirect Chain
  • http://www.google-analytics.com/r/collect?v=1&_v=j55&aip=1&a=790477278&t=pageview&_s=1&dl=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victi...
  • https://www.google-analytics.com/r/collect?v=1&_v=j55&aip=1&a=790477278&t=pageview&_s=1&dl=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-vict...
35 B
44 B
Image
General
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j55&aip=1&a=790477278&t=pageview&_s=1&dl=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims&ul=en-us&de=UTF-8&dt=Washington%20Post%2C%20Guardian%20links%20used%20to%20infect%20The%20Mask%20malware%20victims%20%7C%20ZDNet&sd=24-bit&sr=1600x1200&vp=1583x1132&je=0&fl=25.0%20r0&_u=YAhAAEABI~&jid=2035058406&gjid=1046206878&cid=519849922.1496978568&tid=UA-33613588-22&_gid=2086022008.1496978569&_r=1&cd2=other&z=906286230
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::200e , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

:path
/r/collect?v=1&_v=j55&aip=1&a=790477278&t=pageview&_s=1&dl=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims&ul=en-us&de=UTF-8&dt=Washington%20Post%2C%20Guardian%20links%20used%20to%20infect%20The%20Mask%20malware%20victims%20%7C%20ZDNet&sd=24-bit&sr=1600x1200&vp=1583x1132&je=0&fl=25.0%20r0&_u=YAhAAEABI~&jid=2035058406&gjid=1046206878&cid=519849922.1496978568&tid=UA-33613588-22&_gid=2086022008.1496978569&_r=1&cd2=other&z=906286230
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
www.google-analytics.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 09 Jun 2017 03:22:48 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://www.google-analytics.com/r/collect?v=1&_v=j55&aip=1&a=790477278&t=pageview&_s=1&dl=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims&ul=en-us&de=UTF-8&dt=Washington%20Post%2C%20Guardian%20links%20used%20to%20infect%20The%20Mask%20malware%20victims%20%7C%20ZDNet&sd=24-bit&sr=1600x1200&vp=1583x1132&je=0&fl=25.0%20r0&_u=YAhAAEABI~&jid=2035058406&gjid=1046206878&cid=519849922.1496978568&tid=UA-33613588-22&_gid=2086022008.1496978569&_r=1&cd2=other&z=906286230
Non-Authoritative-Reason
HSTS
pubads_impl_121.js
securepubads.g.doubleclick.net/gpt/ Frame 603.
185 KB
64 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Requested by
Host: www.googletagservices.com
URL: http://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
sffe /
Resource Hash
ac4f9618be0b43e3a85ccb1b5ae9b9c5efbe4d1ac30bcd5db7b624a767024481
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/gpt/pubads_impl_121.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
cookie
id=22f2a50bdb3e00fa||t=1496978568|et=730|cs=002213fd48f4f282e1e8e26553; IDE=AHWqTUl7zbUiStH9IzxlRG2LPFmnniHEwgdCS4y4jlpQRWwdeCnRsUSkug
:scheme
https
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Tue, 06 Jun 2017 15:29:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
215598
status
200
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
65897
x-xss-protection
1; mode=block
last-modified
Tue, 06 Jun 2017 14:12:08 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 06 Jun 2018 15:29:30 GMT
Cookie set 367408.gif
idsync.rlcdn.com/
Redirect Chain
  • http://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTk1NjkwMzUvdC8y/dpuid/14d961f4ad805689d47f15d0ba15101fd82f43abf03a3a0e13db010910bd6dec3528d9f17d145da0/url/http://idsync.rlcdn.com/367408.gif?partner_uid=...
  • http://idsync.rlcdn.com/367408.gif?partner_uid=3248526639972084495
43 B
43 B
Image
General
Full URL
http://idsync.rlcdn.com/367408.gif?partner_uid=3248526639972084495
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
34.199.66.174 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-199-66-174.compute-1.amazonaws.com
Software
/
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
idsync.rlcdn.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
ck1=ck1; rlas3=yPIy63lSYGnHCu/NUIpkdOY7VXWOlrpSIisIiQC533aMyA9jEACu5w==; rtn1-z=IaPVs8VHz+QkI+xpCzOoUZ9fOJlf1SXI8+D37pP2zM4=; drtn984110679=TI1KKPvS+8ahigfDYQNG3vBJChYxHMpy
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Expires
Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control
no-cache, no-store
Set-Cookie
drtn984110679="";Version=1;Domain=.rlcdn.com;Expires=Thu, 01-Jan-1970 00:00:00 GMT;Max-Age=0 rlas3=yPIy63lSYGnHCu/NUIpkdOY7VXWOlrpSIisIiQC533aMyA9jEACu5w==;Domain=.rlcdn.com;Expires=Wed, 06-Dec-2017 03:22:45 GMT rtn1-z=IaPVs8VHz+TPpMPCUqZ9FhODFKmx6t5QjnL8A1T2W5pXF6DrWbwtDuyKDTWnr7Ot;Domain=.rlcdn.com;Expires=Wed, 06-Dec-2017 03:22:45 GMT
P3P
CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE"
Content-Length
43
Connection
keep-alive
Content-Type
image/gif; charset=ISO-8859-1

Redirect headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
Server
Apache-Coyote/1.1
P3P
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Location
http://idsync.rlcdn.com/367408.gif?partner_uid=3248526639972084495
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Set-Cookie
uid=3248526639972084495; Domain=.turn.com; Expires=Wed, 06-Dec-2017 03:22:49 GMT; Path=/
Content-Length
0
Cookie set pixelmatch
cmi.netseer.com/
Redirect Chain
  • http://ssum.casalemedia.com/usermatchredir?s=183876&cb=http%3A%2F%2Fcmi.netseer.com%2Fpixelmatch%3Fex%3D39%26xid%3D__UID__%26t%3D3&C=1
  • http://cmi.netseer.com/pixelmatch?ex=39&xid=WToUiLlQJ8QAAHjozBgAAACE%261137&t=3
42 B
42 B
Image
General
Full URL
http://cmi.netseer.com/pixelmatch?ex=39&xid=WToUiLlQJ8QAAHjozBgAAACE%261137&t=3
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
52.1.246.30 Ashburn, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-1-246-30.compute-1.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cmi.netseer.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
netseer_v3_vi=H4sIAAAAAAAAADOyKi0uMk5LNTJLMk4xTzYzSE2xNLYyNLE0szS3MDWzMDYw0zG0sHKNCHEN8nP0QZIxM7bUMTbEJmNpYg4AMJbTNVcAAAA
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Set-Cookie
netseer_v3_vi=H4sIAAAAAAAAADOyKi0uMk5LNTJLMk4xTzYzSE2xNLYyNLE0szS3MDWzMDYw0zG0sHKNCHEN8nP0QZIxM7bUMTbEJmNpYq5jbGkVHpIfmumTE-hlEejo6JGVX-WU7ujo6OyqZmhobI5QbmlgYQwAv7Kee4YAAAA; Domain=.netseer.com; Expires=Tue, 08-Aug-2017 03:22:49 GMT; Path=/
Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
Apache-Coyote/1.1
Connection
keep-alive
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Length
42
Content-Type
image/gif

Redirect headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
Apache
Connection
keep-alive
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
http://cmi.netseer.com/pixelmatch?ex=39&xid=WToUiLlQJ8QAAHjozBgAAACE%261137&t=3
Cache-Control
max-age=0, no-cache, no-store
Set-Cookie
CMID=WToUiLlQJ8QAAHjozBgAAACE;domain=casalemedia.com;path=/;expires=Sat, 09 Jun 2018 03:22:48 GMT CMPS=1137;domain=casalemedia.com;path=/;expires=Thu, 07 Sep 2017 03:22:48 GMT CMPRO=1137;domain=casalemedia.com;path=/;expires=Thu, 07 Sep 2017 03:22:48 GMT CMST=WToUiFk6FIgA;domain=casalemedia.com;path=/;expires=Sat, 10 Jun 2017 03:22:48 GMT CMSC=WToUiA**;domain=casalemedia.com;path=/; CMDD=;domain=casalemedia.com;path=/;expires=Sat, 10 Jun 2017 03:22:48 GMT
Content-Type
text/html; charset=iso-8859-1
Content-Length
271
Expires
Fri, 09 Jun 2017 03:22:48 GMT
Cookie set pixelmatch
cm.netseer.com/
Redirect Chain
  • http://bttrack.com/pixel/cookiesync/NetSeer1489?t=3
  • http://cm.netseer.com/pixelmatch?ex=41&buyerid=1c560347-2d91-4c7b-956d-a5c8d7a1899d
42 B
42 B
Image
General
Full URL
http://cm.netseer.com/pixelmatch?ex=41&buyerid=1c560347-2d91-4c7b-956d-a5c8d7a1899d
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
54.88.164.103 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-88-164-103.compute-1.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cm.netseer.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
netseer_v3_vi=H4sIAAAAAAAAADOyKi0uMk5LNTJLMk4xTzYzSE2xNLYyNLE0szS3MDWzMDYw0zG0sHKNCHEN8nP0QZIxM7bUMTbEJmNpYg4AMJbTNVcAAAA
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Set-Cookie
netseer_v3_vi=H4sIAAAAAAAAAG3LOw7CMBAFwAvZktf7fe4o0iEKRJE28SYHAHF_SiioR9PH-_Xk8-i2c_q0diR4kMDgoRbcrFCMZX0s99vl-iPGKEz_BOJFaNBUayxee4KqTN8r1LJuOiN9owDyu9CgH_w2cteNAAAA; Domain=.netseer.com; Expires=Tue, 08-Aug-2017 03:22:49 GMT; Path=/
Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
Apache-Coyote/1.1
Connection
keep-alive
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Length
42
Content-Type
image/gif

Redirect headers

X-ServerName
NLB1
Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:48 GMT
X-AspNetMvc-Version
5.2
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
P3P
policyref="http://www.bidtellect.com/w3c/p3p.xml", CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Location
http://cm.netseer.com/pixelmatch?ex=41&buyerid=1c560347-2d91-4c7b-956d-a5c8d7a1899d
Cache-Control
private,no-cache
Set-Cookie
GLOBALID=2uKlc8-sIBd987GfJwLFHub_4guco1Ifdek74-gzxDtx2EKIcAy6roHNZJ9QnMca5-e2LyHTlbM1; domain=.bttrack.com; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/
Content-Type
text/html; charset=utf-8
Content-Length
204
Expires
-1
Cookie set napi.jsonp
cas.criteo.com/delivery/0.1/ Frame 603.
62 B
62 B
Script
General
Full URL
http://cas.criteo.com/delivery/0.1/napi.jsonp?zoneid=734803&callback=cb07990055478977933&publisherid=31850205
Requested by
Host: cdn.bttrack.com
URL: https://cdn.bttrack.com/js/infeed/1.1/20bc0442-8bec-43f8-9992-08be6e6a3591/31850205/infeed.min.js?bustframe=1
Protocol
HTTP/1.1
Server
178.250.2.71 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
cas.criteo.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
9dfeee3e87ed97082d664c6bc11c7cb2b42885c1b905adb90f327aa56b4aa4a7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cas.criteo.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
Access-Control-Max-Age
1000
Access-Control-Allow-Methods
GET, POST, OPTIONS
P3P
CP='CUR ADM OUR NOR STA NID'
Access-Control-Allow-Origin
*
Cache-Control
private
Access-Control-Allow-Credentials
true
Set-Cookie
uid=2f4fe3ce-0842-4d01-915b-8bbf48a64ca6; domain=.criteo.com; expires=Sat, 09-Jun-2018 03:22:48 GMT; path=/ uid=2f4fe3ce-0842-4d01-915b-8bbf48a64ca6; domain=.criteo.com; expires=Sat, 09-Jun-2018 03:22:48 GMT; path=/ zdi=*1Tt61xO3HsovavRpBIgOgCg%3d%3d; domain=.criteo.com; expires=Sat, 09-Dec-2017 03:22:49 GMT; path=/
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
Content-Length
62
Expires
Mon, 26 Jul 1997 05:00:00 GMT
Cookie set InFeed
api.bttrack.com/WebClient/ Frame 603.
5 KB
5 KB
XHR
General
Full URL
http://api.bttrack.com/WebClient/InFeed?t=20bc0442-8bec-43f8-9992-08be6e6a3591&br=%7B%22site%22%3A%7B%22ref%22%3A%22http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F%22%2C%22page%22%3A%22http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F%22%2C%22extbt%22%3A%7B%22secure%22%3Afalse%7D%7D%2C%22imp%22%3A%5B%7B%22pid%22%3A%2231850205%22%7D%5D%2C%22kw%22%3A%22%22%7D
Requested by
Host: cdn.bttrack.com
URL: https://cdn.bttrack.com/js/infeed/1.1/20bc0442-8bec-43f8-9992-08be6e6a3591/31850205/infeed.min.js?bustframe=1
Protocol
HTTP/1.1
Server
192.132.33.31 , United States, ASN18568 (BIDTELLECT - Bidtellect Inc., US),
Reverse DNS
Software
Microsoft-IIS/8.5 /
Resource Hash
035c6a2f4be7239b29b4f5145b518ed096eb82124637cbf57d38442494a9df4a

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
api.bttrack.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
application/json
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Accept
application/json
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
P3P
policyref="http://www.bidtellect.com/w3c/p3p.xml", CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Access-Control-Allow-Origin
http://www.zdnet.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Set-Cookie
GLOBALID=2uKlc8-sIBd987HhIIG6ZJ394IvmWVAddZE_n-rLvEUO3zr2cPDHqoPNnBtS5MYaRp3dhCHTlbM1; domain=.bttrack.com; expires=Sun, 09-Jun-2019 03:22:48 GMT; path=/
Content-Type
application/json; charset=utf-8
Content-Length
4887
Expires
-1
redirect
sync.teads.tv/iframe/ Frame 603.
Redirect Chain
  • http://sync.teads.tv/iframe?pid=32374&userId=6ddb3e27-dbfe-4c2d-ad37-30ae4606c599&1496978568969
  • http://sync.teads.tv/iframe/redirect
0
0

ad
a.teads.tv/page/0/
39 KB
2 KB
XHR
General
Full URL
http://a.teads.tv/page/0/ad?windowWidth=1598&windowHeight=1132&windowDepth=1&windowReferrerUrl=&page=%7B%22id%22%3A0%2C%22placements%22%3A%5B%7B%22id%22%3A32374%2C%22validity%22%3A%7B%22status%22%3Atrue%2C%22reasons%22%3A%5B%5D%7D%2C%22player%22%3A%7B%22width%22%3A620%2C%22height%22%3A349%7D%2C%22slotType%22%3A%22native%22%7D%5D%7D&userId=6ddb3e27-dbfe-4c2d-ad37-30ae4606c599&formatVersion=2.14.15&env=js-web
Requested by
Host: cdn.teads.tv
URL: http://cdn.teads.tv/media/format/v3/teads-format.min.js?2017693
Protocol
HTTP/1.1
Server
52.31.88.15 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-31-88-15.eu-west-1.compute.amazonaws.com
Software
teads-ssp /
Resource Hash
ae109e9f328268aa1639db3ac45ceef8fa41921dcf313bb17b3b86ae75ee9cbd

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
a.teads.tv
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
application/json; charset=UTF-8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Accept
application/json; charset=UTF-8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
Content-Encoding
gzip
Server
teads-ssp
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
http://www.zdnet.com
Cache-Control
no-cache, must-revalidate, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
2245
Expires
0
track
t.teads.tv/
23 B
23 B
Image
General
Full URL
http://t.teads.tv/track?action=placementCall&pageId=0&pid=32374&gid=&slot=native&env=js-web&ts=1496978568961
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
54.72.151.68 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-72-151-68.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
t.teads.tv
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Expires
Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
23
Content-Type
image/gif
track
t.teads.tv/
23 B
23 B
Image
General
Full URL
http://t.teads.tv/track?action=slotAvailable&pageId=0&pid=32374&gid=&slot=native&env=js-web&ts=1496978568961
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
52.30.66.229 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-30-66-229.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
t.teads.tv
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Expires
Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
23
Content-Type
image/gif
container.html
tpc.googlesyndication.com/safeframe/1-0-9/html/ Frame 603.
3 KB
2 KB
Other
General
Full URL
http://tpc.googlesyndication.com/safeframe/1-0-9/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
ae5f50b2f37e6d987eeeab05cc75c24906e6c4ccd7bb9f1ad842d635d3dfaee7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Purpose
prefetch
Accept-Encoding
gzip, deflate, sdch
Host
tpc.googlesyndication.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Purpose
prefetch
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Tue, 06 Jun 2017 14:59:14 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Wed, 24 May 2017 18:50:59 GMT
Server
sffe
Age
217415
Vary
Accept-Encoding
Content-Type
text/html
Cache-Control
public, immutable, max-age=31536000
Accept-Ranges
bytes
Content-Length
1770
X-XSS-Protection
1; mode=block
Expires
Wed, 06 Jun 2018 14:59:14 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame 603.
33 KB
8 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&correlator=1657346303541785&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&json_a=1&eid=108809080%2C108809107%2C21060094%2C21060157&sc=0&sfv=1-0-9&iu_parts=8264%2Caw-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=372x142%2C372x142&prev_scp=pos%3D%26campaign%3D%26env%3Dprod%26session%3Da%26subses%3D3%26ptype%3Darticle%26vguid%3D93e230e0-1346-4244-983d-5885f92e829c%7Cpos%3D%26campaign%3D%26env%3Dprod%26session%3Da%26subses%3D3%26ptype%3Darticle%26vguid%3D93e230e0-1346-4244-983d-5885f92e829c&cookie_enabled=1&lmt=1496978569&dt=1496978569018&frm=23&biw=1583&bih=1132&isw=371&ish=771&oid=3&adxs=0%2C0&adys=0%2C0&adks=2442809372%2C2442809371&gut=v2&ifi=1&ifk=3346631032&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=5&u_nmime=7&u_sd=1&flash=25.0.0&nhd=1&iag=3&url=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&ref=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&top=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&dssz=12&icsg=2592&std=0&vrg=121&vrp=121&rumc=5424580201612750&ga_vid=519849922.1496978568&ga_sid=1496978569&ga_hid=1742469684
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
cafe /
Resource Hash
40d0a5b3a082259653eaa1a6cb0ccc1eddaadc90e0ceee6266b5df07f5947d0d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/gampad/ads?gdfp_req=1&correlator=1657346303541785&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&json_a=1&eid=108809080%2C108809107%2C21060094%2C21060157&sc=0&sfv=1-0-9&iu_parts=8264%2Caw-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=372x142%2C372x142&prev_scp=pos%3D%26campaign%3D%26env%3Dprod%26session%3Da%26subses%3D3%26ptype%3Darticle%26vguid%3D93e230e0-1346-4244-983d-5885f92e829c%7Cpos%3D%26campaign%3D%26env%3Dprod%26session%3Da%26subses%3D3%26ptype%3Darticle%26vguid%3D93e230e0-1346-4244-983d-5885f92e829c&cookie_enabled=1&lmt=1496978569&dt=1496978569018&frm=23&biw=1583&bih=1132&isw=371&ish=771&oid=3&adxs=0%2C0&adys=0%2C0&adks=2442809372%2C2442809371&gut=v2&ifi=1&ifk=3346631032&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=5&u_nmime=7&u_sd=1&flash=25.0.0&nhd=1&iag=3&url=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&ref=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&top=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&dssz=12&icsg=2592&std=0&vrg=121&vrp=121&rumc=5424580201612750&ga_vid=519849922.1496978568&ga_sid=1496978569&ga_hid=1742469684
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
cookie
id=22f2a50bdb3e00fa||t=1496978568|et=730|cs=002213fd48f4f282e1e8e26553; IDE=AHWqTUl7zbUiStH9IzxlRG2LPFmnniHEwgdCS4y4jlpQRWwdeCnRsUSkug
:scheme
https
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Fri, 09 Jun 2017 03:22:49 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
7777
x-xss-protection
1; mode=block
google-lineitem-id
580074129,236987769
pragma
no-cache
server
cafe
google-creative-id
120084724329,72120427449
content-type
text/javascript; charset=UTF-8
cache-control
no-cache, must-revalidate
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/ Frame 603.
42 B
42 B
Image
General
Full URL
http://pagead2.googlesyndication.com/activeview?avi=B5bXfhxQ6WceWLaXPxgKlub3ADAAAAAAQATgByAEJwAIC4AIA4AQBoAYf0ggFCIBhEAE&cid=CAASBORoIY8&id=osdim&ti=1&adk=2426749405&mtos=0,0,0,0,0&tos=0,0,0,0,0&p=0,0,0,0&mcvt=0&rs=3&ht=0&mc=0&lte=-1&bas=1&bac=1&gte=108809103&tmo=5&tme=317&rtl=false&til=317&tdl=17&tdld=239&tcl=147&tcld=509&tlr=17&tlrd=239&r=u&bs=1583,1132&bos=1598,1132&ps=1583,6275&ss=1600,1200&tt=472&pt=-1&deb=1-0-12-4-4--1&tvt=0&avms=geo&uc=1&tgt=BODY&cl=1&cec=5&clc=0&cd=980x0
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
2a00:1450:4001:824::2002 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pagead2.googlesyndication.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
X-Content-Type-Options
nosniff
Server
cafe
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, must-revalidate
Timing-Allow-Origin
*
Content-Length
42
X-XSS-Protection
1; mode=block
Expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/ Frame 603.
42 B
42 B
Image
General
Full URL
http://pagead2.googlesyndication.com/activeview?avi=BiqLLhxQ6WciWLaXPxgKlub3ADAAAAAAQATgByAEJwAIC4AIA4AQBoAYf0ggFCIBhEAE&cid=CAASBORoiJ0&id=osdim&ti=1&adk=3800986708&mtos=0,0,0,0,0&tos=0,0,0,0,0&p=0,0,0,0&mcvt=0&rs=3&ht=0&mc=0&lte=-1&bas=1&bac=1&gte=108809103&tmo=5&tme=331&rtl=false&til=331&tdl=27&tdld=171&tcl=147&tcld=503&tlr=27&tlrd=171&r=u&bs=1583,1132&bos=1598,1132&ps=1583,6275&ss=1600,1200&tt=472&pt=-1&deb=1-0-12-4-4--1&tvt=0&avms=geo&uc=1&tgt=BODY&cl=1&cec=5&clc=0&cd=0x0
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
2a00:1450:4001:824::2002 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pagead2.googlesyndication.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
X-Content-Type-Options
nosniff
Server
cafe
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, must-revalidate
Timing-Allow-Origin
*
Content-Length
42
X-XSS-Protection
1; mode=block
Expires
Fri, 01 Jan 1990 00:00:00 GMT
teads-format.css
cdn.teads.tv/media/format/v3/
864 B
333 B
Stylesheet
General
Full URL
http://cdn.teads.tv/media/format/v3/teads-format.css
Requested by
Host: cdn.teads.tv
URL: http://cdn.teads.tv/media/format/v3/teads-format.min.js?2017693
Protocol
HTTP/1.1
Server
95.100.186.168 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-186-168.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
6ffdc3f8c9b917bbec995f62ea5a3682c80f25024f03bdb6f8163356f3a59a43

