URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Submission: On October 16 via api from US

Summary

This website contacted 72 IPs in 8 countries across 60 domains to perform 408 HTTP transactions. The main IP is 2.18.233.143, located in Ascension Island and belongs to AKAMAI-AS - Akamai Technologies, Inc., US. The main domain is www.zdnet.com.
TLS certificate: Issued by GeoTrust RSA CA 2018 on April 23rd 2019. Valid for: a year.
This is the only time www.zdnet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
11 2.18.233.143 16625 (AKAMAI-AS)
63 2a04:4e42:3::444 54113 (FASTLY)
15 2a04:4e42:1b:... 54113 (FASTLY)
1 23.45.108.200 20940 (AKAMAI-ASN1)
1 35.190.38.167 15169 (GOOGLE)
3 2.18.234.21 16625 (AKAMAI-AS)
7 23.32.243.235 20940 (AKAMAI-ASN1)
19 172.217.16.162 15169 (GOOGLE)
1 52.85.183.205 16509 (AMAZON-02)
2 35.168.89.158 14618 (AMAZON-AES)
1 3 172.217.16.198 15169 (GOOGLE)
1 52.48.102.50 16509 (AMAZON-02)
14 152.199.23.241 15133 (EDGECAST)
8 2a00:1450:400... 15169 (GOOGLE)
1 2a01:4a0:1338... 201011 (NETZBETRI...)
6 2606:4700::68... 13335 (CLOUDFLAR...)
8 2606:4700::68... 13335 (CLOUDFLAR...)
2 6 34.248.158.173 16509 (AMAZON-02)
3 184.31.90.90 20940 (AKAMAI-ASN1)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
4 64.30.230.22 6623 (CBSI-1)
1 52.44.237.33 14618 (AMAZON-AES)
1 1 23.67.136.71 20940 (AKAMAI-ASN1)
2 2 35.190.72.21 15169 (GOOGLE)
2 52.31.106.135 16509 (AMAZON-02)
2 2 2.18.233.201 16625 (AKAMAI-AS)
2 2 54.76.84.205 16509 (AMAZON-02)
2 3 18.195.251.148 16509 (AMAZON-02)
1 5 34.241.149.220 16509 (AMAZON-02)
7 151.101.114.133 54113 (FASTLY)
1 2600:9000:215... 16509 (AMAZON-02)
6 54.86.231.246 14618 (AMAZON-AES)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
4 34.246.252.247 16509 (AMAZON-02)
2 52.30.105.51 16509 (AMAZON-02)
5 15.188.31.119 16509 (AMAZON-02)
5 37.252.173.62 29990 (ASN-APPNEXUS)
1 4 66.117.28.68 15224 (OMNITURE)
1 7 2.19.43.224 20940 (AKAMAI-ASN1)
1 104.17.209.240 13335 (CLOUDFLAR...)
1 4 52.17.222.87 16509 (AMAZON-02)
2 2a03:2880:f02... 32934 (FACEBOOK)
1 2600:9000:21f... 16509 (AMAZON-02)
2 2 66.117.28.86 15224 (OMNITURE)
1 1 172.217.22.2 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 35.227.208.151 15169 (GOOGLE)
1 23.99.128.52 8075 (MICROSOFT...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 1 172.217.22.98 15169 (GOOGLE)
1 10 2a00:1450:400... 15169 (GOOGLE)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1288:110... 34010 (YAHOO-IRD)
2 151.101.112.134 54113 (FASTLY)
1 52.28.51.75 16509 (AMAZON-02)
2 2a03:2880:f12... 32934 (FACEBOOK)
8 2a00:1450:400... 15169 (GOOGLE)
5 2600:9000:20e... 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
15 2a00:1450:400... 15169 (GOOGLE)
52 2.18.235.40 16625 (AKAMAI-AS)
6 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2.19.38.84 20940 (AKAMAI-ASN1)
2 69.173.144.142 26667 (RUBICONPR...)
3 2a00:1450:400... 15169 (GOOGLE)
4 3.10.83.173 16509 (AMAZON-02)
2 34.199.164.63 14618 (AMAZON-AES)
1 2404:6800:400... 15169 (GOOGLE)
2 69.173.144.154 26667 (RUBICONPR...)