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.teads.tv
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
tt_viewer=2de54e70-a45d-4808-ae5f-2597108614bf
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:49 GMT
Content-Encoding
gzip
Last-Modified
Wed, 07 Jun 2017 12:24:05 GMT
Server
AmazonS3
x-amz-request-id
E97748831C900ECF
ETag
"fc8e28c30c5ab2ca064a0acdb6abff90"
Vary
Accept-Encoding
Content-Type
text/css;charset=utf-8
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
333
x-amz-id-2
Imhc29l88TbCAt+wMvMypgL5JmnaUUUcyfoaQtw9UU2KcT5c8UgN3U7BkwH8KxosBkCZ8LcAlI8=
ads
pubads.g.doubleclick.net/gampad/
156 B
153 B
XHR
General
Full URL
http://pubads.g.doubleclick.net/gampad/ads?sz=640x481&iu=/8264/vaw-zdnet/teads&ciu_szs=300x60&impl=s&gdfp_req=1&env=vp&output=xml_vast2&unviewed_position_start=1&url=http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/&description_url=[description_url]&correlator=1496978569053&ad_rule=0&nofb=1
Requested by
Host: cdn.teads.tv
URL: http://cdn.teads.tv/media/format/v3/teads-format.min.js?2017693
Protocol
HTTP/1.1
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
cafe /
Resource Hash
a7694405d22e2ce17d95152b5eca83fc18f2c119984d85438bf7e5d213e90df5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
pubads.g.doubleclick.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
id=22f2a50bdb3e00fa||t=1496978568|et=730|cs=002213fd48f4f282e1e8e26553; IDE=AHWqTUl7zbUiStH9IzxlRG2LPFmnniHEwgdCS4y4jlpQRWwdeCnRsUSkug
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com

Response headers

Date
Fri, 09 Jun 2017 03:22:49 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Google-MediationGroup-Id
-2
P3P
policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Length
153
X-XSS-Protection
1; mode=block
Google-LineItem-Id
-2
Pragma
no-cache
Server
cafe
Google-Creative-Id
-2
Content-Type
text/xml; charset=UTF-8
Access-Control-Allow-Origin
http://www.zdnet.com
Cache-Control
no-cache, must-revalidate
Access-Control-Allow-Credentials
true
Timing-Allow-Origin
*
Expires
Fri, 01 Jan 1990 00:00:00 GMT
format.js
cdn.teads.tv/media/ Frame 603.
93 KB
29 KB
Script
General
Full URL
https://cdn.teads.tv/media/format.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.186.168 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-186-168.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
fecab180f1b65fe9a7426a2ce8c95c83198d0faf2c5c26e2394c150c677476b3

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
cdn.teads.tv
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
tt_viewer=2de54e70-a45d-4808-ae5f-2597108614bf
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:49 GMT
Content-Encoding
gzip
Last-Modified
Mon, 05 Jun 2017 13:44:22 GMT
Server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:0/uname:root/gid:997/mode:33188/mtime:1496667859/atime:1496667869/md5:370061ab0d79b1bd02cb46989579aae8/ctime:1496667859
x-amz-request-id
491646A884C779BF
ETag
"69e1a30e47cc276446814a4d03aad520"
Vary
Accept-Encoding
Content-Type
application/javascript;charset=utf-8
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
29971
x-amz-id-2
QRFycmwCAPa2zaqu5wFX5jRTpvDo1KSBcofkD3zLWuREqj7kuS1R9IEUs1k8LfyRRgQiTFtGxjQ=
track
t.teads.tv/
23 B
23 B
Image
General
Full URL
http://t.teads.tv/track?action=error-vast&code=303&pid=32374&vid=4bfd7a679b10448a9f535f82cc3fb4f191fc0037&mediaFileType=unknown&gid=22174&env=js-web&1496978569052
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
52.30.66.229 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-30-66-229.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
t.teads.tv
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
tt_viewer=2de54e70-a45d-4808-ae5f-2597108614bf
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Expires
Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
23
Content-Type
image/gif
track
t.teads.tv/
23 B
23 B
Image
General
Full URL
http://t.teads.tv/track?action=adAvailable-error-vast-303&pageId=0&pid=32374&gid=&slot=native&env=js-web&ts=1496978568961
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
54.72.151.68 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-72-151-68.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
t.teads.tv
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
tt_viewer=2de54e70-a45d-4808-ae5f-2597108614bf
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Expires
Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
23
Content-Type
image/gif
track
t.teads.tv/
23 B
23 B
Image
General
Full URL
http://t.teads.tv/track?action=passback-noAd&pageId=0&pid=32374&gid=&slot=native&env=js-web&ts=1496978568961
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
52.30.66.229 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-30-66-229.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
t.teads.tv
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
tt_viewer=2de54e70-a45d-4808-ae5f-2597108614bf
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Expires
Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
23
Content-Type
image/gif
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/ Frame 603.
24 KB
0
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
fb80487775677e61280ccbce05f36a3d6ce72cb2df59c58d07c365472d3793d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/js/r20170605/r20110914/activeview/osd_listener.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET

Response headers

date
Tue, 06 Jun 2017 00:41:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
268853
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
9846
x-xss-protection
1; mode=block
server
cafe
etag
5368213822475282120
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 20 Jun 2017 00:41:55 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
0
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
truncated
/ Frame 603.
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0f6d4070e7f50fa7e754b3f4e01207969bc3922be3b4f02d7be3ab63748818ba

Request headers

Response headers

osd.js
pagead2.googlesyndication.com/pagead/ Frame 603.
77 KB
29 KB
Script
General
Full URL
http://pagead2.googlesyndication.com/pagead/osd.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Server
2a00:1450:4001:824::2002 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
557007834448c888efaa01c2c1d25155130fea075308b3bdb1ea87662b82a2ae
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pagead2.googlesyndication.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 02:27:17 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
cafe
Age
3332
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
ETag
5277057430624346146
Content-Type
text/javascript; charset=UTF-8
Cache-Control
public, max-age=3600
Content-Disposition
attachment; filename="f.txt"
Timing-Allow-Origin
*
Content-Length
29297
X-XSS-Protection
1; mode=block
Expires
Fri, 09 Jun 2017 03:27:17 GMT
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/ Frame 603.
24 KB
0
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
fb80487775677e61280ccbce05f36a3d6ce72cb2df59c58d07c365472d3793d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/js/r20170605/r20110914/activeview/osd_listener.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET

Response headers

date
Tue, 06 Jun 2017 00:41:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
268853
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
9846
x-xss-protection
1; mode=block
server
cafe
etag
5368213822475282120
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 20 Jun 2017 00:41:55 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 603.
219 KB
0
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache

Response headers

Date
Fri, 09 Jun 2017 03:22:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 May 2017 17:31:48 GMT
Server
AmazonS3
x-amz-request-id
C7B373E8293E975E
ETag
"09910e1609ce449c1afe045eb6677f98"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=23064
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71277
x-amz-id-2
jGQT6ADAj2xZy3n95ZdC17IYQ3kwZdxYHQPje4DhHmTsMjyvRPfpEiuXtC9RDWeTCVkTKtzyr+8=
truncated
/ Frame 603.
212 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
41452df83d87a902f281254194848f6bb39e57ced653c321491bad264806cbc0

Request headers

Response headers

view
securepubads.g.doubleclick.net/pcs/ Frame 603.
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu0yML9mNlwM4zS_sDCn3qU--4njTsbYf5SOexqqMJfj7NDY81aDGvhA2vLJPivx5sAX_fgGms6JO0e_5V-WfEAJuv0XdCJqCTKyzbxbg8MxJuoH31fdmBoq02HDusaXu7GqNu_NFHcSqDXnN_waW_vpZP6eGRHnx_pTUCXlMAHkziSJDkR8twJBFVfUKVj8jsKmPFpGeiCuoFCxKFLbQxf69WMzzPcZAqKQ9u6bVpYei4oYJfzQNoXP97pqTA&sig=Cg0ArKJSzHxeS6Ok32YWEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pcs/view?xai=AKAOjsu0yML9mNlwM4zS_sDCn3qU--4njTsbYf5SOexqqMJfj7NDY81aDGvhA2vLJPivx5sAX_fgGms6JO0e_5V-WfEAJuv0XdCJqCTKyzbxbg8MxJuoH31fdmBoq02HDusaXu7GqNu_NFHcSqDXnN_waW_vpZP6eGRHnx_pTUCXlMAHkziSJDkR8twJBFVfUKVj8jsKmPFpGeiCuoFCxKFLbQxf69WMzzPcZAqKQ9u6bVpYei4oYJfzQNoXP97pqTA&sig=Cg0ArKJSzHxeS6Ok32YWEAE&urlfix=1&adurl=
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
cookie
id=22f2a50bdb3e00fa||t=1496978568|et=730|cs=002213fd48f4f282e1e8e26553; IDE=AHWqTUl7zbUiStH9IzxlRG2LPFmnniHEwgdCS4y4jlpQRWwdeCnRsUSkug
:scheme
https
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 09 Jun 2017 03:22:49 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
0
x-xss-protection
1; mode=block
imgad
tpc.googlesyndication.com/pagead/
11 KB
11 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKDL57X2XRABGAEyCOo3TSQkWdkk
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
b3654bd93a8e909f18d7f0a13561758b83f4539ac38f2145cd699887a95467b2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/imgad?id=CICAgKDL57X2XRABGAEyCOo3TSQkWdkk
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Thu, 08 Jun 2017 05:21:27 GMT
x-content-type-options
nosniff
server
cafe
age
79282
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/jpeg
status
200
cache-control
public, max-age=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
11696
x-xss-protection
1; mode=block
expires
Thu, 15 Jun 2017 05:21:27 GMT
beacon
tag.researchnow.com/t/ Frame 603.
42 B
42 B
Image
General
Full URL
https://tag.researchnow.com/t/beacon?adn=3&ca=11235374&cr=81370894&pl=149873033&pr=11194&si=2935648
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.0.40.31 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-0-40-31.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
tag.researchnow.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
Last-Modified
Thu, 11 Dec 2014 18:19:06 GMT
Server
Apache
Content-Type
image/gif
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
42
Expires
Fri, 09 Jun 2017 03:22:49 GMT
Cookie set event
att.demdex.net/ Frame 603.
Redirect Chain
  • https://ad.atdmt.com/i/img;adv=11022204319972;ec=11022204320517;adv.a=6141273;c.a=11235374;s.a=2935648;p.a=149873033;a.a=320818982;cache=1314820144;qpb=1;?h=https://att.demdex.net/event?d_event=imp...
  • https://att.demdex.net/event?d_event=imp&d_src=127123&d_placement=149873033&d_campaign=11235374&d_site=2935648&d_cb=1314820144
42 B
42 B
Image
General
Full URL
https://att.demdex.net/event?d_event=imp&d_src=127123&d_placement=149873033&d_campaign=11235374&d_site=2935648&d_cb=1314820144
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.49.214.49 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-49-214-49.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
att.demdex.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
demdex=35714883694003665103108200718919644587
X-Client-Data
CIi2yQEIpLbJAQ==
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

DCS
irl1-prod-dcs-fcef086a.edge-irl1.demdex.com 5.11.1.20170606140807 5ms
Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
X-TID
B+9POA59SMY=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Set-Cookie
demdex=35714883694003665103108200718919644587;Path=/;Domain=.demdex.net;Expires=Wed, 06-Dec-2017 03:22:49 GMT att=35714883694003665103108200718919644587;Path=/;Domain=.att.demdex.net;Expires=Wed, 06-Dec-2017 03:22:49 GMT
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 2009 00:00:00 GMT

Redirect headers

status
302
pragma
no-cache
date
Fri, 09 Jun 2017 03:22:49 GMT
cache-control
private, no-cache, no-store, must-revalidate
location
https://att.demdex.net/event?d_event=imp&d_src=127123&d_placement=149873033&d_campaign=11235374&d_site=2935648&d_cb=1314820144
expires
0
visit.jpg
tps30.doubleverify.com/ Frame 603.
305 B
305 B
Image
General
Full URL
https://tps30.doubleverify.com/visit.jpg?ctx=607671&cmp=11235374&sid=2935648&plc=149873033&num=&adid=&advid=226&adsrv=1%C2%AEion=30&btreg=&btadsrv=&crt=&crtname=&chnl=&unit=&pid=&uid=&tagtype=&app=&sup=&DVP_EXID=&DVP_CDID=&DVP_DMGRV=&DVP_LAT=&DVP_LONG=&dvtagver=6.1.img&
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
204.154.111.113 , United States, ASN36062 (DOUBLE-VERIFY - DoubleVerify, Inc., US),
Reverse DNS
nycp-hlb10.doubleverify.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
a78f3c394abdb5185b2a1235457e0e9a50b97625ef7c01a276a0aef6c5dd87fb

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
tps30.doubleverify.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:48 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
Content-Type
image/jpeg
Cache-Control
max-age=0
Content-Length
305
Expires
6/8/2017 3:22:49 AM
view
securepubads.g.doubleclick.net/pcs/ Frame 603.
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssTmtxng52fQNGzRQWQF9VLd191roW4XOG9DjC0_9VQfGHpCZ8-trLMBvIqZVaOb5meT9uo6-ISPnzCEOGxtBUbUw-biqTyAoXXhHbxpx29KdbdQD5jfaFMn8IgLpeDsbPqB8UJO54OAUY-KbSF7wevPfYvpdKoD2h51TuTnLXdWKb7n4U4n65tW-9UTBE7PVc2npvrCdSh_PaEZrhsQ6OLhYVFTYqmxNVYMbSNLUg4LDDxCeTnSoc&sig=Cg0ArKJSzHMZltoiQibvEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pcs/view?xai=AKAOjssTmtxng52fQNGzRQWQF9VLd191roW4XOG9DjC0_9VQfGHpCZ8-trLMBvIqZVaOb5meT9uo6-ISPnzCEOGxtBUbUw-biqTyAoXXhHbxpx29KdbdQD5jfaFMn8IgLpeDsbPqB8UJO54OAUY-KbSF7wevPfYvpdKoD2h51TuTnLXdWKb7n4U4n65tW-9UTBE7PVc2npvrCdSh_PaEZrhsQ6OLhYVFTYqmxNVYMbSNLUg4LDDxCeTnSoc&sig=Cg0ArKJSzHMZltoiQibvEAE&urlfix=1&adurl=
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
cookie
id=22f2a50bdb3e00fa||t=1496978568|et=730|cs=002213fd48f4f282e1e8e26553; IDE=AHWqTUl7zbUiStH9IzxlRG2LPFmnniHEwgdCS4y4jlpQRWwdeCnRsUSkug
:scheme
https
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 09 Jun 2017 03:22:49 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
0
x-xss-protection
1; mode=block
teads-format.min.js
cdn.teads.tv/media/format/v3/
596 KB
139 KB
Script
General
Full URL
http://cdn.teads.tv/media/format/v3/teads-format.min.js?2017693
Requested by
Host: cdn.teads.tv
URL: https://cdn.teads.tv/media/format.js
Protocol
HTTP/1.1
Server
95.100.186.168 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-186-168.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
5856c358cd7b45e8ed4a4cd710392afcd24f02b65c72c1507a7ac3cc08797f35

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.teads.tv
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
tt_viewer=2de54e70-a45d-4808-ae5f-2597108614bf
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:49 GMT
Content-Encoding
gzip
Last-Modified
Wed, 07 Jun 2017 12:24:07 GMT
Server
AmazonS3
x-amz-request-id
48C81925FF627A46
ETag
"55b967099fb4f209e172a3d1fdd4ef9e"
Vary
Accept-Encoding
Content-Type
text/javascript;charset=utf-8
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
142130
x-amz-id-2
iAO9AM3TonRhZrRUWYkhhHZZ47h1EqJ+nR13w8QyozUV6G2iyheA/r4DG5G9W30UYPwXMCVk+TQ=
Cookie set json
trc.taboola.com/cbsinteractive-zdnet/trc/3/
10 KB
4 KB
Script
General
Full URL
http://trc.taboola.com/cbsinteractive-zdnet/trc/3/json?tim=03%3A22%3A49.321&data=%7B%22id%22%3A909%2C%22ii%22%3A%22%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1496978569319%2C%22cv%22%3A%22257-18-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A8%2C%22uim%22%3A%22alternating-thumbnails-a%3Aabp%3D0%22%2C%22uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22orig_uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22normal%22%7D
Requested by
Host: cdn.taboola.com
URL: http://cdn.taboola.com/libtrc/impl.257-18-RELEASE.js
Protocol
HTTP/1.1
Server
151.101.114.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.10.1 /
Resource Hash
697d161683f3f155d137af4ba7345ebb4924c47ab5227bd1fbcd81453a0cdee1

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
trc.taboola.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:49 GMT
Content-Encoding
gzip
Access-Control-Allow-Origin
*
Transfer-Encoding
chunked
X-Cache
MISS
P3P
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
X-Cache-Hits
0
Connection
keep-alive
X-Served-By
cache-hhn1522-HHN
Server
nginx/1.10.1
X-Timer
S1496978569.328818,VS0,VE46
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Via
1.1 varnish
Access-Control-Allow-Credentials
true
Set-Cookie
t_gid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09;Path=/;Domain=.taboola.com;Expires=Sat, 09-Jun-2018 03:22:49 GMT taboola_session_id=v2_252ce2b55a7f52b0eafd4b8e9982312b_143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09_1496978569_1496978569_CNawjgYQzro_GOfwgNfIKyABKAE;Path=/cbsinteractive-zdnet/ JSESSIONID=.water401;Path=/ stpt="thetradedesk-network!-#@1497583369342,neustar!-#@1497583369342,bluekai!-#@1497583369342";Version=1;Path=/;Domain=.taboola.com;Expires=Sat, 09-Jun-2018 03:22:49 GMT;Max-Age=31536000 taboola_upci=CIDxgNfIKxIPFQAAAAAdAAAAACUAAAAAKg8VAAAAAB0AAAAAJQAAAAAwAA;Path=/;Expires=Sat, 09-Jun-2018 03:22:49 GMT t_vpub=CAETCM66PxABFA;Path=/;Domain=.taboola.com;Expires=Sat, 09-Jun-2018 03:22:49 GMT
Accept-Ranges
bytes
Expires
Thu, 01 Jan 1970 00:00:00 GMT
/
bttrack.com/Pixel/Impression/ Frame 603.
0
0

143672
cdn.bttrack.com/li/80/59/
2 KB
2 KB
Image
General
Full URL
http://cdn.bttrack.com/li/80/59/143672
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
52.84.34.90 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-84-34-90.ewr50.r.cloudfront.net
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
f153297b055e329ec72a2633f1c5c01009e73cf2c197e4c078c539b11a0c367b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.bttrack.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
GLOBALID=2uKlc8-sIBd987HhIIG6ZJ394IvmWVAddZE_n-rLvEUO3zr2cPDHqoPNnBtS5MYaRp3dhCHTlbM1
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

X-ServerName
NATIVE01
Date
Fri, 09 Jun 2017 03:22:48 GMT
Via
1.1 e364a215258bbfb310702eaedcb82e22.cloudfront.net (CloudFront)
X-AspNetMvc-Version
5.2
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
X-Cache
Miss from cloudfront
P3P
policyref="http://www.bidtellect.com/w3c/p3p.xml", CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Cache-Control
private
Connection
keep-alive
Content-Type
image/jpeg
Content-Length
2513
X-Amz-Cf-Id
ygU99x8PkIkjn_ad6Xv9FS9Oq9qeGTRm_3iVOXPnOL4wPJUEJkV8GQ==
3aadbb71016ecd7a194bbe2791777e9a.png
cdn.taboola.com/libtrc/static/thumbnails/
581 B
581 B
Image
General
Full URL
http://cdn.taboola.com/libtrc/static/thumbnails/3aadbb71016ecd7a194bbe2791777e9a.png
Requested by
Host: cdn.taboola.com
URL: http://cdn.taboola.com/libtrc/impl.257-18-RELEASE.js
Protocol
HTTP/1.1
Server
151.101.114.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
528b6b3e8edb272a61e1d3b10f11af0d241680684143fb5339fa2758a3e65187

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.taboola.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
t_gid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09; stpt="thetradedesk-network!-#@1497583369342,neustar!-#@1497583369342,bluekai!-#@1497583369342"; t_vpub=CAETCM66PxABFA
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

x-amz-version-id
6aZUfTQ.S26Y_1N5QpSv75PDrWc.NB7q
Via
1.1 varnish
ETag
"2697f4b848d2400cd051312585a6bf42"
Age
9306007
X-Cache
HIT
x-amz-replication-status
COMPLETED
Connection
keep-alive
Content-Length
581
x-amz-id-2
AWmoybLoPXqCGftv+GDA2/l2jN9dPD/UEl8vHjg3hENR1illpBms7pe39N2/i0/Lk2uIwuSeyEQ=
X-Served-By
cache-hhn1545-HHN
Last-Modified
Wed, 24 Jun 2015 08:00:33 GMT
Server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1426488754/atime:1435045951/md5:2697f4b848d2400cd051312585a6bf42/ctime:1426488754
X-Timer
S1496978569.466408,VS0,VE0
Date
Fri, 09 Jun 2017 03:22:49 GMT
x-amz-request-id
4728F86E40808AFB
Cache-Control
private,max-age=31536000
Accept-Ranges
bytes
Content-Type
image/png
X-Cache-Hits
28544965
f539211219b796ffbb49949997c764f0.png
cdn.taboola.com/libtrc/static/thumbnails/
254 B
254 B
Image
General
Full URL
http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
Requested by
Host: cdn.taboola.com
URL: http://cdn.taboola.com/libtrc/impl.257-18-RELEASE.js
Protocol
HTTP/1.1
Server
151.101.114.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.taboola.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
t_gid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09; stpt="thetradedesk-network!-#@1497583369342,neustar!-#@1497583369342,bluekai!-#@1497583369342"; t_vpub=CAETCM66PxABFA
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

x-amz-version-id
hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC
Via
1.1 varnish
ETag
"dfa7b52c86e56bd67fa4002f6ed19854"
Age
8876815
X-Cache
HIT
x-amz-replication-status
COMPLETED
Connection
keep-alive
Content-Length
254
x-amz-id-2
XvamycYj5i9elo1HIxQVWoqB3bzM0MDs3mgweXjpvYdi7ZZIyzbyvzEvbwKvdJGIx5LiaLJce0k=
X-Served-By
cache-hhn1543-HHN
Last-Modified
Wed, 24 Jun 2015 07:14:11 GMT
Server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567
X-Timer
S1496978569.468297,VS0,VE0
Date
Fri, 09 Jun 2017 03:22:49 GMT
x-req
/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
x-amz-request-id
093E8082E423E036
Cache-Control
private,max-age=31536000
Accept-Ranges
bytes
Content-Type
image/png
X-Cache-Hits
16462290
rtb-h
match.taboola.com/sg/thetradedesk-network/1/ Frame 603.
Redirect Chain
  • http://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=70df82eb-b8d1-4e97-b70c-10d3446fdea5
  • http://match.taboola.com/sg/thetradedesk-network/1/rtb-h?taboola_hm=70df82eb-b8d1-4e97-b70c-10d3446fdea5&tbid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09
0
0
Image
General
Full URL
http://match.taboola.com/sg/thetradedesk-network/1/rtb-h?taboola_hm=70df82eb-b8d1-4e97-b70c-10d3446fdea5&tbid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
151.101.14.49 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.9.12 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
match.taboola.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Cache-Control
no-cache
Cookie
stpt="thetradedesk-network!-#@1497583369342,neustar!-#@1497583369342,bluekai!-#@1497583369342"; t_vpub=CAETCM66PxABFA; t_gid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09; taboola_usg=GgQQ9KlB
Connection
keep-alive
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Via
1.1 varnish
Server
nginx/1.9.12
X-Timer
S1496978570.446212,VS0,VE9
X-Served-By
cache-fra1240-FRA
X-Cache
MISS
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
X-Cache-Hits
0

Redirect headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Via
1.1 varnish
Server
nginx/1.10.1
X-Timer
S1496978570.601052,VS0,VE742
X-Cache
MISS
Location
http://match.taboola.com/sg/thetradedesk-network/1/rtb-h?taboola_hm=70df82eb-b8d1-4e97-b70c-10d3446fdea5&tbid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09
Set-Cookie
t_gid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09;Path=/;Domain=.taboola.com;Expires=Sat, 09-Jun-2018 03:22:50 GMT taboola_usg=GgQQ9KlB;Path=/;Domain=.taboola.com;Expires=Sat, 09-Jun-2018 03:22:50 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
X-Cache-Hits
0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
X-Served-By
cache-hhn1522-HHN
Cookie set cm
trc.taboola.com/sg/bluekai/1/ Frame 603.
Redirect Chain
  • http://tags.bluekai.com/site/35702?dt=0&r=287950946&sig=2551099617&bkca=KJy+iLWvy09xHndslQ0SBR688aJYGwuzLfig+o/WyjgdfhTv1XmqRUvR+xWz/aCJz5euJODAl+cv8sZ6skVvG8c+GQRyKEU5SQ08p3J4VSNuNp0VzFim0L7n2XtOh...
  • http://trc.taboola.com/sg/bluekai/1/cm?taboola_hm=dn%2FwiWyA99ed7poj
0
0
Image
General
Full URL
http://trc.taboola.com/sg/bluekai/1/cm?taboola_hm=dn%2FwiWyA99ed7poj
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
151.101.114.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.10.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
trc.taboola.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Cache-Control
no-cache
Cookie
t_gid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09; JSESSIONID=.water401; stpt="thetradedesk-network!-#@1497583369342,neustar!-#@1497583369342,bluekai!-#@1497583369342"; taboola_upci=CIDxgNfIKxIPFQAAAAAdAAAAACUAAAAAKg8VAAAAAB0AAAAAJQAAAAAwAA; t_vpub=CAETCM66PxABFA
Connection
keep-alive
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:49 GMT
Via
1.1 varnish
Server
nginx/1.10.1
X-Timer
S1496978570.801687,VS0,VE8
X-Cache
MISS
Set-Cookie
t_gid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09;Path=/;Domain=.taboola.com;Expires=Sat, 09-Jun-2018 03:22:49 GMT taboola_usg=Ig0KB2JsdWVrYWkSAggB;Path=/;Domain=.taboola.com;Expires=Sat, 09-Jun-2018 03:22:49 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
X-Cache-Hits
0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
X-Served-By
cache-hhn1525-HHN

Redirect headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
Location
//trc.taboola.com/sg/bluekai/1/cm?taboola_hm=dn%2FwiWyA99ed7poj
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
nnCoection
close
Cache-Control
max-age=0, no-cache, no-store
Set-Cookie
bku=m3X99/ADmkZvmxI/; expires=Wed, 06-Dec-2017 03:22:49 GMT; path=/; domain=.bluekai.com
Content-Type
text/html
Content-Length
0
BK-Server
5040
Expires
Thu, 01 Dec 1994 16:00:00 GMT
Cookie set cm
trc.taboola.com/sg/neustar/1/ Frame 603.
Redirect Chain
  • http://d.agkn.com/pixel/8463/?che=1496978569&sk=163850202351000158163&puid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09&l0=http://trc.taboola.com/sg/neustar/1/cm?taboola_hm=163850202351000158163
  • http://trc.taboola.com/sg/neustar/1/cm?taboola_hm=163850202351000158163
0
0
Image
General
Full URL
http://trc.taboola.com/sg/neustar/1/cm?taboola_hm=163850202351000158163
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
151.101.114.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.10.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
trc.taboola.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Cache-Control
no-cache
Cookie
JSESSIONID=.water401; stpt="thetradedesk-network!-#@1497583369342,neustar!-#@1497583369342,bluekai!-#@1497583369342"; taboola_upci=CIDxgNfIKxIPFQAAAAAdAAAAACUAAAAAKg8VAAAAAB0AAAAAJQAAAAAwAA; t_vpub=CAETCM66PxABFA; t_gid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09; taboola_usg=Ig0KB2JsdWVrYWkSAggB
Connection
keep-alive
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Via
1.1 varnish
Server
nginx/1.10.1
X-Timer
S1496978570.031250,VS0,VE8
X-Cache
MISS
Set-Cookie
t_gid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09;Path=/;Domain=.taboola.com;Expires=Sat, 09-Jun-2018 03:22:50 GMT taboola_usg=Ig0KB2JsdWVrYWkSAggBIg0KB25ldXN0YXISAggB;Path=/;Domain=.taboola.com;Expires=Sat, 09-Jun-2018 03:22:50 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
X-Cache-Hits
0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
X-Served-By
cache-hhn1525-HHN

Redirect headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
Server
Apache-Coyote/1.1
P3P
CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
http://trc.taboola.com/sg/neustar/1/cm?taboola_hm=163850202351000158163
Set-Cookie
ab=0001%3AmOk45jY4MJo3hJT41V9NVNjxOpLwtaYk;Max-Age=31536000;domain=agkn.com;path=/ u=C|0CAIAAAAAIMzRCQAAAAAAAAACARYAAAAALC0AAAAA;Max-Age=31536000;domain=agkn.com;path=/
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Sat, 01 Jan 2000 00:00:00 GMT
iframe
sync.teads.tv/ Frame 603.
0
0

ad
a.teads.tv/page/0/
7 KB
1 KB
XHR
General
Full URL
http://a.teads.tv/page/0/ad?windowWidth=1598&windowHeight=1132&windowDepth=1&windowReferrerUrl=&page=%7B%22id%22%3A0%2C%22placements%22%3A%5B%7B%22id%22%3A61059%2C%22validity%22%3A%7B%22status%22%3Atrue%2C%22reasons%22%3A%5B%5D%7D%2C%22player%22%3A%7B%22width%22%3A620%2C%22height%22%3A349%7D%2C%22slotType%22%3A%22native%22%7D%5D%7D&userId=300307ed-807e-463d-bce8-e1b0e0e3c93a&formatVersion=2.14.15&env=js-web
Requested by
Host: cdn.teads.tv
URL: http://cdn.teads.tv/media/format/v3/teads-format.min.js?2017693
Protocol
HTTP/1.1
Server
52.31.88.15 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-31-88-15.eu-west-1.compute.amazonaws.com
Software
teads-ssp /
Resource Hash
33e93d0302563436613b0cd260b87da3a88b35ca805868077cd468d2d8d0ecf2

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
a.teads.tv
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
application/json; charset=UTF-8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
tt_viewer=2de54e70-a45d-4808-ae5f-2597108614bf
Connection
keep-alive
Cache-Control
no-cache
Accept
application/json; charset=UTF-8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
Content-Encoding
gzip
Server
teads-ssp
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
http://www.zdnet.com
Cache-Control
no-cache, must-revalidate, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
1262
Expires
0
track
t.teads.tv/
23 B
23 B
Image
General
Full URL
http://t.teads.tv/track?action=placementCall&pageId=0&pid=61059&gid=&slot=native&env=js-web&ts=1496978569553
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
52.30.66.229 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-30-66-229.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
t.teads.tv
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
tt_viewer=2de54e70-a45d-4808-ae5f-2597108614bf
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Expires
Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
23
Content-Type
image/gif
track
t.teads.tv/
23 B
23 B
Image
General
Full URL
http://t.teads.tv/track?action=slotAvailable&pageId=0&pid=61059&gid=&slot=native&env=js-web&ts=1496978569553
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
52.30.66.229 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-30-66-229.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
t.teads.tv
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
tt_viewer=2de54e70-a45d-4808-ae5f-2597108614bf
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Expires
Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
23
Content-Type
image/gif
livefyre_mod_main.js
zor.fyre.co/wjs/v3.0.1496355585/javascripts/
21 KB
7 KB
Script
General
Full URL
http://zor.fyre.co/wjs/v3.0.1496355585/javascripts/livefyre_mod_main.js
Requested by
Host: cdn.livefyre.com
URL: http://cdn.livefyre.com/libs/fyre.conv/v3.0.0/livefyre.min.js
Protocol
HTTP/1.1
Server
54.192.36.140 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-192-36-140.jfk1.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
7f81966a91cf11fd69984ae03875657b4ef3bb11f9bab23a0830710b71d5d37f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zor.fyre.co
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 01 Jun 2017 22:23:39 GMT
Content-Encoding
gzip
Last-Modified
Thu, 01 Jun 2017 22:21:07 GMT
Server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:1001/gname:deployment/uname:deployment/gid:1001/mode:33188/mtime:1496355640/atime:1496355640/ctime:1496355640
Age
622751
ETag
"88ef5c2ec2ad6f377f01107659cd9201"
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Via
1.1 6f4c292df8fb7b5bd5bfa8aff66748aa.cloudfront.net (CloudFront)
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
7479
X-Amz-Cf-Id
LSm0R9H1-nBmfi70Aln0ExaiuZIGLqzqE4h7KL3lVTThDlc9mqdovw==
rum.js
pagead2.googlesyndication.com/pagead/js/ Frame 603.
34 KB
13 KB
Script
General
Full URL
http://pagead2.googlesyndication.com/pagead/js/rum.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Server
2a00:1450:4001:824::2002 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
3cb8af8f49d328177a46138d9da7d57cf87cccddbfb8bac3092562d414d30d92
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pagead2.googlesyndication.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:02:38 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
cafe
Age
1211
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
ETag
18364998708581736293
Content-Type
text/javascript; charset=UTF-8
Cache-Control
public, max-age=3600
Content-Disposition
attachment; filename="f.txt"
Timing-Allow-Origin
*
Content-Length
12872
X-XSS-Protection
1; mode=block
Expires
Fri, 09 Jun 2017 04:02:38 GMT
activeview
pagead2.googlesyndication.com/ Frame 603.
42 B
42 B
Image
General
Full URL
http://pagead2.googlesyndication.com/activeview?avi=B9f28iRQ6WbrlAoysbMachKgMAAAAABABOAHIAQnAAgLgAgDgBAGgBh_SCAUIgGEQAQ&cid=CAASEuRoR3kyc_edkwH9YAD94E_xDA&id=osdim&ti=1&adk=2442809371&mtos=0,0,0,0,0&tos=0,0,0,0,0&p=0,0,0,0&mcvt=0&rs=3&ht=0&mc=0&lte=-1&bas=1&bac=1&gte=108809107&tmo=10&tme=10&rtl=false&til=10&tlr=80&tlrd=62&r=u&bs=1583,1132&bos=1598,1132&ps=1583,6401&ss=1600,1200&tt=299&pt=-1&deb=1-0-2-2-2--1&tvt=0&iframe_loc=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&is=371,771&avms=geo&uc=1&tgt=BODY&cl=1&cec=6&clc=0&cd=372x0
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
2a00:1450:4001:824::2002 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pagead2.googlesyndication.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
X-Content-Type-Options
nosniff
Server
cafe
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, must-revalidate
Timing-Allow-Origin
*
Content-Length
42
X-XSS-Protection
1; mode=block
Expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/ Frame 603.
42 B
42 B
Image
General
Full URL
http://pagead2.googlesyndication.com/activeview?avi=BEEO9hxQ6WcaWLaXPxgKlub3ADAAAAAAQATgByAEJwAIC4AIA4AQBoAYf0ggFCIBhEAE&cid=CAASBORoXSY&id=osdim&ti=1&adk=3113356553&mtos=0,0,0,0,0&tos=0,0,0,0,0&p=0,0,0,0&mcvt=0&rs=3&ht=0&mc=0&lte=-1&bas=1&bac=1&gte=108809103&tmo=4&tme=482&rtl=false&til=482&tdl=146&tdld=151&tcl=332&tcld=16&tlr=146&tlrd=151&r=u&bs=1583,1132&bos=1598,1132&ps=1583,6275&ss=1600,1200&tt=1125&pt=-1&deb=1-0-12-9-10--1&tvt=0&avms=geo&uc=1&tgt=BODY&cl=1&cec=8&clc=0&cd=0x0
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
2a00:1450:4001:824::2002 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pagead2.googlesyndication.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
X-Content-Type-Options
nosniff
Server
cafe
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, must-revalidate
Timing-Allow-Origin
*
Content-Length
42
X-XSS-Protection
1; mode=block
Expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/ Frame 603.
42 B
42 B
Image
General
Full URL
http://pagead2.googlesyndication.com/activeview?avi=BMqgThxQ6WcqWLaXPxgKlub3ADAAAAAAQATgByAEJwAIC4AIA4AQBoAYf0ggFCIBhEAE&cid=CAASBORoiq8&id=osdim&ti=1&adk=973953724&mtos=0,0,0,0,0&tos=0,0,0,0,0&p=0,0,0,0&mcvt=0&rs=3&ht=0&mc=0&lte=-1&bas=1&bac=1&gte=108809103&tmo=5&tme=483&rtl=false&til=483&tdl=234&tdld=165&tcl=148&tcld=497&tlr=148&tlrd=497&r=u&bs=1583,1132&bos=1598,1132&ps=1583,6275&ss=1600,1200&tt=1125&pt=-1&deb=1-0-12-9-10--1&tvt=0&avms=geo&uc=1&tgt=BODY&cl=1&cec=5&clc=0&cd=300x0
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
2a00:1450:4001:824::2002 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pagead2.googlesyndication.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
X-Content-Type-Options
nosniff
Server
cafe
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, must-revalidate
Timing-Allow-Origin
*
Content-Length
42
X-XSS-Protection
1; mode=block
Expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/ Frame 603.
42 B
42 B
Image
General
Full URL
http://pagead2.googlesyndication.com/activeview?avi=BRBnzhxQ6Wc6WLaXPxgKlub3ADAAAAAAQATgByAEJwAIC4AIA4AQBoAYf0ggFCIBhEAE&cid=CAASBORoyfY&id=osdim&ti=1&adk=1434303317&mtos=0,0,0,0,0&tos=0,0,0,0,0&p=0,0,0,0&mcvt=0&rs=3&ht=0&mc=0&lte=-1&bas=1&bac=1&gte=108809103&tmo=6&tme=485&rtl=false&til=485&tdl=246&tdld=114&tcl=148&tcld=486&tlr=148&tlrd=486&r=u&bs=1583,1132&bos=1598,1132&ps=1583,6275&ss=1600,1200&tt=1125&pt=-1&deb=1-0-12-9-10--1&tvt=0&avms=geo&uc=1&tgt=BODY&cl=1&cec=5&clc=0&cd=300x0
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
2a00:1450:4001:824::2002 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pagead2.googlesyndication.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
X-Content-Type-Options
nosniff
Server
cafe
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, must-revalidate
Timing-Allow-Origin
*
Content-Length
42
X-XSS-Protection
1; mode=block
Expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/ Frame 603.
42 B
42 B
Image
General
Full URL
http://pagead2.googlesyndication.com/activeview?avi=BvMlQhxQ6Wc-WLaXPxgKlub3ADAAAAAAQATgByAEJwAIC4AIA4AQBoAYW0ggFCIBhEAE&cid=CAASBORoC40&id=osdim&ti=1&adk=2779441031&mtos=0,0,0,0,0&tos=0,0,0,0,0&p=0,0,0,0&mcvt=0&rs=3&ht=0&mc=0&lte=-1&bas=1&bac=1&gte=108809103&tmo=6&tme=471&rtl=false&til=471&tdl=134&tdld=200&tcl=148&tcld=483&tlr=134&tlrd=200&r=u&bs=1583,1132&bos=1598,1132&ps=1583,6275&ss=1600,1200&tt=1125&pt=-1&deb=1-0-12-9-10--1&tvt=0&avms=geo&uc=1&tgt=BODY&cl=1&cec=5&clc=0&cd=641x0
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
2a00:1450:4001:824::2002 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pagead2.googlesyndication.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
X-Content-Type-Options
nosniff
Server
cafe
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, must-revalidate
Timing-Allow-Origin
*
Content-Length
42
X-XSS-Protection
1; mode=block
Expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/ Frame 603.
42 B
42 B
Image
General
Full URL
http://pagead2.googlesyndication.com/activeview?avi=B1tDqhxQ6WdCWLaXPxgKlub3ADAAAAAAQATgByAEJwAIC4AIA4AQBoAYf0ggFCIBhEAE&cid=CAASBORopl8&id=osdim&ti=1&adk=1702138152&mtos=0,0,0,0,0&tos=0,0,0,0,0&p=0,0,0,0&mcvt=0&rs=3&ht=0&mc=0&lte=-1&bas=1&bac=1&gte=108809103&tmo=6&tme=473&rtl=false&til=473&tdl=140&tdld=188&tcl=148&tcld=480&tlr=140&tlrd=188&r=u&bs=1583,1132&bos=1598,1132&ps=1583,6275&ss=1600,1200&tt=1125&pt=-1&deb=1-0-12-9-10--1&tvt=0&avms=geo&uc=1&tgt=BODY&cl=1&cec=5&clc=0&cd=728x0
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
2a00:1450:4001:824::2002 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pagead2.googlesyndication.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
X-Content-Type-Options
nosniff
Server
cafe
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, must-revalidate
Timing-Allow-Origin
*
Content-Length
42
X-XSS-Protection
1; mode=block
Expires
Fri, 01 Jan 1990 00:00:00 GMT
init
data.livefyre.com/bs3/v3.1/zdnet.fyre.co/360461/MjcwODE2OTYtMzRlNS0xMWU0LTllNmEtMDA1MDU2ODUxMTlh/
13 KB
4 KB
XHR
General
Full URL
http://data.livefyre.com/bs3/v3.1/zdnet.fyre.co/360461/MjcwODE2OTYtMzRlNS0xMWU0LTllNmEtMDA1MDU2ODUxMTlh/init
Requested by
Host: cdn.livefyre.com
URL: http://cdn.livefyre.com/libs/fyre.conv/v3.0.0/livefyre.min.js
Protocol
HTTP/1.1
Server
151.101.112.233 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache/2.2.22 (Ubuntu) /
Resource Hash
4de69e960fb2afc8e2e6863650882d5514bca5971b51ada30619abf03f6f81c9

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
data.livefyre.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com

Response headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Content-Encoding
gzip
Age
0
Accept-Ranges
bytes
X-TR-TTL
120.000
X-TR-Cached
yes
Access-Control-Max-Age
1728000
X-Cache
MISS, MISS
Connection
keep-alive
Content-Length
3657
X-Served-By
vf24.prod.livefyre.com, cache-hhn1536-HHN
Access-Control-Allow-Origin
http://www.zdnet.com
Last-Modified
Fri, 09 Jun 2017 03:22:50 GMT
Server
Apache/2.2.22 (Ubuntu)
X-Timer
S1496978570.790573,VS0,VE370
Vary
Accept-Encoding,Origin
Access-Control-Allow-Methods
GET, POST, PUT, DELETE, PATCH
Content-Type
application/json
Via
1.1 varnish 1.1 varnish
Cache-Control
public, max-age=120, s-maxage=120
X-Server
bs21
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
Content-Type, accept, authorization
X-Cache-Hits
0
Cookie set /
www.zdnet.com/livefyre/user-token/
34 B
54 B
XHR
General
Full URL
http://www.zdnet.com/livefyre/user-token/
Requested by
Host: zdnet3.cbsistatic.com
URL: http://zdnet3.cbsistatic.com/fly/883-fly/js/main.default.js
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
6f7d2101a47c82983248e5ce834d3e7a9545285c11ba7d0d1bc00d7dff29aa13

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.zdnet.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
application/json, text/javascript, */*; q=0.01
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
X-Requested-With
XMLHttpRequest
Cookie
AMCVS_10D31225525FF5790A490D4D%40AdobeOrg=1; bm_last_load_status=NOT_BLOCKING; bm_monthly_unique=true; bm_daily_unique=true; _tb_sess_r=; _tb_t_ppg=http%3A//www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/; bm_sample_frequency=100; s_cc=true; AMCV_10D31225525FF5790A490D4D%40AdobeOrg=-1248264605%7CMCMID%7C82019002344760642192159551723785266833%7CMCAAMLH-1497583367%7C6%7CMCAAMB-1497583368%7CcIBAx_aQzFEHcPoEv0GwcQ%7CMCOPTOUT-1496985768s%7CNONE%7CMCAID%7C2C9D0A4405312D21-600001008000086D; _ga=GA1.2.519849922.1496978568; _gid=GA1.2.2086022008.1496978569; _gat__pm_ga=1; aam_uuid=81798148289666930272139155021439591401; __gads=ID=5862cbe659e0fc4d:T=1496978569:S=ALNI_Ma30Latm-HXDUGa_ZUNEGJSHYNrzg; trc_cookie_storage=cbsinteractive-zdnet%253Asession-data%3Dv2_252ce2b55a7f52b0eafd4b8e9982312b_143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09_1496978569_1496978569_CNawjgYQzro_GOfwgNfIKyABKAE%7Ctaboola%2520global%253Alocal-storage-keys%3D%255B%2522cbsinteractive-zdnet%253Asession-data%2522%252C%2522taboola%2520global%253Auser-id%2522%255D%7Ctaboola%2520global%253Auser-id%3D143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09
Connection
keep-alive
Cache-Control
no-cache
Accept
application/json, text/javascript, */*; q=0.01
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:50 GMT
Content-Encoding
gzip
Server
nginx
Connection
keep-alive
Vary
Accept-Encoding
X-Tx-Id
1448b6d7-a28c-441b-96dc-1b9b4807ab41
Content-Type
application/json
Cache-Control
max-age=0, no-cache, no-store
Set-Cookie
fly_geo={"countryCode": "de"}; expires=Fri, 16-Jun-2017 03:22:50 GMT; path=/; domain=.zdnet.com fly_default_edition=eu; expires=Fri, 16-Jun-2017 03:22:50 GMT; path=/; domain=.zdnet.com fly_device=desktop; expires=Fri, 16-Jun-2017 03:22:50 GMT; path=/; domain=.zdnet.com ak_bmsc=696881092272EF0930C85E1E20196A6548F7B204AE4800008A143A597B2EC813~plZQAA624bv5b5eaeDRrYe7jRXnRbuTp3XCItTIgWaY8PypUzNDmpAEVsOHn0JJpGHF1J+HWLxW2OI4zYAgBQqRi40fH+WQuY/MC44H7GmUGenmNgXJa+grkAMajKdpMGRbZtCNqeLY7VT1QicmywR3GVUvH6bTjzLXpveP+nTlU1O2JSwpmFDJ1AryyFXqS1Pg2fang+p9lJCa97NEk4v6VNpNtziZQyiQghW1KInG6s=; expires=Fri, 09 Jun 2017 05:22:50 GMT; max-age=7200; path=/; domain=.zdnet.com; HttpOnly
Accept-Ranges
bytes
Content-Length
54
Expires
Fri, 09 Jun 2017 03:22:50 GMT
d6a4d29f-dd0f-433d-95de-91e9d35960b2
a.teads.tv/vast/
16 KB
2 KB
XHR
General
Full URL
http://a.teads.tv/vast/d6a4d29f-dd0f-433d-95de-91e9d35960b2
Requested by
Host: cdn.teads.tv
URL: http://cdn.teads.tv/media/format/v3/teads-format.min.js?2017693
Protocol
HTTP/1.1
Server
52.31.88.15 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-31-88-15.eu-west-1.compute.amazonaws.com
Software
teads-ssp /
Resource Hash
6b67f5de941377455d3fdd0cb6db86aeda8b0918b66ffb5127b35d81f0317b1e

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
a.teads.tv
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
tt_viewer=2de54e70-a45d-4808-ae5f-2597108614bf
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
Content-Encoding
gzip
Server
teads-ssp
Content-Type
text/xml; charset=UTF-8
Access-Control-Allow-Origin
http://www.zdnet.com
Cache-Control
no-cache, must-revalidate, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
1942
Expires
0
720.mp4
cdn2.teads.tv/scala/141548/aef8ad1069fa72d00fc7ffc16a62d06b/
0
0
XHR
General
Full URL
http://cdn2.teads.tv/scala/141548/aef8ad1069fa72d00fc7ffc16a62d06b/720.mp4?1496978569918
Requested by
Host: cdn.teads.tv
URL: http://cdn.teads.tv/media/format/v3/teads-format.min.js?2017693
Protocol
HTTP/1.1
Server
95.100.186.168 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-186-168.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
cdn2.teads.tv
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com

Response headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Last-Modified
Wed, 07 Jun 2017 14:47:13 GMT
Server
AmazonS3
x-amz-request-id
B37D49C42B905A35
ETag
"3ba80927be22d5dfe094bf0966fdfa78"
Access-Control-Max-Age
3000
Access-Control-Allow-Methods
GET, HEAD, POST
Content-Type
video/mp4
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Content-Length, Content-Range
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6807031
x-amz-id-2
9qUj5Nj2OI68/lpu92p+CyHhkb6ctssC9qm0AjHuAJ3wGPJIsWuegouQMtEwPOQSx0gKo9mT1tU=
/
bootstrap.livefyre.com/api/v4/configuration/zdnet.fyre.co/site/360461/
59 B
59 B
XHR
General
Full URL
http://bootstrap.livefyre.com/api/v4/configuration/zdnet.fyre.co/site/360461/?section=translations&translations.lang_code=en-US&translations.app=comment-component
Requested by
Host: cdn.livefyre.com
URL: http://cdn.livefyre.com/libs/fyre.conv/v3.0.0/livefyre.min.js
Protocol
HTTP/1.1
Server
52.201.11.100 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-201-11-100.compute-1.amazonaws.com
Software
gunicorn/19.6.0 /
Resource Hash
79f07fe10edf4d842913bd2121283f4bdc01044ef113f53e85d247f67f914f4e

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
bootstrap.livefyre.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com

Response headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Via
1.1 varnish
Vary
Origin
Age
24
X-TR-TTL
60.000
X-Cache
HIT
Connection
keep-alive
Content-Length
59
X-Index-Last-Modified
2017-06-09 03:22:26.224141
X-Served-By
vf26.prod.livefyre.com
Accept-Ranges
bytes
Server
gunicorn/19.6.0
Access-Control-Max-Age
1728000
Access-Control-Allow-Methods
GET, POST, PUT, DELETE, PATCH
X-Varnish
1303006804 1302985519
Access-Control-Allow-Origin
http://www.zdnet.com
Cache-Control
max-age=60
X-Server
bsserver1
X-TR-Cached
yes
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Headers
Content-Type, accept, authorization
Access-Control-Allow-Credentials
true
X-Cache-Hits
45
rum.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/ Frame 603.
34 KB
13 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/rum.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
3cb8af8f49d328177a46138d9da7d57cf87cccddbfb8bac3092562d414d30d92
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/js/r20170605/r20110914/rum.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Tue, 06 Jun 2017 02:01:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
264103
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
12872
x-xss-protection
1; mode=block
server
cafe
etag
18364998708581736293
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 20 Jun 2017 02:01:07 GMT
Cookie set domains
api.viglink.com/api/
42 B
42 B
XHR
General
Full URL
http://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: http://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Server
52.17.60.112 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-17-60-112.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
c09f777fd80a646341d2ece59fb93df47b583c3649631e159f9e96c41aab2d00

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate
Host
api.viglink.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Accept
*/*
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Content-Length
208
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:49 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
http://www.zdnet.com
Set-Cookie
vglnk.Agent.p=4c20446b70137829c06f930c445610a7; Domain=.viglink.com; Expires=Mon, 07-Jun-2027 03:22:50 GMT; Path=/
Cache-Control
no-cache no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT
the-maskapt.jpg
zdnet4.cbsistatic.com/hub/i/2014/10/04/7068430f-4be9-11e4-b6a0-d4ae52e95e57/4c549ce567ae0ad63103800b8c7ab0c9/
1002 KB
1000 KB
Image
General
Full URL
http://zdnet4.cbsistatic.com/hub/i/2014/10/04/7068430f-4be9-11e4-b6a0-d4ae52e95e57/4c549ce567ae0ad63103800b8c7ab0c9/the-maskapt.jpg
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
72.247.178.24 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-24.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
776cd5b2e2140b2a5dd6f2d5a1ace401d389a8fc996b5de828b2b1a56ebc3de4

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet4.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Oct 2014 05:43:35 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
image/jpeg
Access-Control-Allow-Origin
http://origin.img.hub.zdnet.com
Cache-Control
max-age=5184000
Connection
keep-alive
Content-Length
1023733
Expires
Tue, 08 Aug 2017 03:22:50 GMT
f62536e294ad204eba9ebaa5a248ed40.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/
8 KB
8 KB
Image
General
Full URL
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/f62536e294ad204eba9ebaa5a248ed40.png
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
151.101.114.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
f15329eb993dc1905ea4deb82e1802237f14ecf8bf56d8b8b2dd08525b86814e

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
images.taboola.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
stpt="thetradedesk-network!-#@1497583369342,neustar!-#@1497583369342,bluekai!-#@1497583369342"; t_vpub=CAETCM66PxABFA; t_gid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09; taboola_usg=Ig0KB2JsdWVrYWkSAggBIg0KB25ldXN0YXISAggB
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Via
1.1 varnish
Age
1802782
X-Cache
HIT
Connection
keep-alive
X-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/f62536e294ad204eba9ebaa5a248ed40.png
Content-Length
8081
X-Served-By
cache-hhn1548-HHN
Last-Modified
Wed, 19 Apr 2017 06:36:21 GMT
Server
cloudinary
X-Timer
S1496978570.325248,VS0,VE0
ETag
"6b2271c269afc5612142226f2b20fc2e"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
Accept-Ranges
bytes
Access-Control-Allow-Headers
X-Requested-With
X-Cache-Hits
1
b96652896dd3fe84e21a17d3c840a9dc.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/
7 KB
7 KB
Image
General
Full URL
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/b96652896dd3fe84e21a17d3c840a9dc.jpg
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
151.101.114.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
59e63ae7728cb41dfa246ae8e6b4e2be283ee731737b10858e4a373d148df985

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
images.taboola.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
stpt="thetradedesk-network!-#@1497583369342,neustar!-#@1497583369342,bluekai!-#@1497583369342"; t_vpub=CAETCM66PxABFA; t_gid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09; taboola_usg=Ig0KB2JsdWVrYWkSAggBIg0KB25ldXN0YXISAggB
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Via
1.1 varnish
Age
1153297
X-Cache
HIT
Connection
keep-alive
X-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/b96652896dd3fe84e21a17d3c840a9dc.jpg
Content-Length
7469
X-Served-By
cache-hhn1522-HHN
Last-Modified
Tue, 25 Apr 2017 06:20:35 GMT
Server
cloudinary
X-Timer
S1496978570.324054,VS0,VE0
ETag
"84802085a765abf8d7ce19ba7eb7aa81"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
Accept-Ranges
bytes
Access-Control-Allow-Headers
X-Requested-With
X-Cache-Hits
7
V_EN_600x500_Dali_2017-0302_02_Zaice_5b32b7ea43ce3cee82af00516db1f976.600x500.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/041ca465-399e-4bcf-9b7d-edb6b5c8d972/
7 KB
7 KB
Image
General
Full URL
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/041ca465-399e-4bcf-9b7d-edb6b5c8d972/V_EN_600x500_Dali_2017-0302_02_Zaice_5b32b7ea43ce3cee82af00516db1f976.600x500.png
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
151.101.114.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
dc464adf246186393741b0f44a1d13705f830814b4d3428b5578a40db15c6352

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
images.taboola.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
stpt="thetradedesk-network!-#@1497583369342,neustar!-#@1497583369342,bluekai!-#@1497583369342"; t_vpub=CAETCM66PxABFA; t_gid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09; taboola_usg=Ig0KB2JsdWVrYWkSAggBIg0KB25ldXN0YXISAggB
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Via
1.1 varnish
Age
1035687
X-Cache
HIT
Connection
keep-alive
X-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/041ca465-399e-4bcf-9b7d-edb6b5c8d972/V_EN_600x500_Dali_2017-0302_02_Zaice_5b32b7ea43ce3cee82af00516db1f976.600x500.png
Content-Length
7066
X-Served-By
cache-hhn1527-HHN
Last-Modified
Wed, 03 May 2017 07:13:14 GMT
Server
cloudinary
X-Timer
S1496978570.329719,VS0,VE0
ETag
"1aadcab504c40b01c6267fb97f11904f"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
Accept-Ranges
bytes
Access-Control-Allow-Headers
X-Requested-With
X-Cache-Hits
2
be4ccff8c4ca5716c63abf90a38cd87ba04c6b7b8509948f2afa3264
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//gleaned-images.stuff.com/signals-test/
4 KB
4 KB
Image
General
Full URL
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//gleaned-images.stuff.com/signals-test/be4ccff8c4ca5716c63abf90a38cd87ba04c6b7b8509948f2afa3264
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
151.101.114.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
73ffdcce854ad81be3d51dded6a94a88d3cf06e47633f7f510d8b601e37969d6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
images.taboola.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
stpt="thetradedesk-network!-#@1497583369342,neustar!-#@1497583369342,bluekai!-#@1497583369342"; t_vpub=CAETCM66PxABFA; t_gid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09; taboola_usg=Ig0KB2JsdWVrYWkSAggBIg0KB25ldXN0YXISAggB
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Via
1.1 varnish
Age
691232
X-Cache
HIT
Status
200 OK
Connection
keep-alive
X-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//gleaned-images.stuff.com/signals-test/be4ccff8c4ca5716c63abf90a38cd87ba04c6b7b8509948f2afa3264
Content-Length
4315
X-Request-Id
7419c6c331c2c861
X-Served-By
cache-hhn1529-HHN
Last-Modified
Sat, 20 May 2017 12:06:40 GMT
Server
cloudinary
X-Timer
S1496978570.322047,VS0,VE0
ETag
"99499058d587530a811bff99c0f0bc22"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
Accept-Ranges
bytes
Access-Control-Allow-Headers
X-Requested-With
X-Cache-Hits
2
adf3e36d6255520b71bc29479eae90d7ae5a7f126a4c239fe7d6fb29
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//gleaned-images.stuff.com/signals-test/
7 KB
7 KB
Image
General
Full URL
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//gleaned-images.stuff.com/signals-test/adf3e36d6255520b71bc29479eae90d7ae5a7f126a4c239fe7d6fb29
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
151.101.114.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
272478feb31b85e11a576ea02a7f9dcc02df20a69253fe2e981c8392a7e7b3a4

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
images.taboola.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
stpt="thetradedesk-network!-#@1497583369342,neustar!-#@1497583369342,bluekai!-#@1497583369342"; t_vpub=CAETCM66PxABFA; t_gid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09; taboola_usg=Ig0KB2JsdWVrYWkSAggBIg0KB25ldXN0YXISAggB
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Via
1.1 varnish
Age
329412
X-Cache
HIT
Status
200 OK
Connection
keep-alive
X-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//gleaned-images.stuff.com/signals-test/adf3e36d6255520b71bc29479eae90d7ae5a7f126a4c239fe7d6fb29
Content-Length
7084
X-Request-Id
5c1ffc8e6b9c7dd7
X-Served-By
cache-hhn1528-HHN
Last-Modified
Mon, 05 Jun 2017 03:54:13 GMT
Server
cloudinary
X-Timer
S1496978570.324373,VS0,VE0
ETag
"3b0de4074ae603d1c29231b6e63ea479"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
Accept-Ranges
bytes
Access-Control-Allow-Headers
X-Requested-With
X-Cache-Hits
506
496d90672e17980d17ed5bf680d8c613_14944431661682_7db29296b56c8447d02513f469b400ec.600x500.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/c257b396-7bd6-476c-bac6-6ad061526256/
8 KB
8 KB
Image
General
Full URL
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/c257b396-7bd6-476c-bac6-6ad061526256/496d90672e17980d17ed5bf680d8c613_14944431661682_7db29296b56c8447d02513f469b400ec.600x500.png
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
151.101.114.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
13b546bdf5736a773a5d237651266970775b3115f81cc42ae9010b9e1456e72b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
images.taboola.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
stpt="thetradedesk-network!-#@1497583369342,neustar!-#@1497583369342,bluekai!-#@1497583369342"; t_vpub=CAETCM66PxABFA; t_gid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09; taboola_usg=Ig0KB2JsdWVrYWkSAggBIg0KB25ldXN0YXISAggB
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Via
1.1 varnish
Age
2062515
X-Cache
HIT
Connection
keep-alive
X-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/c257b396-7bd6-476c-bac6-6ad061526256/496d90672e17980d17ed5bf680d8c613_14944431661682_7db29296b56c8447d02513f469b400ec.600x500.png
Content-Length
8255
X-Served-By
cache-hhn1526-HHN
Last-Modified
Tue, 16 May 2017 04:43:36 GMT
Server
cloudinary
X-Timer
S1496978570.320330,VS0,VE0
ETag
"c6d9d26c172025cc815c3a563d299262"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
Accept-Ranges
bytes
Access-Control-Allow-Headers
X-Requested-With
X-Cache-Hits
1
9cbecbe6bcbe519cdce58f36f164f21b.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/
9 KB
9 KB
Image
General
Full URL
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/9cbecbe6bcbe519cdce58f36f164f21b.jpg
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
151.101.114.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
26d9343eadd22b9f25c82f992b0a5dff4290b4b29656abbabd06388eeb014eb0

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
images.taboola.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
stpt="thetradedesk-network!-#@1497583369342,neustar!-#@1497583369342,bluekai!-#@1497583369342"; t_vpub=CAETCM66PxABFA; t_gid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09; taboola_usg=Ig0KB2JsdWVrYWkSAggBIg0KB25ldXN0YXISAggB
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Via
1.1 varnish
Age
898070
X-Cache
HIT
Connection
keep-alive
X-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/9cbecbe6bcbe519cdce58f36f164f21b.jpg
Content-Length
9669
X-Served-By
cache-hhn1526-HHN
Last-Modified
Thu, 04 May 2017 07:27:46 GMT
Server
cloudinary
X-Timer
S1496978570.327800,VS0,VE0
ETag
"f8edb7a7a092d2f7c8293dc21d85b444"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
Accept-Ranges
bytes
Access-Control-Allow-Headers
X-Requested-With
X-Cache-Hits
1
5631782e274e494e0defd3b96eb7fbb8.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/
5 KB
5 KB
Image
General
Full URL
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/5631782e274e494e0defd3b96eb7fbb8.jpg
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
151.101.114.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
8b17fe85028b52bec0712ed753f12f9a75840cc64c76a8b122bc739ae4abf6b1

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
images.taboola.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
stpt="thetradedesk-network!-#@1497583369342,neustar!-#@1497583369342,bluekai!-#@1497583369342"; t_vpub=CAETCM66PxABFA; t_gid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09; taboola_usg=Ig0KB2JsdWVrYWkSAggBIg0KB25ldXN0YXISAggB
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Via
1.1 varnish
Age
2331986
X-Cache
HIT
Connection
keep-alive
X-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_150%2Cw_180%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/5631782e274e494e0defd3b96eb7fbb8.jpg
Content-Length
5061
X-Served-By
cache-hhn1528-HHN
Last-Modified
Fri, 12 May 2017 15:02:30 GMT
Server
cloudinary
X-Timer
S1496978570.331984,VS0,VE0
ETag
"8f068825d59339e4d13c5c17b4db26da"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=2592000
Accept-Ranges
bytes
Access-Control-Allow-Headers
X-Requested-With
X-Cache-Hits
3
rum.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/ Frame 603.
34 KB
0
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/rum.js
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
3cb8af8f49d328177a46138d9da7d57cf87cccddbfb8bac3092562d414d30d92
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/js/r20170605/r20110914/rum.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET

Response headers

date
Tue, 06 Jun 2017 02:01:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
264103
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
12872
x-xss-protection
1; mode=block
server
cafe
etag
18364998708581736293
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 20 Jun 2017 02:01:07 GMT
csi
csi.gstatic.com/ Frame 603.
0
0
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&puid=1~j3pae1el&c=5424580201612750&ctx=1&met.7=CAcQChgBIIwEKIwEMJUEOApojgRwlQR4mE2AAfZMiAHwwQE~CA0QChgBIJYHKJYHMJMJOPwBQIcJSIgJUIgJWI0JaI0JcJIJeIwOgAHQCogBmhU~CAcQChgBIJcHKJcHMJ4HOAdolwdwnQd4mE2AAfZMiAHwwQE~CA4QChgBIMAJKMAJMM8JOA9owQlwxgl4v4QEgAHpggSIAfnKCw~CBAQBxgBIMQKKMQKMN0KOBg~CA8QChgBINcKKNcKMN4LOIcBaNgKcN0LeNs-gAHhPIgBrYcC~CBYQChgBIJoMKJoMMKkMOA9onQxwogx4h-kBgAHx5AGIAa7nBA~CBkQChgBIOoPKOoPMPIPOAho6w9w8A9432iAAchkiAGEjQI&met.3=123.t9_1~121.up~118.v7~118.vb~118.vj~118.vu~118.vw~118.w2~118.w4~118.w6~118.w7~118.w8~118.w9~118.wa~118.wc~118.wf~118.wh~118.wh~118.xd~118.xg~118.xi~118.xi~118.xj~118.xk~118.xk~118.xl~118.xn~118.xp~54.11a~74.118_1~26.11a_1~54.11b~43.11b~53.11b~54.11b~49.11b~54.11b~49.11b~54.11b~49.11b~54.11b~49.11b~54.11b~49.11b~54.11b~49.11b~54.11b~49.11b~54.11c~74.11b~26.11c~54.11c~43.11c~53.11c~54.11c~49.11c~54.11c~49.11c~54.11c~49.11c~54.11c~49.11c~54.11c~49.11c~54.11c~49.11c~54.11c~49.11c~26.11c~7.11c~26.11c~6.11c~26.11c~14.11c~104.11c~87.11c~91.11c~104.11d~104.11d~23.11e~54.11e~42.11e~54.11e~42.11e~107.11d_4~54.11g~42.11g~54.11l~54.11m~48.11m~48.11m~54.11p~54.11p~54.11t~48.11t~54.11v~54.11v~48.11v~54.11y~54.11z~95.11c_n~54.11z~42.11z~54.120~95.11z~76.118_r~77.118_r~104.120~104.120~54.16f~54.16f~54.16f~54.16f~54.16g~54.17f~54.17f~54.181~203.16f_1n~118.188~118.188~118.18b~118.18f~118.18g~118.18q~118.18s~118.18v~118.18v~118.19f~118.19g~115.1ac~122.1ac~114.1ad~197.1aj~192.1al~118.1b5~118.1b6~118.1bn~118.1bs~118.1bt~osd%3A%3AdebugRemoveZombies.1c8~157.1c9_1~155.1bz_b~118.1e4~132.1e4_1~192.1k7~osd%3A%3AdebugRemoveZombies.1k7~157.1k8~157.1k8~130.1k7_2~117.1k9~94.1k9~92.1ka~154.1ka~118.1kf~132.1kf~118.1kg~132.1kg~118.1kj~132.1kj~113.1kr_4~112.1kp_5~118.21p~132.21p~118.21r~132.21r~118.21r~132.21s~115.21t~122.21t~114.21t~129.23w&met.9=1.xs~2.117&met.2=15.c~16.2ze6&met.1=1.j3padzao~6.0~7.0~8.0~9.0~10.0~12.0~13.0~14.1e~15.1e~16.1e~17.1e~18.1e~19.1f~20.1f~21.1f
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/rum.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:400e:800::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

:path
/csi?v=2&s=pagead&action=csi_pagead&puid=1~j3pae1el&c=5424580201612750&ctx=1&met.7=CAcQChgBIIwEKIwEMJUEOApojgRwlQR4mE2AAfZMiAHwwQE~CA0QChgBIJYHKJYHMJMJOPwBQIcJSIgJUIgJWI0JaI0JcJIJeIwOgAHQCogBmhU~CAcQChgBIJcHKJcHMJ4HOAdolwdwnQd4mE2AAfZMiAHwwQE~CA4QChgBIMAJKMAJMM8JOA9owQlwxgl4v4QEgAHpggSIAfnKCw~CBAQBxgBIMQKKMQKMN0KOBg~CA8QChgBINcKKNcKMN4LOIcBaNgKcN0LeNs-gAHhPIgBrYcC~CBYQChgBIJoMKJoMMKkMOA9onQxwogx4h-kBgAHx5AGIAa7nBA~CBkQChgBIOoPKOoPMPIPOAho6w9w8A9432iAAchkiAGEjQI&met.3=123.t9_1~121.up~118.v7~118.vb~118.vj~118.vu~118.vw~118.w2~118.w4~118.w6~118.w7~118.w8~118.w9~118.wa~118.wc~118.wf~118.wh~118.wh~118.xd~118.xg~118.xi~118.xi~118.xj~118.xk~118.xk~118.xl~118.xn~118.xp~54.11a~74.118_1~26.11a_1~54.11b~43.11b~53.11b~54.11b~49.11b~54.11b~49.11b~54.11b~49.11b~54.11b~49.11b~54.11b~49.11b~54.11b~49.11b~54.11b~49.11b~54.11c~74.11b~26.11c~54.11c~43.11c~53.11c~54.11c~49.11c~54.11c~49.11c~54.11c~49.11c~54.11c~49.11c~54.11c~49.11c~54.11c~49.11c~54.11c~49.11c~26.11c~7.11c~26.11c~6.11c~26.11c~14.11c~104.11c~87.11c~91.11c~104.11d~104.11d~23.11e~54.11e~42.11e~54.11e~42.11e~107.11d_4~54.11g~42.11g~54.11l~54.11m~48.11m~48.11m~54.11p~54.11p~54.11t~48.11t~54.11v~54.11v~48.11v~54.11y~54.11z~95.11c_n~54.11z~42.11z~54.120~95.11z~76.118_r~77.118_r~104.120~104.120~54.16f~54.16f~54.16f~54.16f~54.16g~54.17f~54.17f~54.181~203.16f_1n~118.188~118.188~118.18b~118.18f~118.18g~118.18q~118.18s~118.18v~118.18v~118.19f~118.19g~115.1ac~122.1ac~114.1ad~197.1aj~192.1al~118.1b5~118.1b6~118.1bn~118.1bs~118.1bt~osd%3A%3AdebugRemoveZombies.1c8~157.1c9_1~155.1bz_b~118.1e4~132.1e4_1~192.1k7~osd%3A%3AdebugRemoveZombies.1k7~157.1k8~157.1k8~130.1k7_2~117.1k9~94.1k9~92.1ka~154.1ka~118.1kf~132.1kf~118.1kg~132.1kg~118.1kj~132.1kj~113.1kr_4~112.1kp_5~118.21p~132.21p~118.21r~132.21r~118.21r~132.21s~115.21t~122.21t~114.21t~129.23w&met.9=1.xs~2.117&met.2=15.c~16.2ze6&met.1=1.j3padzao~6.0~7.0~8.0~9.0~10.0~12.0~13.0~14.1e~15.1e~16.1e~17.1e~18.1e~19.1f~20.1f~21.1f
pragma
no-cache
origin
http://www.zdnet.com
accept-encoding
gzip, deflate, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
content-type
text/plain;charset=UTF-8
accept
*/*
cache-control
max-age=0
:authority
csi.gstatic.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
content-length
0
:method
POST
Cache-Control
max-age=0
Origin
http://www.zdnet.com
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 09 Jun 2017 03:22:50 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
available
trc.taboola.com/cbsinteractive-zdnet/log/3/ Frame 603.
0
0
Document
General
Full URL
http://trc.taboola.com/cbsinteractive-zdnet/log/3/available
Requested by
Host: cdn.taboola.com
URL: http://cdn.taboola.com/libtrc/impl.257-18-RELEASE.js
Protocol
HTTP/1.1
Server
151.101.114.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.10.1 /
Resource Hash

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate
Host
trc.taboola.com
Accept-Language
en-US,en;q=0.8
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
taboola_session_id=v2_252ce2b55a7f52b0eafd4b8e9982312b_143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09_1496978569_1496978569_CNawjgYQzro_GOfwgNfIKyABKAE; JSESSIONID=.water401; stpt="thetradedesk-network!-#@1497583369342,neustar!-#@1497583369342,bluekai!-#@1497583369342"; taboola_upci=CIDxgNfIKxIPFQAAAAAdAAAAACUAAAAAKg8VAAAAAB0AAAAAJQAAAAAwAA; t_vpub=CAETCM66PxABFA; t_gid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09; taboola_usg=GgQQ9KlB
Connection
keep-alive
Content-Length
2534
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:50 GMT
Via
1.1 varnish
Server
nginx/1.10.1
X-Timer
S1496978570.431183,VS0,VE9
X-Served-By
cache-hhn1525-HHN
X-Cache
MISS
P3P
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
Access-Control-Allow-Origin
http://www.zdnet.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/gif
X-Cache-Hits
0
livefyre_mod_editor_main.js
zor.fyre.co/wjs/v3.0.1496355585/javascripts/
1 KB
519 B
Script
General
Full URL
http://zor.fyre.co/wjs/v3.0.1496355585/javascripts/livefyre_mod_editor_main.js
Requested by
Host: cdn.livefyre.com
URL: http://cdn.livefyre.com/libs/fyre.conv/v3.0.0/livefyre.min.js
Protocol
HTTP/1.1
Server
54.192.36.140 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-192-36-140.jfk1.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2154f777d1dca0c2f8eea29b26981b23b18611a5eb8232a43f12384d0ac3cd85

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zor.fyre.co
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 01 Jun 2017 22:23:41 GMT
Content-Encoding
gzip
Last-Modified
Thu, 01 Jun 2017 22:21:07 GMT
Server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:1001/gname:deployment/uname:deployment/gid:1001/mode:33188/mtime:1496355640/atime:1496355640/ctime:1496355640
Age
622749
ETag
"abfdc7512a7351ea2fb9fa31bef2ea59"
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Via
1.1 6f4c292df8fb7b5bd5bfa8aff66748aa.cloudfront.net (CloudFront)
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
519
X-Amz-Cf-Id
hWaoq_mJQ2Wy1rCv6q7MJaFk0JJpZ8tUyAqNnnXCjyV5gRQkie9Ong==
/
zdnet.stream1.fyre.co/servers/
457 B
457 B
XHR
General
Full URL
http://zdnet.stream1.fyre.co/servers/?domain=zdnet.fyre.co&collectionId=102965388
Requested by
Host: cdn.livefyre.com
URL: http://cdn.livefyre.com/libs/fyre.conv/v3.0.0/livefyre.min.js
Protocol
HTTP/1.1
Server
50.16.161.127 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-50-16-161-127.compute-1.amazonaws.com
Software
Perseids 2.0/ct225.dsr.livefyre.com /
Resource Hash
f5cb58f78fed527b0592a1d1afe7cf322a3dfeff79a3d009e607056175f7b4dd

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
zdnet.stream1.fyre.co
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com

Response headers

Access-Control-Allow-Origin
http://www.zdnet.com
Access-Control-Allow-Credentials
true
Server
Perseids 2.0/ct225.dsr.livefyre.com
Connection
keep-alive
X-RequestId
873017408731244136@3
Content-Length
457
Content-Type
application/json; charset=UTF-8
945205045488
lc.livefyre.com/livecountping/102965388/
104 B
110 B
XHR
General
Full URL
http://lc.livefyre.com/livecountping/102965388/945205045488?__=h2mx6xhfvf80&jid&siteId=360461&networkId=zdnet.fyre.co
Requested by
Host: cdn.livefyre.com
URL: http://cdn.livefyre.com/libs/fyre.conv/v3.0.0/livefyre.min.js
Protocol
HTTP/1.1
Server
52.4.251.102 Ashburn, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-4-251-102.compute-1.amazonaws.com
Software
Livecount/1.1 (Simple 4.0) lc74.dsr.livefyre.com /
Resource Hash
3ffcdc2e3b9a14d3bcfb9218ffd4c66442af6f972a217630c4b745e0b2e5c3d4

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
lc.livefyre.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com

Response headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Last-Modified
Fri, 09 Jun 2017 03:22:50 GMT
Server
Livecount/1.1 (Simple 4.0) lc74.dsr.livefyre.com
transfer-encoding
chunked
Access-Control-Allow-Methods
GET, OPTIONS
Content-Type
application/json
Access-Control-Allow-Origin
http://www.zdnet.com
Access-Control-Max-Age
1728000
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Origin, Accept-Language, Accept-Encoding, X-Forwarded-For, Connection, Accept, User-Agent, Host, Referer, Cookie, Content-Type, Cache-Control
user-alt.png
zdnet3.cbsistatic.com/fly/1496941227-fly/bundles/zdnetcss/images/livefyre/
4 KB
4 KB
Image
General
Full URL
http://zdnet3.cbsistatic.com/fly/1496941227-fly/bundles/zdnetcss/images/livefyre/user-alt.png
Requested by
Host: zor.fyre.co
URL: http://zor.fyre.co/wjs/v3.0.1496355585/javascripts/livefyre_base.js
Protocol
HTTP/1.1
Server
72.247.178.24 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-24.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
58109422f2e148020d624b0adee264da7691cc2eeebfb2f2e4140ee500ff6780

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet3.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Content-Encoding
gzip
Last-Modified
Thu, 08 Jun 2017 17:00:27 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
4453
Expires
Fri, 16 Jun 2017 03:22:50 GMT
snake-loader.gif
zor.fyre.co/wjs/v3.0.1496355585/images/
2 KB
2 KB
Image
General
Full URL
http://zor.fyre.co/wjs/v3.0.1496355585/images/snake-loader.gif
Requested by
Host: zor.fyre.co
URL: http://zor.fyre.co/wjs/v3.0.1496355585/javascripts/livefyre_base.js
Protocol
HTTP/1.1
Server
54.192.36.140 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-192-36-140.jfk1.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0eddaab3b8cb0b15d81d62e5ae5960329c3e576ea78dc321b20734ab20271847

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zor.fyre.co
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://zor.fyre.co/wjs/v3.0.1496355585/css/livefyre_main.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://zor.fyre.co/wjs/v3.0.1496355585/css/livefyre_main.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 01 Jun 2017 22:23:40 GMT
Content-Encoding
gzip
Last-Modified
Thu, 01 Jun 2017 22:21:06 GMT
Server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:1001/gname:deployment/uname:deployment/gid:1001/mode:33188/mtime:1496355640/atime:1496355640/ctime:1496355640
Age
622751
ETag
"784f10aec7b1ea1804df1349fa470c1f"
X-Cache
Hit from cloudfront
Content-Type
image/gif
Via
1.1 9137d054c423ede4794f3621c7d50adb.cloudfront.net (CloudFront)
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1586
X-Amz-Cf-Id
8sRw1H-Qv3JhCDRA4waLeKBa9e50pWNh7kPYVyuX7h2x_fNkp2WLkA==
sprite.png
zor.fyre.co/wjs/v3.0.1496355585/images/
18 KB
18 KB
Image
General
Full URL
http://zor.fyre.co/wjs/v3.0.1496355585/images/sprite.png
Requested by
Host: zor.fyre.co
URL: http://zor.fyre.co/wjs/v3.0.1496355585/javascripts/livefyre_base.js
Protocol
HTTP/1.1
Server
54.192.36.140 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-192-36-140.jfk1.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ab99a5eaea7da28aacbf11cfc30c31756e34170767ae4abee4d5c50a296f18c5

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zor.fyre.co
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://zor.fyre.co/wjs/v3.0.1496355585/css/livefyre_main.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://zor.fyre.co/wjs/v3.0.1496355585/css/livefyre_main.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 01 Jun 2017 22:23:40 GMT
Content-Encoding
gzip
Last-Modified
Thu, 01 Jun 2017 22:21:06 GMT
Server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:1001/gname:deployment/uname:deployment/gid:1001/mode:33188/mtime:1496355640/atime:1496355640/ctime:1496355640
Age
622751
ETag
"b5ff8d2d032890ccee1de0a469513429"
X-Cache
Hit from cloudfront
Content-Type
image/png
Via
1.1 6f4c292df8fb7b5bd5bfa8aff66748aa.cloudfront.net (CloudFront)
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
17957
X-Amz-Cf-Id
Kimfshy3E6mn4evXe-7SnY_GDNrWaL8i3X6I4pvvpfpS_I249_0woA==
down_arrow.png
zor.fyre.co/wjs/v3.0.1496355585/images/
86 B
116 B
Image
General
Full URL
http://zor.fyre.co/wjs/v3.0.1496355585/images/down_arrow.png
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
54.192.36.140 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-192-36-140.jfk1.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6c3b778f9857724245edd89767f6dbe13c1ae96468375e78a2b718bacf765cf8

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zor.fyre.co
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 01 Jun 2017 22:23:40 GMT
Content-Encoding
gzip
Last-Modified
Thu, 01 Jun 2017 22:20:59 GMT
Server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:1001/gname:deployment/uname:deployment/gid:1001/mode:33188/mtime:1496355640/atime:1496355640/ctime:1496355640
Age
622751
ETag
"495bc827a4e10f2d08281d5197d79ef8"
X-Cache
Hit from cloudfront
Content-Type
image/png
Via
1.1 9137d054c423ede4794f3621c7d50adb.cloudfront.net (CloudFront)
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
116
X-Amz-Cf-Id
RMQuktutY2yxOlKDu7kLOVUdcJ7p3Utp7ROKgG77gF-Uvg2rAQI-yA==
truncated
/
26 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Response headers

activeview
pagead2.googlesyndication.com/ Frame 603.
42 B
42 B
Image
General
Full URL
http://pagead2.googlesyndication.com/activeview?avi=BU_rjiRQ6WbnlAoysbMachKgMAAAAABABOAHIAQnAAgLgAgDgBAGgBh_SCAUIgGEQAQ&cid=CAASEuRowssxiobMw629XcLhQLaRwA&id=osdim&ti=1&adk=2442809372&mtos=0,0,0,0,0&tos=0,0,0,0,0&p=0,0,0,0&mcvt=0&rs=3&ht=0&mc=0&lte=-1&bas=1&bac=1&gte=108809107&tmo=9&tme=298&rtl=false&til=298&tdl=928&tdld=1091&tcl=306&tcld=9&tlr=306&tlrd=9&r=u&bs=1583,1132&bos=1598,1132&ps=1583,6917&ss=1600,1200&tt=1014&pt=1013&deb=1-2-2-2-3--1&tvt=0&iframe_loc=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&is=371,771&avms=geo&uc=1&tgt=BODY&cl=1&cec=12&clc=0&cd=0x0
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
2a00:1450:4001:824::2002 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pagead2.googlesyndication.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:50 GMT
X-Content-Type-Options
nosniff
Server
cafe
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, must-revalidate
Timing-Allow-Origin
*
Content-Length
42
X-XSS-Protection
1; mode=block
Expires
Fri, 01 Jan 1990 00:00:00 GMT
format.png
zdnet1.cbsistatic.com/fly/1496941227-fly/bundles/zdnetcss/images/livefyre/
1 KB
837 B
Image
General
Full URL
http://zdnet1.cbsistatic.com/fly/1496941227-fly/bundles/zdnetcss/images/livefyre/format.png
Requested by
Host: zor.fyre.co
URL: http://zor.fyre.co/wjs/v3.0.1496355585/javascripts/livefyre_base.js
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
5b6b56078eb0f3efed65d57f6fa84e7d010106c895ddf22b6283a7c042c92614

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet1.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Content-Encoding
gzip
Last-Modified
Thu, 08 Jun 2017 17:00:27 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
837
Expires
Fri, 16 Jun 2017 03:22:50 GMT
mention.png
zdnet4.cbsistatic.com/fly/1496941227-fly/bundles/zdnetcss/images/livefyre/
1 KB
1 KB
Image
General
Full URL
http://zdnet4.cbsistatic.com/fly/1496941227-fly/bundles/zdnetcss/images/livefyre/mention.png
Requested by
Host: zor.fyre.co
URL: http://zor.fyre.co/wjs/v3.0.1496355585/javascripts/livefyre_base.js
Protocol
HTTP/1.1
Server
72.247.178.24 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-24.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
5bd6c7ed0b96e469ed51d54f8cfbccd922d537d8825556b203d3904aa5a05977

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet4.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://zdnet1.cbsistatic.com/fly/css/core/main-88cf334629-rev.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Content-Encoding
gzip
Last-Modified
Thu, 08 Jun 2017 17:00:27 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
1104
Expires
Fri, 16 Jun 2017 03:22:50 GMT
sprites.png
zor.fyre.co/wjs/v3.0.1496355585/images/editor/
9 KB
9 KB
Image
General
Full URL
http://zor.fyre.co/wjs/v3.0.1496355585/images/editor/sprites.png
Requested by
Host: zor.fyre.co
URL: http://zor.fyre.co/wjs/v3.0.1496355585/javascripts/livefyre_base.js
Protocol
HTTP/1.1
Server
54.192.36.93 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-192-36-93.jfk1.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
315bba207a7e699f626db815466d2597b91ae0ad4ba4b1909c87300f0f7ff450

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zor.fyre.co
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://zor.fyre.co/wjs/v3.0.1496355585/css/livefyre_main.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://zor.fyre.co/wjs/v3.0.1496355585/css/livefyre_main.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 01 Jun 2017 22:23:40 GMT
Content-Encoding
gzip
Last-Modified
Thu, 01 Jun 2017 22:21:01 GMT
Server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:1001/gname:deployment/uname:deployment/gid:1001/mode:33188/mtime:1496355640/atime:1496355640/ctime:1496355640
Age
622751
ETag
"1fe2fa1655179caa1a6d3255b7d8c2c0"
X-Cache
Hit from cloudfront
Content-Type
image/png
Via
1.1 6f4c292df8fb7b5bd5bfa8aff66748aa.cloudfront.net (CloudFront)
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
9333
X-Amz-Cf-Id
1MqeobquwCvnW2SbWI5zkQfcUbzZngqnz93qHvWh8tXlQdmNUao7fA==
Down-Arrow-Up(1x).png
zor.fyre.co/wjs/v3.0.1496355585/images/editor/share/
120 B
158 B
Image
General
Full URL
http://zor.fyre.co/wjs/v3.0.1496355585/images/editor/share/Down-Arrow-Up(1x).png
Requested by
Host: zor.fyre.co
URL: http://zor.fyre.co/wjs/v3.0.1496355585/javascripts/livefyre_base.js
Protocol
HTTP/1.1
Server
54.192.36.140 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-192-36-140.jfk1.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
79c2d2235013fc78642ec014222efa28a3b68e827ade9ee2cbff592abb833ac0

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zor.fyre.co
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://zor.fyre.co/wjs/v3.0.1496355585/css/livefyre_main.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://zor.fyre.co/wjs/v3.0.1496355585/css/livefyre_main.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 01 Jun 2017 22:23:42 GMT
Content-Encoding
gzip
Last-Modified
Thu, 01 Jun 2017 22:21:00 GMT
Server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:1001/gname:deployment/uname:deployment/gid:1001/mode:33188/mtime:1496355640/atime:1496355640/ctime:1496355640
Age
622749
ETag
"e73d96dfb185ff03f02cd9d6b07f8150"
X-Cache
Hit from cloudfront
Content-Type
image/png
Via
1.1 3da3508da5df5956549a94ec250a7674.cloudfront.net (CloudFront)
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
158
X-Amz-Cf-Id
F_wsXuTQYgtqIkvY9UjoiOC-Ze8TGKO3LkFMjidvQmEKhut_cGvpHw==
50hc.png
avatars.fyre.co/a/anon/
1 KB
1 KB
Image
General
Full URL
http://avatars.fyre.co/a/anon/50hc.png
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
52.84.40.203 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-84-40-203.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4b3b77256ae2eff154017eaff1b04d8711bf45a44d46e097758f07afa252936c

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
avatars.fyre.co
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 26 Jan 2017 14:16:56 GMT
Via
1.1 e364a215258bbfb310702eaedcb82e22.cloudfront.net (CloudFront)
Last-Modified
Fri, 13 Jan 2017 01:33:28 GMT
Server
AmazonS3
Age
4751710
ETag
"127fb0fd3e3c12f9300aee523d8b12a8"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=5184000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1156
X-Amz-Cf-Id
cz_FyMGitu8DUDV0rgBcjMsFcQBfLhjyCr6fK6qW-izDA9sZb3q3qA==
945205045488
lc72.dsr.livefyre.com/livecountping/102965388/
35 B
35 B
XHR
General
Full URL
http://lc72.dsr.livefyre.com/livecountping/102965388/945205045488?__=ylkq8y210btz&routed=1&jid&siteId=360461&networkId=zdnet.fyre.co
Requested by
Host: cdn.livefyre.com
URL: http://cdn.livefyre.com/libs/fyre.conv/v3.0.0/livefyre.min.js
Protocol
HTTP/1.1
Server
54.210.16.8 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-210-16-8.compute-1.amazonaws.com
Software
Livecount/1.1 (Simple 4.0) lc72.dsr.livefyre.com /
Resource Hash
da1791b1b8361af6383790c6e77ef6eb149b22ed7e2d59b61ac2deb7884edf4d

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
lc72.dsr.livefyre.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com

Response headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Last-Modified
Fri, 09 Jun 2017 03:22:50 GMT
Server
Livecount/1.1 (Simple 4.0) lc72.dsr.livefyre.com
Access-Control-Max-Age
1728000
Access-Control-Allow-Methods
GET, OPTIONS
Content-Type
application/json
Access-Control-Allow-Origin
http://www.zdnet.com
Access-Control-Allow-Credentials
true
Connection
close
Access-Control-Allow-Headers
Origin, Accept-Language, Accept-Encoding, X-Forwarded-For, Connection, Accept, User-Agent, Host, Referer, Cookie, Content-Type, Cache-Control
player-sprite.svg
cdn.teads.tv/media/format/v3/assets/default/ Frame 603.
9 KB
3 KB
Image
General
Full URL
http://cdn.teads.tv/media/format/v3/assets/default/player-sprite.svg
Requested by
Host: cdn.teads.tv
URL: http://cdn.teads.tv/media/format/v3/teads-format.min.js?2017693
Protocol
HTTP/1.1
Server
95.100.186.168 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-186-168.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
3ba7f40e2b4080979389e9b81e6d0ed155e9b7f74b3310bc1289ee70cba2035d

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.teads.tv
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
tt_viewer=2de54e70-a45d-4808-ae5f-2597108614bf
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Content-Encoding
gzip
Last-Modified
Wed, 07 Jun 2017 12:24:23 GMT
Server
AmazonS3
x-amz-request-id
466476FBAB6A543F
ETag
"e307a2e20d3fa9462cb2acc0e3b573c8"
Vary
Accept-Encoding
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3397
x-amz-id-2
Jh4yz6ttpK/m9Z4DAGmevyspHvA1bMg8xktsqpqJX22PqPrOmqFhf39kYs5xHR1weR4GytWtR2s=
moatvideo.js
js.moatads.com/teads245638586802/
201 KB
64 KB
Script
General
Full URL
http://js.moatads.com/teads245638586802/moatvideo.js
Requested by
Host: cdn.teads.tv
URL: http://cdn.teads.tv/media/format/v3/teads-format.min.js?2017693
Protocol
HTTP/1.1
Server
95.100.248.112 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-100-248-112.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
8ff36c89ffa31f7ad0f07297a945d6cbdcfb7ad713a164cb068c6fd40eef95a7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
js.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:50 GMT
Content-Encoding
gzip
Last-Modified
Wed, 31 May 2017 18:11:54 GMT
Server
AmazonS3
x-amz-request-id
55F5B4C7CADD5863
ETag
"1d9bbbe31bfb1a3a254911241c82c378"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=41458
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
65039
x-amz-id-2
Np8k5Kkwbhgs7nH6PzUwBn57ze6L/Bo1xMOYeb8qyCC+EilGABckDJFlqtJAMxEaddT67+X9fSk=
track
t.teads.tv/
23 B
23 B
Image
General
Full URL
http://t.teads.tv/track?action=adAvailable-success&pageId=0&pid=61059&gid=&slot=native&env=js-web&ts=1496978569554
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
52.30.66.229 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-30-66-229.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
t.teads.tv
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
tt_viewer=2de54e70-a45d-4808-ae5f-2597108614bf
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Expires
Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
23
Content-Type
image/gif
pixel.gif
px.moatads.com/
43 B
43 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=34&ud=0&ue=0&uu=0&qa=1600&qb=1200&qc=1&qd=67&qf=1598&qe=1132&qh=1598&qg=1132&qi=1600&qj=1200&ql=%3B%5BpwxnRd%7Dt%3Aa%5DmJVOG)%2C~%405%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(u0.pVw!ry8k.%22%3A%3DMo%5Di*3oD%5BN%7BQO%3FSFm%5D)4m3%23(%3DNRpStZ.EfoG0Kc%5ENFnUz%22uCG&qo=0&qm=0&qn=6OZw%3DoHB%2CEF%3FKC1I%3Cq.bWoCSV2W0Su*TDXlCfX2iR2%25(GyHN%3DI(%2C%3Ba15lK1t!9Zp%7Bl.I6%3DT103etW6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo8rY2baurI!tzm!jVSn%3CV%3CTZ8!J%3BatASYUby%3D(tN%23V.x1.qUD%60aFjL%2FX%252%3B(OC)Lp%22%3Fj3VYUex8k%40%22%7Cu7pRB%5Bz%26(K%2BxP%25l7g%26kyM8F4%2BKCCRP)Et%5B%40(X%7C01%5B_)vVS%2F%2F.hX%3Dt%3C!T%5D%3DNMV8t8fvb%26%225gRo%2BG%22IQ3qC%60I4%3CeZl%5DM%3ArRaxDmPN0%2FdEGm(tVDU%3CVZvoJU4b6W%3AGHBx%3Df%5E7j%22R%5EIc%2CDT%24F%26(%26u3Rs%3C%5ECPR9%6013s%40.Y_hmP%3BgsJ%24Ym%24%2FjkkeL07ta_*JRLRV%3BO5FN6tRAlTJ%3F_v%3D(tN%23V.xm9%25KMD4YP%60T11K%3E(7b%5DQ%22_KF5%5D5%2F%5BGI%3F4Y_hO%3Dn%3CG.3pG%24cz98Zpe4tE0b15%7CQjw%60.%7Bi%24J)%2C4i8ocS!%5BFZKU37B%2BMm1TVGX%5E8Y.NI%22mCN&qp=10000&qq=000001100000&qr=0&gz=0&hh=0&hn=0&qt=0&i=TEADSVIDEOJS2&hp=1&zMoatOrigSlicer1=29790&zMoatOrigSlicer2=43531&zMoatTPL=-&zMoat_ad_entity_id=7373&zMoat_connection=0_NONE&zMoat_domain=zdnet.com&zMoat_subdomain=zdnet.com&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&bq=8&f=0&j=&o=3&t=1496978570763&de=535433845621&m=0&ar=7b317f9-clean&q=47&cb=0&cu=1496978570763&ll=2&lm=0&ln=0&r=25.0.0&em=0&en=1&d=1404_Western%20Union%3A50523_DE_ELITE_Western%20Union_Fullyear%20Digital%202017_inRead%20DESKTOP_Apr17_JUN%3A155321_DE_ELITE_USA_Western%20Union_Fullyear%20Digital%202017_inRead%20DESKTOP_Apr17_JUN_I%3A141548_DE_ELITE_Western%20Union_Fullyear%20Digital%202017_inRead%20DESKTOP_Apr17_JUN_Air%20APP%20Video&qs=1&zMoatGSR=1&gu=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&bo=zdnet.com&bd=zdnet.com&gw=teads245638586802&fd=1&ac=1&it=500&fs=117120&na=138686661&cs=0
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
px.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:50 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 09 Jun 2017 03:22:50 GMT
/
ct214.dsr.livefyre.com/v3.1/collection/102965388/1486441095182696/
0
0
XHR
General
Full URL
http://ct214.dsr.livefyre.com/v3.1/collection/102965388/1486441095182696/?multi=true&jid&siteId=360461&networkId=zdnet.fyre.co&backend=DTH&rlo=0&err=0&to=0&cV=undefined
Requested by
Host: cdn.livefyre.com
URL: http://cdn.livefyre.com/libs/fyre.conv/v3.0.0/livefyre.min.js
Protocol
HTTP/1.1
Server
54.146.151.35 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-146-151-35.compute-1.amazonaws.com
Software
Perseids 2.0/ct214.dsr.livefyre.com /
Resource Hash

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
ct214.dsr.livefyre.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com

Response headers

Access-Control-Allow-Origin
http://www.zdnet.com
Access-Control-Allow-Credentials
true
Server
Perseids 2.0/ct214.dsr.livefyre.com
X-RequestId
873017519272038788@1
Transfer-Encoding
chunked
Content-Type
application/json; charset=UTF-8
domains
api.viglink.com/api/
58 B
58 B
XHR
General
Full URL
http://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: http://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Server
52.17.60.112 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-17-60-112.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
8729d0b3fe29b9678177ae43fa9140de2666fb00058a1c84e202d1926d7a16e6

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate
Host
api.viglink.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Accept
*/*
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
vglnk.Agent.p=4c20446b70137829c06f930c445610a7
Connection
keep-alive
Content-Length
331
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:50 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
http://www.zdnet.com
Cache-Control
no-cache no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
58
Expires
Thu, 01 Jan 1970 00:00:00 GMT
csi
csi.gstatic.com/ Frame 603.
0
0
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&puid=1~j3pae23y&chm=1&c=5424580201612750&ctx=2&qqid=CPnN4N7nr9QCFQwWGwodRg4BxQ&met.7=CAcQChgBILkBKLkBMLkBaLkBcLkBgAH2TIgB8MEB~CBgQChgBIOYKKOYKMOYKaOYKcOYKgAHIZIgBhI0C&met.4=fb.52~ol.ip~dt.4&met.3=123.59_4~121.5v_1~118.6q~118.6t~118.6x~118.78~118.7a~118.7d~118.7x~118.7y~118.9n~118.9o~116.b0~116.io~116.io~117.io~118.ix~118.ix~118.iy~122.zr~114.zr~118.108~115.12j~113.156_2~112.155_4~118.15a~118.15a_1~118.1d9~118.1dc~118.1df~118.1dg~118.1dh~122.1rm~114.1rn&met.2=15.7~16.k&met.1=1.j3pae0c6~6.0~7.0~8.0~9.0~10.0~12.0~13.0~14.l~15.l~16.l~17.l~18.l~19.l~20.l~21.l
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/rum.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:400e:800::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

:path
/csi?v=2&s=pagead&action=csi_pagead&puid=1~j3pae23y&chm=1&c=5424580201612750&ctx=2&qqid=CPnN4N7nr9QCFQwWGwodRg4BxQ&met.7=CAcQChgBILkBKLkBMLkBaLkBcLkBgAH2TIgB8MEB~CBgQChgBIOYKKOYKMOYKaOYKcOYKgAHIZIgBhI0C&met.4=fb.52~ol.ip~dt.4&met.3=123.59_4~121.5v_1~118.6q~118.6t~118.6x~118.78~118.7a~118.7d~118.7x~118.7y~118.9n~118.9o~116.b0~116.io~116.io~117.io~118.ix~118.ix~118.iy~122.zr~114.zr~118.108~115.12j~113.156_2~112.155_4~118.15a~118.15a_1~118.1d9~118.1dc~118.1df~118.1dg~118.1dh~122.1rm~114.1rn&met.2=15.7~16.k&met.1=1.j3pae0c6~6.0~7.0~8.0~9.0~10.0~12.0~13.0~14.l~15.l~16.l~17.l~18.l~19.l~20.l~21.l
pragma
no-cache
origin
http://www.zdnet.com
accept-encoding
gzip, deflate, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
content-type
text/plain;charset=UTF-8
accept
*/*
cache-control
max-age=0
:authority
csi.gstatic.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
content-length
0
:method
POST
Cache-Control
max-age=0
Origin
http://www.zdnet.com
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 09 Jun 2017 03:22:51 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel.gif
px.moatads.com/
43 B
43 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=TEADSVIDEOJS2&hp=1&zMoatOrigSlicer1=29790&zMoatOrigSlicer2=43531&zMoatTPL=-&zMoat_ad_entity_id=7373&zMoat_connection=0_NONE&zMoat_domain=zdnet.com&zMoat_subdomain=zdnet.com&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&bq=8&f=0&j=&o=3&t=1496978570763&de=535433845621&m=0&ar=7b317f9-clean&q=48&cb=0&cu=1496978570763&ll=2&lm=0&ln=0&r=25.0.0&em=0&en=1&d=1404_Western%20Union%3A50523_DE_ELITE_Western%20Union_Fullyear%20Digital%202017_inRead%20DESKTOP_Apr17_JUN%3A155321_DE_ELITE_USA_Western%20Union_Fullyear%20Digital%202017_inRead%20DESKTOP_Apr17_JUN_I%3A141548_DE_ELITE_Western%20Union_Fullyear%20Digital%202017_inRead%20DESKTOP_Apr17_JUN_Air%20APP%20Video&qs=1&zMoatGSR=1&gu=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&bo=zdnet.com&bd=zdnet.com&gw=teads245638586802&fd=1&ac=1&it=500&fs=117120&na=1556025329&cs=0
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
px.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:51 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 09 Jun 2017 03:22:51 GMT
csi
csi.gstatic.com/ Frame 603.
0
0
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&puid=1~j3pae240&chm=1&c=5424580201612750&ctx=2&qqid=CPrN4N7nr9QCFQwWGwodRg4BxQ&met.7=CAcQChgBINYBKNYBMNYBaNYBcNYBgAH2TIgB8MEB~CBgQChgBIIcKKIcKMI8KOAdoiApwjgp4s2WAAchkiAGEjQI&met.4=fb.5w~ol.90~dt.2&met.3=123.5z_1~121.6h~118.6o~118.6t~118.6w~118.6w~118.79~118.7c~118.7c~118.7v~117.90~118.9l~118.9m~118.9n~118.av~118.iw~118.ix~115.zq~122.zq~114.zs~118.108~118.108~118.15a~113.15d_2~112.15c_3~118.1d7~118.1db~118.1de~118.1df~118.1dg~115.1rl~122.1rl~114.1rl&met.2=15.5~16.aet&met.1=1.j3pae0c8~6.0~7.0~8.0~9.0~10.0~12.0~13.0~14.k~15.k~16.k~17.k~18.k~19.k~20.k~21.k
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/rum.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:400e:800::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

:path
/csi?v=2&s=pagead&action=csi_pagead&puid=1~j3pae240&chm=1&c=5424580201612750&ctx=2&qqid=CPrN4N7nr9QCFQwWGwodRg4BxQ&met.7=CAcQChgBINYBKNYBMNYBaNYBcNYBgAH2TIgB8MEB~CBgQChgBIIcKKIcKMI8KOAdoiApwjgp4s2WAAchkiAGEjQI&met.4=fb.5w~ol.90~dt.2&met.3=123.5z_1~121.6h~118.6o~118.6t~118.6w~118.6w~118.79~118.7c~118.7c~118.7v~117.90~118.9l~118.9m~118.9n~118.av~118.iw~118.ix~115.zq~122.zq~114.zs~118.108~118.108~118.15a~113.15d_2~112.15c_3~118.1d7~118.1db~118.1de~118.1df~118.1dg~115.1rl~122.1rl~114.1rl&met.2=15.5~16.aet&met.1=1.j3pae0c8~6.0~7.0~8.0~9.0~10.0~12.0~13.0~14.k~15.k~16.k~17.k~18.k~19.k~20.k~21.k
pragma
no-cache
origin
http://www.zdnet.com
accept-encoding
gzip, deflate, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
content-type
text/plain;charset=UTF-8
accept
*/*
cache-control
max-age=0
:authority
csi.gstatic.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
content-length
0
:method
POST
Cache-Control
max-age=0
Origin
http://www.zdnet.com
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 09 Jun 2017 03:22:51 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sync
gum.criteo.com/
79 B
79 B
Script
General
Full URL
http://gum.criteo.com/sync?r=2&c=158&j=STRCriteoCallback
Requested by
Host: native.sharethrough.com
URL: http://native.sharethrough.com/assets/sfp.js
Protocol
HTTP/1.1
Server
178.250.0.67 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
f37c079aea7313c99b8729dc30d2843999d2705c10cd9e10eaeee85a910bafb4

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
gum.criteo.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
uid=2f4fe3ce-0842-4d01-915b-8bbf48a64ca6; zdi=*1Tt61xO3HsovavRpBIgOgCg%3d%3d
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:51 GMT
Cache-Control
private
Expires
Fri, 09 Jun 2017 04:22:51 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
Content-Length
79
Content-Type
text/javascript; charset=utf-8
Cookie set vglnk.js
cdn.viglink.com/api/
77 KB
27 KB
Script
General
Full URL
http://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Server
2400:cb00:2048:1::6810:a40d , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software
cloudflare-nginx /
Resource Hash
8d132c2ec29a828cc58c2060046cfcfc4c4312ebb2570973221ad8a4fadf7490

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.viglink.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
vglnk.Agent.p=4c20446b70137829c06f930c445610a7
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:51 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
x-amz-request-id
86EFEB3A821C4CF6
Connection
keep-alive
Content-Length
27392
x-amz-id-2
xYY6QdRqzgoNuPvJGAn4uVTJXceYX8zhq/2y5onTQwVinE1gG7GgQ09rvUHXbYLD3SfF4+FLzpk=
Last-Modified
Tue, 09 May 2017 17:46:08 GMT
Server
cloudflare-nginx
ETag
"0c7f630eb71f657108a7590a6e47e1bd"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
public, max-age=60
Set-Cookie
__cfduid=df2fa65a05a72729bce5c4af8d6714fb81496978571; expires=Sat, 09-Jun-18 03:22:51 GMT; path=/; domain=.viglink.com; HttpOnly
Accept-Ranges
bytes
CF-RAY
36c0f809348363cd-FRA
Expires
Fri, 09 Jun 2017 03:23:51 GMT
utag.1775.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
26 KB
9 KB
Script
General
Full URL
http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.31.201705252122
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/9F88) /
Resource Hash
0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
tags.tiqcdn.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:51 GMT
Content-Encoding
gzip
Last-Modified
Thu, 10 Nov 2016 20:41:55 GMT
Server
ECS (fcn/9F88)
Etag
"525171678"
Vary
Accept-Encoding
X-Cache
HIT
Content-Type
text/javascript
Cache-Control
max-age=1296000
Accept-Ranges
bytes
Content-Length
8960
Expires
Sat, 24 Jun 2017 03:22:51 GMT
utag.277.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
863 B
Script
General
Full URL
http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.31.201705252122
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/41A4) /
Resource Hash
0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
tags.tiqcdn.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:51 GMT
Content-Encoding
gzip
Last-Modified
Mon, 11 Jul 2016 20:43:58 GMT
Server
ECS (fcn/41A4)
Etag
"2176731784+gzip"
Vary
Accept-Encoding
X-Cache
HIT
Content-Type
text/javascript
Cache-Control
max-age=1296000
Accept-Ranges
bytes
Content-Length
863
Expires
Sat, 24 Jun 2017 03:22:51 GMT
utag.1772.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
959 B
Script
General
Full URL
http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1772.js?utv=ut4.31.201705252122
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/4052) /
Resource Hash
e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
tags.tiqcdn.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:51 GMT
Content-Encoding
gzip
Last-Modified
Mon, 11 Jul 2016 20:43:58 GMT
Server
ECS (fcn/4052)
Etag
"1042734427+gzip"
Vary
Accept-Encoding
X-Cache
HIT
Content-Type
text/javascript
Cache-Control
max-age=1296000
Accept-Ranges
bytes
Content-Length
959
Expires
Sat, 24 Jun 2017 03:22:51 GMT
utag.1796.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
8 KB
3 KB
Script
General
Full URL
http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1796.js?utv=ut4.31.201705252122
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/41C3) /
Resource Hash
9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
tags.tiqcdn.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:51 GMT
Content-Encoding
gzip
Last-Modified
Mon, 28 Nov 2016 15:09:53 GMT
Server
ECS (fcn/41C3)
Etag
"2979597343"
Vary
Accept-Encoding
X-Cache
HIT
Content-Type
text/javascript
Cache-Control
max-age=1296000
Accept-Ranges
bytes
Content-Length
2762
Expires
Sat, 24 Jun 2017 03:22:51 GMT
dest5.html
fast.cbsi.demdex.net/ Frame 603.
0
0

dest5.html
fast.cbsi.demdex.net/ Frame 603.
0
0

pixel_details.html
www.everestjs.net/static/ Frame 603.
Redirect Chain
  • http://pixel.everesttech.net/4083/gr?ev_gb=0&url=http%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__EFOPTOUT__%26throttleCookie...
  • http://www.everestjs.net/static/pixel_details.html
0
0

identity.html
www.lightboxcdn.com/static/ Frame 603.
0
0

/
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/
37 KB
9 KB
Script
General
Full URL
http://zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_3xeBFJDuSs0SRW5&Q_LOC=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.31.201705252122
Protocol
HTTP/1.1
Server
104.108.56.114 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-108-56-114.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e51a8aa65ffb34c6ef80ab29f19ccf75e70088d76db57ed04124e777e1b33868

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:52 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3P
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Expires
Fri, 09 Jun 2017 03:22:52 GMT
Cache-Control
max-age=0
Connection
keep-alive
Content-Type
application/javascript
Content-Length
9121
ServerShortName
m
secure-us.imrworldwide.com/cgi-bin/
Redirect Chain
  • http://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=http%3A//www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/&rp=&ts=compact&rnd=1496...
  • http://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=http%3A//www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/&rp=&ts=compact&rnd=1496...
44 B
44 B
Image
General
Full URL
http://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=http%3A//www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/&rp=&ts=compact&rnd=1496978571980&ja=1
Protocol
HTTP/1.1
Server
138.108.96.100 Schaumburg, United States, ASN16477 (ACNIELSEN-AS - ACNIELSEN, US),
Reverse DNS
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
secure-us.imrworldwide.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
IMRID=27a5829a-f44c-46a6-8e2a-65dcb1a5cc14
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:52 GMT
Server
nginx
P3P
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
44
Expires
Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:52 GMT
Server
nginx
P3P
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
Location
http://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=http%3A//www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/&rp=&ts=compact&rnd=1496978571980&ja=1
Set-Cookie
IMRID=27a5829a-f44c-46a6-8e2a-65dcb1a5cc14;Path=/;Domain=imrworldwide.com;Expires=Sun, 09-Jun-2019 03:22:52 GMT;Max-Age=63072000
Cache-Control
no-cache
Connection
close
Content-Length
0
Expires
Thu, 01 Dec 1994 16:00:00 GMT
fbevents.js
connect.facebook.net/en_US/
33 KB
11 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
f28084bcab05ed8bd7946dd4c791abf08b7fbc34ecf289cd8f01349763e80019
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* *.akamaihd.net wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security max-age=15552000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

:path
/en_US/fbevents.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
connect.facebook.net
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* *.akamaihd.net wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Origin Accept-Encoding
content-length
10886
x-xss-protection
0
pragma
public
x-fb-debug
TFkdGURs9WX3Lg1uLPc8VqiXPksm7z2Ll43VcrBcAU4jMe46dB5emJRFTZl+/JdCbAtZ9d41gqaanRxtAORA7g==
x-frame-options
DENY
date
Fri, 09 Jun 2017 03:22:52 GMT
strict-transport-security
max-age=15552000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
https://connect.facebook.net
access-control-expose-headers
X-FB-Debug, X-Loader-Length
cache-control
public, max-age=1200
access-control-allow-credentials
true
access-control-allow-method
OPTIONS
expires
Sat, 01 Jan 2000 00:00:00 GMT
cs.js
b.scorecardresearch.com/c2/3005086/
0
0
Script
General
Full URL
http://b.scorecardresearch.com/c2/3005086/cs.js
Requested by
Host: tags.tiqcdn.com
URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.31.201705252122
Protocol
HTTP/1.1
Server
95.100.248.105 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-100-248-105.deploy.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
b.scorecardresearch.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
UID=18B95a100248101b79f8a3g1496978568; UIDR=1496978568
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:51 GMT
Content-Encoding
gzip
Last-Modified
Fri, 08 Apr 2011 23:11:26 GMT
ETag
"d41d8cd98f00b204e9800998ecf8427e:1349196464"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=259200
Connection
keep-alive
Content-Length
20
Expires
Mon, 12 Jun 2017 03:22:51 GMT
b
b.scorecardresearch.com/
0
0
Image
General
Full URL
http://b.scorecardresearch.com/b?c1=2&c2=3005086&ns__t=1496978571985&ns_c=UTF-8&c8=Washington%20Post%2C%20Guardian%20links%20used%20to%20infect%20The%20Mask%20malware%20victims%20%7C%20ZDNet&c7=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&c9=
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
95.100.248.115 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-100-248-115.deploy.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
b.scorecardresearch.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
UID=18B95a100248101b79f8a3g1496978568; UIDR=1496978568
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:51 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
Targeting.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/
3 KB
859 B
XHR
General
Full URL
http://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_3xeBFJDuSs0SRW5&Q_LOC=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F
Requested by
Host: zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
URL: http://zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_3xeBFJDuSs0SRW5&Q_LOC=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F
Protocol
HTTP/1.1
Server
104.108.56.114 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-108-56-114.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
3adaca9c6364f73aec6e046f595d0479d61cc6845bff04c22e72b2aaf92e1c66

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate, sdch
Host
siteintercept.qualtrics.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com

Response headers

Date
Fri, 09 Jun 2017 03:22:52 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3P
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Access-Control-Allow-Origin
http://www.zdnet.com
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0, max-age=315360000
Access-Control-Allow-Credentials
true
Connection
keep-alive
ServerShortName
Content-Type
application/json
Content-Length
859
Expires
Mon, 07 Jun 2027 03:22:52 GMT
309391486091569
connect.facebook.net/signals/config/
27 KB
9 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/309391486091569?v=2.7.15
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
06b37e676ad28f865a02dab8e56898482dfdd9b987a6c4add7557364c1bddc1c
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* *.akamaihd.net wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=15552000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

:path
/signals/config/309391486091569?v=2.7.15
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
connect.facebook.net
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* *.akamaihd.net wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Origin Accept-Encoding
content-length
8740
x-xss-protection
0
pragma
public
x-fb-debug
lqdSUTGNeop7acx0rWen5Jih4eUvAdWwVoHWyfDXE1fo8dTLnw63+8jNQ7gvBowfh6ChxfZ4SNKgcGQf0YFk8Q==
x-frame-options
DENY
date
Fri, 09 Jun 2017 03:22:52 GMT
strict-transport-security
max-age=15552000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
https://connect.facebook.net
access-control-expose-headers
X-FB-Debug, X-Loader-Length
cache-control
public, max-age=1200
access-control-allow-credentials
true
access-control-allow-method
OPTIONS
expires
Sat, 01 Jan 2000 00:00:00 GMT
4083-12969.js
www.everestjs.net/dl/4083/
484 B
484 B
Script
General
Full URL
http://www.everestjs.net/dl/4083/4083-12969.js
Requested by
Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol
HTTP/1.1
Server
95.101.245.232 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-245-232.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.everestjs.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:52 GMT
Last-Modified
Mon, 25 Nov 2013 14:23:10 GMT
Server
Apache
ETag
"4a5a49-1e4-4ec011a776f80"
Content-Type
text/javascript
Cache-Control
max-age=50130
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
484
Expires
Fri, 09 Jun 2017 17:18:22 GMT
Cookie set v
pixel.everesttech.net/4083/
128 B
128 B
Image
General
Full URL
http://pixel.everesttech.net/4083/v?ev___loc=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&ev___ref=%2F%2F
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
66.117.28.68 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pixel.everesttech.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
everest_session_v2=WToUiwAABZhotn2v; everest_g_v2=g_surferid~WToUiQAAAGHKok6F
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:52 GMT
Last-Modified
Wed, 19 Oct 2016 22:11:25 GMT
Server
Apache
ETag
"443774-80-53f3f17013d40"
Vary
Cookie
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Set-Cookie
everest_session_v2=WToUiwAABZhotn2v; path=/; domain=.everesttech.net everest_g_v2=g_surferid~WToUiQAAAGHKok6F; path=/; domain=.everesttech.net; expires=Sat, 04-May-2019 14:02:52 GMT
Cache-Control
no-cache
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/png
Keep-Alive
timeout=15, max=992407
Content-Length
128
1x1
pixel.everesttech.net/
Redirect Chain
  • http://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEP16djRA38Ah5gQcWAHRVPY&google_cver=1
  • http://pixel.everesttech.net/1x1
128 B
128 B
Image
General
Full URL
http://pixel.everesttech.net/1x1
Protocol
HTTP/1.1
Server
66.117.28.68 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pixel.everesttech.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
ev_sync_ax=20170609; everest_session_v2=WToUiwAABZhotn2v; everest_g_v2=g_surferid~WToUiQAAAGHKok6F
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:52 GMT
Last-Modified
Wed, 19 Oct 2016 22:11:25 GMT
Server
Apache
ETag
"9c3852-80-53f3f17013d40"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=992372
Content-Length
128

Redirect headers

Date
Fri, 09 Jun 2017 03:22:51 GMT
Server
AMO-cookiemap/1.1
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location
http://pixel.everesttech.net/1x1
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=15,max=100
Content-Length
0
/
www.facebook.com/tr/
44 B
53 B
Image
General
Full URL
https://www.facebook.com/tr/?id=309391486091569&ev=PageView&dl=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&rl=&if=false&ts=1496978572032&v=2.7.15&a=tmtealium&ec=0&o=28
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a03:2880:f11c:8083:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Request headers

:path
/tr/?id=309391486091569&ev=PageView&dl=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&rl=&if=false&ts=1496978572032&v=2.7.15&a=tmtealium&ec=0&o=28
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
www.facebook.com
referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
:scheme
https
:method
GET
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Fri, 09 Jun 2017 03:22:52 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
set-cookie
fr=0mmQ8Uc67Xh86pcwC..BZOhSM...1.0.BZOhSM.; expires=Thursday, 07-Sep-2017 03:22:52 GMT; path=/; domain=.facebook.com; HttpOnly; secure
content-length
44
expires
Fri, 09 Jun 2017 03:22:52 GMT
/
www.facebook.com/tr/ Frame 603.
0
0

/
www.google.de/ads/user-lists/1036174608/
Redirect Chain
  • http://www.google.com/ads/user-lists/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1773981433&cdct=2&is_vtc=1&random=38932789&fpvtc=/1036174608/%3Flab...
  • http://www.google.de/ads/user-lists/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1773981433&cdct=2&is_vtc=1&random=38932789&fpvtc=/1036174608/%3Flabe...
42 B
42 B
Image
General
Full URL
http://www.google.de/ads/user-lists/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1773981433&cdct=2&is_vtc=1&random=38932789&fpvtc=/1036174608/%3Flabel%3DpXjaCJ6m6gcQkIqL7gM%26ctc_id%3DCAIVAgAAAB0CAAAA%26ct_cookie_present%3Dfalse%26random%3D260727973%26cdct%3D2%26is_vtc%3D1&ipr=y&ulfeg=n
Protocol
HTTP/1.1
Server
2a00:1450:401b:802::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
adclick_server /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.google.de
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:52 GMT
X-Content-Type-Options
nosniff
Server
adclick_server
Content-Type
image/gif
Cache-Control
no-cache, no-store, must-revalidate
Content-Length
42
X-XSS-Protection
1; mode=block
Expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Fri, 09 Jun 2017 03:22:52 GMT
X-Content-Type-Options
nosniff
Server
adclick_server
Content-Type
text/html; charset=UTF-8
Location
http://www.google.de/ads/user-lists/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1773981433&cdct=2&is_vtc=1&random=38932789&fpvtc=/1036174608/%3Flabel%3DpXjaCJ6m6gcQkIqL7gM%26ctc_id%3DCAIVAgAAAB0CAAAA%26ct_cookie_present%3Dfalse%26random%3D260727973%26cdct%3D2%26is_vtc%3D1&ipr=y&ulfeg=n
Cache-Control
private, max-age=43200
Content-Length
568
X-XSS-Protection
1; mode=block
Expires
Fri, 09 Jun 2017 03:22:52 GMT
pixel
ad.yieldmanager.com/
0
0
Image
General
Full URL
http://ad.yieldmanager.com/pixel?id=2447099&t=2
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
2a00:1288:110:833::4000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
ad.yieldmanager.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:52 GMT
Server
ATS
Connection
close
Content-Length
0
Cookie set s
pixel.everesttech.net/4083/
128 B
128 B
Image
General
Full URL
http://pixel.everesttech.net/4083/s?s=12969
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
66.117.28.68 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pixel.everesttech.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
everest_session_v2=WToUiwAABZhotn2v; everest_g_v2=g_surferid~WToUiQAAAGHKok6F
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:52 GMT
Last-Modified
Wed, 19 Oct 2016 22:11:25 GMT
Server
Apache
ETag
"9c3852-80-53f3f17013d40"
Vary
Cookie
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Set-Cookie
everest_session_v2=WToUiwAABZhotn2v; path=/; domain=.everesttech.net everest_g_v2=g_surferid~WToUiQAAAGHKok6F; path=/; domain=.everesttech.net; expires=Sat, 04-May-2019 14:02:52 GMT
Cache-Control
no-cache
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/png
Keep-Alive
timeout=15, max=978288
Content-Length
128
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/
52 KB
16 KB
Script
General
Full URL
http://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=Core&Version=si.2017.12
Requested by
Host: zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
URL: http://zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_3xeBFJDuSs0SRW5&Q_LOC=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F
Protocol
HTTP/1.1
Server
104.108.56.114 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-108-56-114.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
d03b4f540581b41d08f42de448145d949323fc70ccaa7948e4a9e16608052cd6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
siteintercept.qualtrics.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:52 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3P
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Expires
Sat, 10 Jun 2017 00:18:09 GMT
Cache-Control
max-age=75317
Connection
keep-alive
Content-Type
text/javascript
Content-Length
16011
ServerShortName
Targeting.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/
3 KB
854 B
XHR
General
Full URL
http://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_3xeBFJDuSs0SRW5&Q_LOC=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&t=1496978572252&Q_VSI=%7B%22SI_37zA9h5CXtf9LZr%22%3A%22DependencyResolver%22%2C%22SI_9SUpOeEcnr7zthr%22%3A%22DependencyResolver%22%2C%22SI_bqq5stF69dfIlcF%22%3A%22DependencyResolver%22%7D
Requested by
Host: zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
URL: http://zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_3xeBFJDuSs0SRW5&Q_LOC=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F
Protocol
HTTP/1.1
Server
104.108.56.114 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-108-56-114.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf49b6cf5a6c8c4ccdbae937fce5bb9ebb655347b31776c4550ba7740faa2ae5

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate
Host
siteintercept.qualtrics.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-type
application/x-www-form-urlencoded
Accept
*/*
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Content-Length
157
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Date
Fri, 09 Jun 2017 03:22:52 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3P
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Access-Control-Allow-Origin
http://www.zdnet.com
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0, max-age=315360000
Access-Control-Allow-Credentials
true
Connection
keep-alive
ServerShortName
Content-Type
application/json
Content-Length
854
Expires
Mon, 07 Jun 2027 03:22:52 GMT
domains
api.viglink.com/api/
42 B
42 B
XHR
General
Full URL
http://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: http://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Server
52.17.60.112 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-17-60-112.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
8580b92ddbd7aebefc8f98bacddbdc8189cca3a49708a9e4378a2ba1ea9d915a

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate
Host
api.viglink.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Accept
*/*
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
vglnk.Agent.p=4c20446b70137829c06f930c445610a7; __cfduid=df2fa65a05a72729bce5c4af8d6714fb81496978571
Connection
keep-alive
Content-Length
192
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:51 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
http://www.zdnet.com
Cache-Control
no-cache no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT
/
22fa047d.akstat.io/
0
0
XHR
General
Full URL
http://22fa047d.akstat.io/
Requested by
Host: c.go-mpulse.net
URL: http://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol
HTTP/1.1
Server
104.108.48.32 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-108-48-32.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate
Host
22fa047d.akstat.io
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-type
application/x-www-form-urlencoded
Accept
*/*
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Content-Length
38418
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Access-Control-Allow-Origin
http://www.zdnet.com
Date
Fri, 09 Jun 2017 03:22:52 GMT
Cache-Control
no-cache
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Content-Type
image/gif
tboptevent.html
widget.perfectmarket.com/opt/ Frame 603.
0
0

logo-192x192.png
zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/logos/
8 KB
7 KB
Other
General
Full URL
http://zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/logos/logo-192x192.png
Protocol
HTTP/1.1
Server
72.247.178.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a72-247-178-8.deploy.akamaitechnologies.com
Software
nginx /
Resource Hash
71f4fc46c709149bfb9d5776e6c731772602a331241207300eb6c14f408e3f7f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
zdnet1.cbsistatic.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 09 Jun 2017 03:22:52 GMT
Content-Encoding
gzip
Last-Modified
Thu, 12 Jan 2017 17:14:18 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
7657
Expires
Fri, 16 Jun 2017 03:22:52 GMT
social
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
0
Image
General
Full URL
http://trc.taboola.com/cbsinteractive-zdnet/log/3/social?ri=95aae88ac9147ccf248e2f03d8af7b88&sd=v2_252ce2b55a7f52b0eafd4b8e9982312b_143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09_1496978569_1496978569_CNawjgYQzro_GOfwgNfIKyABKAE&ui=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09&pi=/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims&wi=3604502968781364361&pt=text&vi=1496978569319&st=social-available&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22ctx%22%2C%22ism%22%3Afalse%2C%22srx%22%3A1600%2C%22sry%22%3A1200%2C%22pd%22%3Anull%2C%22tpl%22%3A%22%22%2C%22url%22%3A%22http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%22%2C%22rref%22%3A%22%22%2C%22sref%22%3A%22_undefined_%22%2C%22hdl%22%3A%22%22%2C%22sec%22%3A%22%22%2C%22aut%22%3A%22%22%2C%22img%22%3A%22%22%2C%22v%22%3A13%7D%5D%7D&tim=03%3A22%3A53.302&id=4971&llvl=1&cv=257-18-RELEASE&
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
151.101.114.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.10.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
trc.taboola.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
taboola_session_id=v2_252ce2b55a7f52b0eafd4b8e9982312b_143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09_1496978569_1496978569_CNawjgYQzro_GOfwgNfIKyABKAE; JSESSIONID=.water401; stpt="thetradedesk-network!-#@1497583369342,neustar!-#@1497583369342,bluekai!-#@1497583369342"; taboola_upci=CIDxgNfIKxIPFQAAAAAdAAAAACUAAAAAKg8VAAAAAB0AAAAAJQAAAAAwAA; t_vpub=CAETCM66PxABFA; t_gid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09; taboola_usg=GgQQ9KlB
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:53 GMT
Via
1.1 varnish
Server
nginx/1.10.1
X-Timer
S1496978573.308086,VS0,VE8
X-Served-By
cache-hhn1525-HHN
X-Cache
MISS
P3P
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/gif
X-Cache-Hits
0
domains
api.viglink.com/api/
42 B
42 B
XHR
General
Full URL
http://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: http://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Server
52.17.60.112 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-17-60-112.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
6c03c100eb4b58902c8da548393924c65ac6084f577660bfdc7ad411b4e19d98

Request headers

Pragma
no-cache
Origin
http://www.zdnet.com
Accept-Encoding
gzip, deflate
Host
api.viglink.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Accept
*/*
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
vglnk.Agent.p=4c20446b70137829c06f930c445610a7; __cfduid=df2fa65a05a72729bce5c4af8d6714fb81496978571
Connection
keep-alive
Content-Length
186
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Origin
http://www.zdnet.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:52 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
http://www.zdnet.com
Cache-Control
no-cache no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT
tboptevent.html
widget.perfectmarket.com/opt/ Frame 603.
0
0

social
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
0
Image
General
Full URL
http://trc.taboola.com/cbsinteractive-zdnet/log/3/social?ri=95aae88ac9147ccf248e2f03d8af7b88&sd=v2_252ce2b55a7f52b0eafd4b8e9982312b_143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09_1496978569_1496978569_CNawjgYQzro_GOfwgNfIKyABKAE&ui=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09&pi=/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims&wi=3604502968781364361&pt=text&vi=1496978569319&st=social-visible&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A1%2C%22ln%22%3A%22below-fold%22%2C%22lx%22%3A425%2C%22ly%22%3A810%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%2C%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A1%2C%22ln%22%3A%22below-fold%22%2C%22lx%22%3A631%2C%22ly%22%3A810%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%5D%7D&tim=03%3A22%3A55.302&id=9512&llvl=1&cv=257-18-RELEASE&
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
151.101.114.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.10.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
trc.taboola.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
taboola_session_id=v2_252ce2b55a7f52b0eafd4b8e9982312b_143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09_1496978569_1496978569_CNawjgYQzro_GOfwgNfIKyABKAE; JSESSIONID=.water401; stpt="thetradedesk-network!-#@1497583369342,neustar!-#@1497583369342,bluekai!-#@1497583369342"; taboola_upci=CIDxgNfIKxIPFQAAAAAdAAAAACUAAAAAKg8VAAAAAB0AAAAAJQAAAAAwAA; t_vpub=CAETCM66PxABFA; t_gid=143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09; taboola_usg=GgQQ9KlB
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:55 GMT
Via
1.1 varnish
Server
nginx/1.10.1
X-Timer
S1496978575.307221,VS0,VE8
X-Served-By
cache-hhn1525-HHN
X-Cache
MISS
P3P
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/gif
X-Cache-Hits
0
240.mp4
cdn2.teads.tv/scala/141548/aef8ad1069fa72d00fc7ffc16a62d06b/ Frame 603.
67 KB
62 KB
Media
General
Full URL
http://cdn2.teads.tv/scala/141548/aef8ad1069fa72d00fc7ffc16a62d06b/240.mp4
Protocol
HTTP/1.1
Server
95.100.186.168 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-186-168.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash

Request headers

Pragma
no-cache
Accept-Encoding
identity;q=1, *;q=0
Host
cdn2.teads.tv
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Range
bytes=0-
Accept
*/*
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Cookie
tt_viewer=2de54e70-a45d-4808-ae5f-2597108614bf
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Range
bytes=0-

Response headers

Date
Fri, 09 Jun 2017 03:22:55 GMT
Last-Modified
Wed, 07 Jun 2017 14:47:07 GMT
Server
AmazonS3
x-amz-request-id
9CF00C67D3DD8E3C
ETag
"3d1d2d1699004a8e2a8396d8e6b2f9d6"
Content-Type
video/mp4
Content-Range
bytes 0-1477610/1477611
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Content-Length
1477611
x-amz-id-2
OoAy9cWcpVoVlyiWOw26lbARdDlzFkxGZAfkQ51nyPEOzTWlVn+gySoZj2IpG87F89uwN8bkkIk=
activeview
pagead2.googlesyndication.com/ Frame 603.
42 B
42 B
Image
General
Full URL
http://pagead2.googlesyndication.com/activeview?avi=Bm3j2hxQ6WdGWLaXPxgKlub3ADAAAAAAQATgByAEJwAIC4AIA4AQBoAYf0ggFCIBhEAE&cid=CAASBORod8E&id=osdim&ti=1&adk=3009519373&mtos=0,0,0,0,0&tos=0,0,0,0,0&p=0,0,0,0&mcvt=0&rs=3&ht=0&mc=0&lte=0&bas=1&bac=1&gte=108809103&tmo=6&tme=1123&rtl=false&til=1123&tdl=266&tdld=64&tcl=257&tcld=106&tlr=257&tlrd=106&r=u&bs=1583,1132&bos=1598,1132&ps=1583,8291&ss=1600,1200&tt=3006&pt=3776&deb=1-12-12-19-14-8&tvt=7&avms=geo&uc=4&tgt=BODY&cl=1&cec=7&clc=0&cd=371x0
Requested by
Host: www.zdnet.com
URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Protocol
HTTP/1.1
Server
2a00:1450:4001:824::2002 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pagead2.googlesyndication.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2017 03:22:55 GMT
X-Content-Type-Options
nosniff
Server
cafe
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, must-revalidate
Timing-Allow-Origin
*
Content-Length
42
X-XSS-Protection
1; mode=block
Expires
Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
cl.netseer.com
URL
http://cl.netseer.com/dsatserving2/servlet/BannerServer?tagid=21103&url=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&adh=240&adw=770&imps=2&impt=1&frd=1496978567512&apid=1980159&mresp=0&t=0.8628173348193167
Domain
tags.bluekai.com
URL
https://tags.bluekai.com/site/20486?limit=0&id=5978151335970770985
Domain
idsync.rlcdn.com
URL
https://idsync.rlcdn.com/395886.gif?partner_uid=5978151335970770985
Domain
dw.cbsi.com
URL
http://dw.cbsi.com/levt/ria/e.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=27081696-34e5-11e4-9e6a-00505685119a&assettitle=washington%20post%2C%20guardian%20links%20used%20to%20infect%20the%20mask%20malware%20victims&assettype=content_article&pubdate=2014-02-10%2018%3A03%3A05&viewguid=93e230e0-1346-4244-983d-5885f92e829c&devicetype=desktop&sitetype=responsive%20web&author=violet%20blue&authorid=80fecb98-8175-11e2-9d12-0018fe8a00b0&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&s8=cnetzdnetglobalsite&v23=cnetzdnetglobalsite&v19=article&v17=113c25b6-ec91-11e3-95d2-02911863765e&v20=27081696-34e5-11e4-9e6a-00505685119a&v16=93e230e0-1346-4244-983d-5885f92e829c&riaevent=impression&comptyp=spot&mapp=medusa_app&objtyp=medusa&eventt=log&v18=security&comp=ucwc&ts=1496978567843&tcset=utf8&im=dsjs&title=Washington%20Post%2C%20Guardian%20links%20used%20to%20infect%20The%20Mask%20malware%20victims%20%7C%20ZDNet&srcurl=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F
Domain
tpc.googlesyndication.com
URL
http://tpc.googlesyndication.com/safeframe/1-0-8/html/container.html
Domain
tpc.googlesyndication.com
URL
http://tpc.googlesyndication.com/safeframe/1-0-8/html/container.html
Domain
tpc.googlesyndication.com
URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Domain
tpc.googlesyndication.com
URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Domain
sync.teads.tv
URL
http://sync.teads.tv/iframe/redirect
Domain
bttrack.com
URL
http://bttrack.com/Pixel/Impression/?data=OuJifVtEKZqw3Hzm6f7tW7Pt5tYXW6YgQ67bxMhTPvcdvD21yECtadqcc2b3ezXHmnsOuoo9IdOJDmsbcAdtQEL0FlmyyBFBGHax9kvS-Whuo5keArV_MmUwYWItSaShZ50pP7OmglARsgpApKVrjQATh8sf_9N5XFxYJCTCbmmp0LK8PfJYyOYI1W-ZkFZpSxARywY-42eqJ2HmCIaPYotutOsG1jqsmFhu6kupvUed93uYYoAb-0LU4zug_aCLqYGHLHYknpE21E5_jYteEeOnyBcyvXQY4Yl1TL2Vc8btt45vMQ_8tUjobdHsAI66znN98lZMWS1OUBNfAZryU0hR8spiXk5KCX_wb0aIQAbfJP5Tj5zFxPRevNA2xVHD6M6uqRxv0S2Zu9UsLRddG6U_YfA00
Domain
sync.teads.tv
URL
http://sync.teads.tv/iframe?pid=61059&userId=300307ed-807e-463d-bce8-e1b0e0e3c93a&1496978569562
Domain
fast.cbsi.demdex.net
URL
http://fast.cbsi.demdex.net/dest5.html?d_nsid=undefined
Domain
fast.cbsi.demdex.net
URL
http://fast.cbsi.demdex.net/dest5.html?d_nsid=0
Domain
www.everestjs.net
URL
http://www.everestjs.net/static/pixel_details.html
Domain
www.lightboxcdn.com
URL
https://www.lightboxcdn.com/static/identity.html?purl=http%3A%2F%2Fwww.zdnet.com%2Farticle%2Fwashington-post-guardian-links-used-to-infect-the-mask-malware-victims%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=1&prev=0&cb=636294540878687886
Domain
www.facebook.com
URL
https://www.facebook.com/tr/
Domain
widget.perfectmarket.com
URL
http://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
Domain
widget.perfectmarket.com
URL
http://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

33 Cookies

Domain/Path Name / Value
.crwdcntrl.net/ Name: _cc_dc
Value: 1
.zdnet.com/ Name: __gads
Value: ID=5862cbe659e0fc4d:T=1496978569:S=ALNI_Ma30Latm-HXDUGa_ZUNEGJSHYNrzg
.demdex.net/ Name: demdex
Value: 35714883694003665103108200718919644587
.flashtalking.com/ Name: flashtalkingad1
Value: "GUID=344747ACDBD0B7"
www.zdnet.com/ Name: trc_cookie_storage
Value: cbsinteractive-zdnet%253Asession-data%3Dv2_252ce2b55a7f52b0eafd4b8e9982312b_143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09_1496978569_1496978569_CNawjgYQzro_GOfwgNfIKyABKAE%7Ctaboola%2520global%253Alocal-storage-keys%3D%255B%2522cbsinteractive-zdnet%253Asession-data%2522%252C%2522taboola%2520global%253Auser-id%2522%255D%7Ctaboola%2520global%253Auser-id%3D143b53d8-ce51-4f0d-b6b8-fac781b0fe74-tuct339a09
.zdnet.com/ Name: _ga
Value: GA1.2.519849922.1496978568
.zdnet.com/ Name: _gid
Value: GA1.2.2086022008.1496978569
.bttrack.com/ Name: GLOBALID
Value: 2uKlc8-sIBd987HhIIG6ZJ394IvmWVAddZE_n-rLvEUO3zr2cPDHqoPNnBtS5MYaRp3dhCHTlbM1
.zdnet.com/ Name: AMCV_10D31225525FF5790A490D4D%40AdobeOrg
Value: -1248264605%7CMCMID%7C82019002344760642192159551723785266833%7CMCAAMLH-1497583367%7C6%7CMCAAMB-1497583368%7CcIBAx_aQzFEHcPoEv0GwcQ%7CMCOPTOUT-1496985768s%7CNONE%7CMCAID%7C2C9D0A4405312D21-600001008000086D
.teads.tv/iframe Name: tt_exelate
Value:
.teads.tv/ Name: tt_viewer
Value: 2de54e70-a45d-4808-ae5f-2597108614bf
.zdnet.com/ Name: AMCVS_10D31225525FF5790A490D4D%40AdobeOrg
Value: 1
.zdnet.com/ Name: fly_geo
Value: {"countryCode": "de"}
.crwdcntrl.net/ Name: _cc_id
Value: 56f9b8ecb8f877b05f67cb6b895a08f2
www.zdnet.com/ Name: bm_last_load_status
Value: NOT_BLOCKING
www.zdnet.com/ Name: bm_sample_frequency
Value: 100
www.zdnet.com/ Name: _tb_sess_r
Value:
www.zdnet.com/ Name: _tb_t_ppg
Value: http%3A//www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/
.zdnet.com/ Name: _gat__pm_ga
Value: 1
www.zdnet.com/ Name: bm_daily_unique
Value: true
.crwdcntrl.net/ Name: _cc_cc
Value: "ACZ4nGNQMDVLs0yySE1OskizMDdPMjBNMzNPTjJLsrA0TTSwSDNiAIJIK5FOBjjgXz7jFh9jtxHDf0ZGhl0HdWHMnQjmm4b7AjD29BPqMOb5xXNYYOxzRw8xw9gPpvYwwtgfP1vCmK%2F6ngnC2IeRtN449YgNxr6ExP6AZOs7JDYAvjREwA%3D%3D"
.teads.tv/iframe Name: tt_bluekai
Value:
www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims Name: adblock_status
Value: not_adblocking
.zdnet.com/ Name: fly_device
Value: desktop
.zdnet.com/ Name: utag_main
Value: linktag:undefined%3Bexp-session
.zdnet.com/ Name: aam_uuid
Value: 81798148289666930272139155021439591401
www.zdnet.com/ Name: bm_monthly_unique
Value: true
.zdnet.com/ Name: s_cc
Value: true
www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims Name: fyre-livecount
Value: 945205045488
.zdnet.com/ Name: RT
Value: "sl=1&ss=1496978565127&tt=6621&obo=0&bcn=%2F%2F22fa047d.akstat.io%2F&sh=1496978571751%3D1%3A0%3A6621&dm=zdnet.com&si=726626e9-f7d3-45e2-af33-61cf58b02b33&ld=1496978571751"
.zdnet.com/ Name: ak_bmsc
Value: 696881092272EF0930C85E1E20196A6548F7B204AE4800008A143A597B2EC813~plZQAA624bv5b5eaeDRrYe7jRXnRbuTp3XCItTIgWaY8PypUzNDmpAEVsOHn0JJpGHF1J+HWLxW2OI4zYAgBQqRi40fH+WQuY/MC44H7GmUGenmNgXJa+grkAMajKdpMGRbZtCNqeLY7VT1QicmywR3GVUvH6bTjzLXpveP+nTlU1O2JSwpmFDJ1AryyFXqS1Pg2fang+p9lJCa97NEk4v6VNpNtziZQyiQghW1KInG6s=
.zdnet.com/ Name: fly_default_edition
Value: eu
.crwdcntrl.net/ Name: _cc_aud
Value: ABR4nGNgYGCItBLpZIABRgbG1hVAGgAcUwJg

32 Console Messages

Source Level URL
Text
console-api log URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/(Line 196)
Message:
ADS: queuing sponsored-text-link-593a1485439c9 for display
console-api log URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/(Line 209)
Message:
ADS: queuing ticker-593a1485439c9 for display
console-api log URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/(Line 601)
Message:
ADS: queuing intromercial-593a1485439c9 for display
console-api log URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/(Line 662)
Message:
ADS: queuing skin-593a1485439c9 for display
console-api log URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/(Line 670)
Message:
ADS: queuing leader-plus-top-593a1485439c9 for display
console-api log URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/(Line 800)
Message:
ADS: queuing inpage-video-top-593a1485439c9 for display
console-api log URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/(Line 813)
Message:
ADS: queuing sharethrough-top-593a1485439c9 for display
console-api log URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/(Line 953)
Message:
ADS: queuing mpu-plus-top-593a1485439c9 for display
console-api log URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/(Line 965)
Message:
ADS: queuing vendor-text-link-593a1485439c9 for display
console-api log URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/(Line 1083)
Message:
ADS: queuing dynamic-showcase-top-593a1485439c9 for display
console-api log URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/(Line 1090)
Message:
ADS: queuing mpu-middle-593a1485439c9 for display
console-api log URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/(Line 1104)
Message:
ADS: queuing mpu-bottom-593a1485439c9 for display
console-api log URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/(Line 1121)
Message:
ADS: queuing leader-plus-bottom-593a1485439c9 for display
console-api log (Line 2)
Message:
ADS: queuing mpu-bottom-593a1485439c9 for display
console-api log URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 9)
Message:
Missing adCookieData!
console-api log URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 82)
Message:
zdnet
console-api log URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 82)
Message:
zdnet
console-api log URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 82)
Message:
zdnet
console-api log (Line 74)
Message:
skin (clickable) ::: creative id = 120028132569
console-api log (Line 29)
Message:
blank creative loaded: 43583969169 (980 x 45)
console-api log (Line 29)
Message:
blank creative loaded: 43583970849 (401 x 11)
console-api log (Line 29)
Message:
blank creative loaded: 31224235809 (300 x 450)
console-api log (Line 29)
Message:
blank creative loaded: 120027819609 (300 x 250)
console-api log (Line 29)
Message:
blank creative loaded: 119967648249 (300 x 250)
console-api log (Line 29)
Message:
blank creative loaded: 119960265609 (728 x 90)
console-api log URL: http://www.zdnet.com/article/washington-post-guardian-links-used-to-infect-the-mask-malware-victims/(Line 160)
Message:
Dynamic Showcase Center container ::: creative id = 72087703209
console-api log (Line 29)
Message:
blank creative loaded: 72120427449 (372 x 142)
console-api log URL: http://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 82)
Message:
zdnet
console-api log URL: http://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=636294540878687886(Line 10364)
Message:
DIGIOH: identityChildReady999999999: zyxcba
console-api log URL: http://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=636294540878687886(Line 10364)
Message:
DIGIOH: setIsLocalStorageWorking(0)
console-api log URL: http://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=636294540878687886(Line 10364)
Message:
DIGIOH: Calling setIsLocalStorageWorking using short circuit!!!!
console-api log URL: http://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=636294540878687886(Line 10364)
Message:
DIGIOH: setIsLocalStorageWorking(0)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

22fa047d.akstat.io
a.teads.tv
ad.atdmt.com
ad.yieldmanager.com
api.bttrack.com
api.viglink.com
as.casalemedia.com
asset.pagefair.com
asset.pagefair.net
att.demdex.net
avatars.fyre.co
b.scorecardresearch.com
b2b.cbsimg.net
bootstrap.livefyre.com
bttrack.com
c.go-mpulse.net
cas.criteo.com
cbsi.demdex.net
cdn.bttrack.com
cdn.clicktale.net
cdn.livefyre.com
cdn.optimizely.com
cdn.taboola.com
cdn.teads.tv
cdn.viglink.com
cdn2.teads.tv
cl.netseer.com
cm.netseer.com
cmi.netseer.com
cn.cbsimg.net
connect.facebook.net
csi.gstatic.com
ct214.dsr.livefyre.com
data.livefyre.com
dpm.demdex.net
dw.cbsi.com
dw.cbsimg.net
fast.cbsi.demdex.net
geo.moatads.com
graph.facebook.com
gum.criteo.com
ib.adnxs.com
idsync.rlcdn.com
iicbsi-a.akamaihd.net
image2.pubmatic.com
images.taboola.com
in.ml314.com
js.indexww.com
js.moatads.com
lc.livefyre.com
lc72.dsr.livefyre.com
match.taboola.com
ml314.com
native.sharethrough.com
om.cbsi.com
pagead2.googlesyndication.com
pixel.everesttech.net
pixel.rubiconproject.com
ps.eyeota.net
ps.ns-cdn.com
pubads.g.doubleclick.net
px.moatads.com
rev.cbsi.com
secure-us.imrworldwide.com
secure.adnxs.com
securepubads.g.doubleclick.net
siteintercept.qualtrics.com
stats.pagefair.com
sync.teads.tv
t.teads.tv
tag.researchnow.com
tags.bluekai.com
tags.tiqcdn.com
tpc.googlesyndication.com
tps30.doubleverify.com
trc.taboola.com
tru.am
us-u.openx.net
widget.perfectmarket.com
www.everestjs.net
www.facebook.com
www.google-analytics.com
www.google.de
www.googletagservices.com
www.lightboxcdn.com
www.linkedin.com
www.zdnet.com
z.moatads.com
zdnet.bootstrap.fyre.co
zdnet.stream1.fyre.co
zdnet1.cbsistatic.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
zdnet4.cbsistatic.com
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
zor.fyre.co
bttrack.com
cl.netseer.com
dw.cbsi.com
fast.cbsi.demdex.net
idsync.rlcdn.com
sync.teads.tv
tags.bluekai.com
tpc.googlesyndication.com
widget.perfectmarket.com
www.everestjs.net
www.facebook.com
www.lightboxcdn.com
104.108.48.32
104.108.56.114
138.108.96.100
151.101.112.233
151.101.113.181
151.101.114.2
151.101.14.49
172.217.22.98
173.241.240.143
178.250.0.67
178.250.2.71
185.33.223.206
185.33.223.209
192.132.33.27
192.132.33.31
198.47.127.15
204.154.111.113
216.239.120.246
23.0.40.31
23.111.11.222
23.111.9.30
2400:cb00:2048:1::6810:4b27
2400:cb00:2048:1::6810:a00d
2400:cb00:2048:1::6810:a40d
2400:cb00:2048:1::6819:a222
2620:109:c00c:104::b93f:9001
2a00:1288:110:833::4000
2a00:1450:4001:81d::2001
2a00:1450:4001:81d::200e
2a00:1450:4001:824::2002
2a00:1450:400e:800::2003
2a00:1450:401b:802::2003
2a02:26f0:64::210:6b08
2a02:26f0:78:18d::2db0
2a03:2880:f01c:20e:face:b00c:0:2
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f01c:9:face:b00c:0:1
2a03:2880:f11c:8083:face:b00c:0:25de
34.196.245.179
34.198.184.115
34.199.132.64
34.199.66.174
34.207.48.84
34.249.129.150
34.251.148.123
50.16.161.127
52.1.246.30
52.17.60.112
52.200.5.59
52.201.11.100
52.203.183.164
52.206.49.191
52.208.40.88
52.30.66.229
52.31.65.152
52.31.88.15
52.4.251.102
52.48.142.133
52.49.214.49
52.57.223.246
52.84.28.208
52.84.32.101
52.84.34.90
52.84.40.203
54.146.151.35
54.154.158.135
54.192.36.140
54.192.36.93
54.192.37.97
54.210.16.8
54.229.75.228
54.72.151.68
54.86.159.215
54.88.164.103
62.67.193.85
66.117.28.68
66.235.148.133
66.235.148.65
68.232.35.180
72.247.178.24
72.247.178.8
95.100.186.168
95.100.248.105
95.100.248.112
95.100.248.115
95.100.248.154
95.100.248.163
95.100.248.168
95.101.241.136
95.101.245.232
95.101.246.112
95.101.252.144
019a6fe5052688eca2cc5395598e6aaf0f43e972026f3232bc3ec4a0e1abe54e
01d932e46452da81f2eecc596f48fe168d2501f59727e2d7077c94d782523a56
035c6a2f4be7239b29b4f5145b518ed096eb82124637cbf57d38442494a9df4a
05ca65e9f294db291d7bca737b236986de41b4a6e55d5badac8903366c1de6fc
06b37e676ad28f865a02dab8e56898482dfdd9b987a6c4add7557364c1bddc1c
070734a9198f4d1994ee05f36ccaf0a4af0a94bb5f0a01bbcef5184ef58c17f2
0b66df7f0294f95106d32fddf0ef54ba4e5a2eee3f1a4aa4d14e5c3712d38e35
0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017
0eddaab3b8cb0b15d81d62e5ae5960329c3e576ea78dc321b20734ab20271847
0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d
0f6d4070e7f50fa7e754b3f4e01207969bc3922be3b4f02d7be3ab63748818ba
100770ceb57c9e10d5283206c1ae0b2b9653a0433021f48e9808751d3900c384
10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
117415b3c7ca40c605848ccbe4c73ebd211d005eed28c2d0bd58fcba0a58ceec
122d78976bfc083338ea0bbbee7ede31726a809f7f90752ed08b5f883c0628ce
126916b85594f83b0b2219434f7d9101ddd3b7627937f76a9741a5512d507355
12b21dc2a6ecc24566c1087756966f341cff296b8758bcdda4efd2d3c908a0a7
13b546bdf5736a773a5d237651266970775b3115f81cc42ae9010b9e1456e72b
15e3aaa814ef983144a212a909fda1e258b8e220784c4f5ef5656f5eab1ca55f
1a388f6470b57a4aea303bf37f2e14b5f09d828200cf7ebc371bf46647263f3f
1bf75dd72f22628a9b30baf624fb93fea6a635aa15ecfb7b6dda829ff1a61117
1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1
1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53
1f5390c537c67f8a7fda0a6263886acc9b8c830d55e285354d5f21cb336e0e38
1fd9cb1187942e358453708b06ce4c6ece34a1ce3a1d80bd316c34d56e661742
2154f777d1dca0c2f8eea29b26981b23b18611a5eb8232a43f12384d0ac3cd85
21a8144e29cf2f60d7361fa7bd962e302b324573faecadeb4992e450954b532d
255edb1f0d3fb5a7d930c19a27388967ec3141a3fce88d7507b336a8ae27ba97
2671d72b96d6d9a1b8bbc1429048505ea6dbc3514daf22ab6dd6dfc8a70ce8d3
26d9343eadd22b9f25c82f992b0a5dff4290b4b29656abbabd06388eeb014eb0
272478feb31b85e11a576ea02a7f9dcc02df20a69253fe2e981c8392a7e7b3a4
2a2de5beb8a808b1f2c288afde53eca0e8dba3e979750967f88ab04972cac70b
2af9dc2a580e92ba9fe0fccd715db8520a72069235dd7adefb437d6ed6348103
2ccd728594ce65fa7e6651109e3bbd61877e548c4dab5480cafa6965f358a4e0
315bba207a7e699f626db815466d2597b91ae0ad4ba4b1909c87300f0f7ff450
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
33e93d0302563436613b0cd260b87da3a88b35ca805868077cd468d2d8d0ecf2
346405485b8eb5393d72c6d004c888cbdddc4bd264274a91f6dc4d2c670798fc
374a55cc3bf0627f248a371049442af63aeb64047aa8b557c3ef0786facec0c1
3adaca9c6364f73aec6e046f595d0479d61cc6845bff04c22e72b2aaf92e1c66
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3ba7f40e2b4080979389e9b81e6d0ed155e9b7f74b3310bc1289ee70cba2035d
3c599ef176cecdb3de25c6c36bc2945b92c12bcbc2ab03350729f4de296b53b8
3cb8af8f49d328177a46138d9da7d57cf87cccddbfb8bac3092562d414d30d92
3cca45013cadb3fa01fb7ab7539a57f674a96053d123cf59dd9488c0bc76d77b
3d5819dcf4319ac59a25f43c4e800cd94b3d7d01b2e94fc04bea62ea65956620
3db67d33437ca898cf1d37aa35b12b7c180e0b4c4907960eeadbbb890b173443
3f3cd0dcfc18194138af49d208581065fea168171b9fe77143327904e9ebb61d
3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22
3ffcdc2e3b9a14d3bcfb9218ffd4c66442af6f972a217630c4b745e0b2e5c3d4
40d0a5b3a082259653eaa1a6cb0ccc1eddaadc90e0ceee6266b5df07f5947d0d
41452df83d87a902f281254194848f6bb39e57ced653c321491bad264806cbc0
442f24793a0a9be8127fdb8b38a1c3b6b2b2aa856e805e0d8649c894a1e63334
45f46e110ecb68a95d93cae5f2246b038bcb4e33601436f36167a8e1ff33de67
4b3b77256ae2eff154017eaff1b04d8711bf45a44d46e097758f07afa252936c
4c86666729bdcffa8e50b6cb524856726cf0e63b4d11b9e2d25794b754a79356
4d049d83eef469c1f2cc0f5df820144ff6c5eb896b4e4aa2e681a1cba7d622a9
4d1d55134769d5168118292383c17ca1e4cfdea886bd484f2fe4c47a551fb9d0
4d7ef2d59fa6de55fd64c182a866be72d9a14a1c187dc063e493a6e6009b2e75
4de69e960fb2afc8e2e6863650882d5514bca5971b51ada30619abf03f6f81c9
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f22a9c52f1baca3dfa041a6d09206be845ba4ed692db2ab42a3ab0364fa8392
4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13
528b6b3e8edb272a61e1d3b10f11af0d241680684143fb5339fa2758a3e65187
52e5457a115897b2c06299769eb4077f60ee95331b10c6ba69b2cf2ad4a858c6
55252b56196d9c050f2487112a0b6214037029dffbf48e4deab8d09125330756
557007834448c888efaa01c2c1d25155130fea075308b3bdb1ea87662b82a2ae
5707c0c20a0c6e4e510904c4229eca894570a439467f7562a0694dfbd9b28c5f
576e8bf4510a62d7cdcfedd8b749f3039d0c5aa8b2bdfe2e38a44645e0f982e4
57dd94f0d9fbed3b1e0437e4af6f807a1e57f06a200cd1755ad767c787b6652f
58109422f2e148020d624b0adee264da7691cc2eeebfb2f2e4140ee500ff6780
5856c358cd7b45e8ed4a4cd710392afcd24f02b65c72c1507a7ac3cc08797f35
59e63ae7728cb41dfa246ae8e6b4e2be283ee731737b10858e4a373d148df985
5a1318561f33ce1e72266caa414ce25c39463998160451ca1ecaf9571b79e636
5b6b56078eb0f3efed65d57f6fa84e7d010106c895ddf22b6283a7c042c92614
5bd6c7ed0b96e469ed51d54f8cfbccd922d537d8825556b203d3904aa5a05977
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3
61c4d6be40fe3111339268ac5ced5b247564944794b318489488848f0cf945b2
63efde2b33373b6e485fcca3b49d9e5b6c9ec423100ca50a4d1a5b8cf9b9af46
64826792ac5d95d95d51f7b9fedba4c74240816ebdc48ff5e481b905ffd40498
683f12838aec7f724965c11f4f53b1ed7947959e6da96a18628418755e82e545
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
697d161683f3f155d137af4ba7345ebb4924c47ab5227bd1fbcd81453a0cdee1
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b67f5de941377455d3fdd0cb6db86aeda8b0918b66ffb5127b35d81f0317b1e
6c03c100eb4b58902c8da548393924c65ac6084f577660bfdc7ad411b4e19d98
6c3b778f9857724245edd89767f6dbe13c1ae96468375e78a2b718bacf765cf8
6cbe3154f8586c03565905d4eaf762939059b621d8824c116828db6ea78b95ee
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
6f7d2101a47c82983248e5ce834d3e7a9545285c11ba7d0d1bc00d7dff29aa13
6f9fd333e3457ca928903ff87fe7035fdf5675a00efaff3047c6c22604b0c95e
6fd0b292bad1e3f33e13b2c33f116238a25a036fb1a400efd5269d4c88e32289
6ffdc3f8c9b917bbec995f62ea5a3682c80f25024f03bdb6f8163356f3a59a43
71f4fc46c709149bfb9d5776e6c731772602a331241207300eb6c14f408e3f7f
73ffdcce854ad81be3d51dded6a94a88d3cf06e47633f7f510d8b601e37969d6
766ab54cb14ef1453fc5faa9bea447e4c85c95a0dba39f7cc57c403761edc3ca
771e516f92e03baf7b791224a638d51116f9238ffc88c6ee331a14c9c420dde0
773b777ab91359b0edbf42357f200c6f2dbd496b625e534a0ebc0f07a67654e2
776cd5b2e2140b2a5dd6f2d5a1ace401d389a8fc996b5de828b2b1a56ebc3de4
786f05e6f9e7a1c0879925b1c4b8ac90d9d9cab67c8bc43a1ffafd5544dbe1af
79c2d2235013fc78642ec014222efa28a3b68e827ade9ee2cbff592abb833ac0
79f07fe10edf4d842913bd2121283f4bdc01044ef113f53e85d247f67f914f4e
7d3f595b53702d39fd426f8dc498b559dcf5c854774ea55ff2307a81b0ec2a26
7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8
7f771e8ef93cae707e7884535c864a92f2241eebd5bcd8e7e5ff69c4d9f2a4b3
7f81966a91cf11fd69984ae03875657b4ef3bb11f9bab23a0830710b71d5d37f
800fa2ade5da03a8b63e6b2a08d3e1cd9c0a823a666a28a24de721916390e53f
80d54533f80e8233621f965ae0a7713928bdb4d491ed0eb5e90434550f1894cb
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8580b92ddbd7aebefc8f98bacddbdc8189cca3a49708a9e4378a2ba1ea9d915a
85a45358aad2071d1964c65da9afd84c51828674480e6b27033a7bdae7ed89d6
86f51762f807d1e9ad87a085adc9c36b417bfac14df90d259ea0e997ee818770
8729d0b3fe29b9678177ae43fa9140de2666fb00058a1c84e202d1926d7a16e6
87bc265dda5e31597442c420def76eeadb5c516d016213a47f570c65d5558b72
89fa2ea2afae7159dced7d2806ff0a7c5bb7398ade6240dcd2a02e0b5eb47cec
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8b17fe85028b52bec0712ed753f12f9a75840cc64c76a8b122bc739ae4abf6b1
8c16c186d7b03c922a03744d16e8f83794c0aafe6a0f3483d679987a95e3c1cc
8cfad77917fa7711f25b846dbb579a95e57970d90261770863e8ce130c5eb17b
8d132c2ec29a828cc58c2060046cfcfc4c4312ebb2570973221ad8a4fadf7490
8dad3047e712df9676f35b1101bb1a42a951d5468a190f581aae72f61d46216d
8ff36c89ffa31f7ad0f07297a945d6cbdcfb7ad713a164cb068c6fd40eef95a7
9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b
96d3bf038966f99afc2c91b78a83c887caf0456db1e58ed2c7be2504dde9e810
97d64971e73a0444a29cc478c7d89bc9d614c0bca95ee3d066fdfd1a539b69fc
9a3f1e89ac7e63ff0a22523be45f8375d5cd7033156396106665f85a6a7cb20c
9db741d0cacec2a70cb9b1df4b7e5f5d7bb6997ac51bf7a47eaf516e6d0cc45a
9dfeee3e87ed97082d664c6bc11c7cb2b42885c1b905adb90f327aa56b4aa4a7
9e69406d7c3cccbc1f8f9e30c5df0ef77b56370df0e3507d698796da6bc19c78
a0f90576ff3ebff7c2265be9437f3b5f730b108ebd6b0dc6af35e2c1bb0aced9
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a37420641266de82fdaca370cedb70d4681e439f5c0e62ba43daf23e36ebabc3
a75f8c822d3d0e6d621ce24a5e059d2f18be39eab454591889cffcc65da5fe87
a7694405d22e2ce17d95152b5eca83fc18f2c119984d85438bf7e5d213e90df5
a78f3c394abdb5185b2a1235457e0e9a50b97625ef7c01a276a0aef6c5dd87fb
a882ed0de2cbc72018357222851d2cdfb8e55ab2e71164d5fef176f67fb51e44
a9b5bcb47ad59808d2028d544476ba365f8ed4d6fffdce2fcd0a3afd58bcaf34
aa3a5670b0b5ce2799bc93fb728027cdbb8fff7abd8b848bcd9ccd9d8d030e31
ab99a5eaea7da28aacbf11cfc30c31756e34170767ae4abee4d5c50a296f18c5
abfae2bdd085e7a30062f6b96e16dd90c55ba817eecdc5a921b50b04e1b0a535
ac4f9618be0b43e3a85ccb1b5ae9b9c5efbe4d1ac30bcd5db7b624a767024481
ae109e9f328268aa1639db3ac45ceef8fa41921dcf313bb17b3b86ae75ee9cbd
ae5f50b2f37e6d987eeeab05cc75c24906e6c4ccd7bb9f1ad842d635d3dfaee7
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1c9c19ebc4698c418de6590bbbc794483312b24630b5c7c73fe03156518f359
b2af0307bd7dc07e1f8f44bbcb4203df50d4565434025066f8fa2f1e236a4728
b2d4f345ea445291da59ae9025de142ceaaecc64c21fdd203cb4078349db2471
b340026b1782dbaa451f7d0b25fcc8c7ed10075c88dde36af54f870e6ae03028
b3654bd93a8e909f18d7f0a13561758b83f4539ac38f2145cd699887a95467b2
b439a395e8449d0f327a74d6f67d903899874fb579f12ed42954935abde9d819
b5c9194053ff64cbd9797b72f1b5f7766a01489df826fa6ad382169dcc0045f5
b75e2790752679bacd58f0bd5600fe108fc13bcc567fd607f5ff0a922c5dcd75
ba166cb05072de6f5f37fef26f2a477924a429e54076a6be382929a3add66cc3
bce96ac7a2ef110da2515407d716cd3ac640f5de8ce3ede325aef0ceac5dbadb
bd9bb31494cf9e5778ec9844fa065b51e782c8e5b3b156f8e314e1154fe59199
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
c09f777fd80a646341d2ece59fb93df47b583c3649631e159f9e96c41aab2d00
c11f9bc2f99850a7f24363f80193d1669a9008989e2b81151daa707aa53e78ee
c1a5beacf0910d974ee3033e8303aef0403890b511cb5f0cb880c418285351f4
c6b0d5270d518be3e51ce481af9aa04b812d825ae0a400333a0b4c181390e75d
c93338a0c4a2d71229f64639dceda2bc38420d6cb4d4c507a7b896affd108f16
cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cf49b6cf5a6c8c4ccdbae937fce5bb9ebb655347b31776c4550ba7740faa2ae5
cf660310e240e7704bced856c6e0fd7ac17d46ae733cd7707a6abdbba33dfe8f
cfd1fee1357b64ce24bbe60515db7f5d4419d451300eacd7adedd5abb14d50eb
d03b4f540581b41d08f42de448145d949323fc70ccaa7948e4a9e16608052cd6
d050d8de22dbdfe67594caa8dc7dfcd69ea8fe36d8c62a337f19ecaecd9f3c2a
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d0fd74148f4cbe78bd0e6328dc5ce5955f0a0ecdb1eb2919da4a7e596ac65912
d571c476e3f5b5d9bfab9552be5fe8337f219e06194d8019aa2d5d2ae422af35
d5781eec877972949ec6b00e57e5da597e6cdb39e227584cadf0ffe349585356
d88176309c2a031f83e5e967e042c1fda46ec8e3b8415d85ba44dcecd68505d6
d9c20466cd436eb3f7b81dd84defbb40f831f187ae8bf604ce5e66bb9bf9cc29
da1791b1b8361af6383790c6e77ef6eb149b22ed7e2d59b61ac2deb7884edf4d
dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff
dac04bcfa7f177ab3bfda32f23244821815941a32bdbca8e04604967c76ef1f2
dc464adf246186393741b0f44a1d13705f830814b4d3428b5578a40db15c6352
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
deee21acc86b40fe0cb13584d9b68a15a21f471fcd0523822aa1f5b58b603604
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a
e51a8aa65ffb34c6ef80ab29f19ccf75e70088d76db57ed04124e777e1b33868
e526d264e12ef01dd5e2f286373430ee9f9399ed4a7a99ee9d1606fd672bb9d3
e5b3ecb9fe86f37f7f3c5a95b350d24e5504bd426f53ac7a64287c39f53f9c3a
eb25e2373947c4e5fa5f594e711fea0c9e601dd0f16eeb7df9511875df6a4c31
ebc89aefb3d617c497756eac9dfebaf0311d3a4767be126d1c9f9c8be19fad66
ed0b9e327e842ad65d014d3543eb95ff28a5c0b6833c6536dc71eed264238707
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0e45c803d6191aed0f5c110e06994de455b59fc49b47fcf503a5fc37789f3e6
f153297b055e329ec72a2633f1c5c01009e73cf2c197e4c078c539b11a0c367b
f15329eb993dc1905ea4deb82e1802237f14ecf8bf56d8b8b2dd08525b86814e
f2253a35b3e82ef10635d6124df03f988146eed49c7f0266911d6b61d9d95d85
f28084bcab05ed8bd7946dd4c791abf08b7fbc34ecf289cd8f01349763e80019
f293ac1569326623ef7bca32e8bd83b11ccf473a4f9f128d6a7eae2c4632f2c2
f37c079aea7313c99b8729dc30d2843999d2705c10cd9e10eaeee85a910bafb4
f5cb58f78fed527b0592a1d1afe7cf322a3dfeff79a3d009e607056175f7b4dd
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9
f8cbde9598cb80b5fa29512ed9b1247c410cfb378d99195ad28ac089bffc61ca
f9905feecaa5edb2374765f678339d7f1dd5b38220756f2797f4f9fe6b3fa0f0
fa2569ee4980a341ef321fc5493e71b201ebcf80ba0bacb61cb4a455ae04dd99
fb342f0e0aed2577171981df7c1b90297ca156a0884373c291cddb269172038c
fb80487775677e61280ccbce05f36a3d6ce72cb2df59c58d07c365472d3793d1
fe2f1dc40370624a89e41b7bfccbc86f35045eb658322c1009f94ea71409f353
fe383d8e359f77ce8208b106e16c72148ce5694a0116003d70769562f0b63a15
fecab180f1b65fe9a7426a2ce8c95c83198d0faf2c5c26e2394c150c677476b3
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097
ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5