10 2.16.186.72 20940 (AKAMAI-ASN1)
2 104.109.78.125 20940 (AKAMAI-ASN1)
4 18.213.196.95 14618 (AMAZON-AES)
24 151.101.14.2 54113 (FASTLY)
4 151.101.113.181 54113 (FASTLY)
2 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
408 72
Apex Domain
Subdomains
Transfer
78 cbsistatic.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
zdnet4.cbsistatic.com
zdnet1.cbsistatic.com
1 MB
40 moatads.com
z.moatads.com
geo.moatads.com
px.moatads.com
1 MB
27 doubleclick.net
securepubads.g.doubleclick.net
ad.doubleclick.net
cm.g.doubleclick.net
googleads.g.doubleclick.net
219 KB
24 taboola.com
cdn.taboola.com
trc.taboola.com
images.taboola.com
348 KB
16 moatpixel.com
cbsdfp5832910442.s.moatpixel.com
6 KB
15 googletagservices.com
www.googletagservices.com
418 KB
14 googlesyndication.com
tpc.googlesyndication.com
pagead2.googlesyndication.com
314 KB
14 tiqcdn.com
tags.tiqcdn.com
89 KB
11 zdnet.com
www.zdnet.com
urs.zdnet.com
204 KB
10 cbsi.com
dw.cbsi.com
saa.cbsi.com
rev.cbsi.com
13 KB
10 viglink.com
cdn.viglink.com
api.viglink.com
112 KB
9 akamaized.net
techrepublicmedia.akamaized.net
7 MB
9 imrworldwide.com
secure-us.imrworldwide.com
cdn-gl.imrworldwide.com
61 KB
9 ml314.com
ml314.com
in.ml314.com
16 KB
9 lightboxcdn.com
www.lightboxcdn.com
api1.lightboxcdn.com
159 KB
8 rubiconproject.com
ads.rubiconproject.com
optimized-by.rubiconproject.com
beacon-eu2.rubiconproject.com
eus.rubiconproject.com
19 KB
7 scorecardresearch.com
sb.scorecardresearch.com
4 KB
7 cbsinteractive.com
vidtech.cbsinteractive.com
445 KB
7 demdex.net
dpm.demdex.net
cbsi.demdex.net
6 KB
6 ampproject.org
cdn.ampproject.org
136 KB
6 everesttech.net
pixel.everesttech.net
cm.everesttech.net
3 KB
6 chartbeat.net
ping.chartbeat.net
1008 B
6 google.com
adservice.google.com
www.google.com
890 B
5 adnxs.com
secure.adnxs.com
6 KB
5 google.de
adservice.google.de
www.google.de
794 B
4 perfectmarket.com
widget.perfectmarket.com
94 KB
4 omtrdc.net
cbsinteractive.hb.omtrdc.net
1 KB
4 gstatic.com
fonts.gstatic.com
csi.gstatic.com
35 KB
4 go-mpulse.net
c.go-mpulse.net
58 KB
3 googleapis.com
imasdk.googleapis.com
fonts.googleapis.com
1 KB
3 akstat.io
686eb71a.akstat.io
0211c83c.akstat.io
1 KB
3 eyeota.net
ps.eyeota.net
1 KB
3 tru.am
tru.am
beacon.tru.am
13 KB
3 everestjs.net
www.everestjs.net
8 KB
2 google-analytics.com
www.google-analytics.com
18 KB
2 litix.io
inqlnfvog763mmf771rou737u.litix.io
698 B
2 facebook.com
www.facebook.com
296 B
2 disqus.com
zdnet-1.disqus.com
2 KB
2 2mdn.net
s0.2mdn.net
102 KB
2 facebook.net
connect.facebook.net
89 KB
2 casalemedia.com
as-sec.casalemedia.com
1 KB
2 crwdcntrl.net
sync.crwdcntrl.net
1 KB
2 mathtag.com
pixel.mathtag.com
1 KB
2 rlcdn.com
idsync.rlcdn.com
728 B
2 akamaihd.net
iicbsi-a.akamaihd.net
cbsadsales-a.akamaihd.net
456 B
2 betrad.com
l.betrad.com
240 B
1 jsdelivr.net
cdn.jsdelivr.net
1 KB
1 summerhamster.com
www.summerhamster.com
181 B
1 yieldmanager.com
ad.yieldmanager.com
341 B
1 googleadservices.com
www.googleadservices.com
726 B
1 azurewebsites.net
lightboxapi2.azurewebsites.net
505 B
1 urbanairship.com
web-sdk.urbanairship.com
17 KB
1 trackonomics.net
cdn-magiclinks.trackonomics.net
18 KB
1 qualtrics.com
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
15 KB
1 chartbeat.com
static.chartbeat.com
23 KB
1 bluekai.com
tags.bluekai.com
856 B
1 adsrvr.org
match.adsrvr.org
535 B
1 sharethrough.com
native.sharethrough.com
121 KB
1 indexww.com
js-sec.indexww.com
26 KB
1 evidon.com
c.evidon.com
512 B
408 60
Domain Requested by
27 zdnet2.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
26 px.moatads.com
23 zdnet3.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
19 securepubads.g.doubleclick.net www.zdnet.com
securepubads.g.doubleclick.net
www.googletagservices.com
16 images.taboola.com vidtech.cbsinteractive.com
16 cbsdfp5832910442.s.moatpixel.com
15 www.googletagservices.com www.zdnet.com
securepubads.g.doubleclick.net
rev.cbsi.com
pagead2.googlesyndication.com
15 zdnet4.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
14 tags.tiqcdn.com zdnet2.cbsistatic.com
tags.tiqcdn.com
13 zdnet1.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
10 z.moatads.com securepubads.g.doubleclick.net
10 www.zdnet.com zdnet3.cbsistatic.com
vidtech.cbsinteractive.com
9 techrepublicmedia.akamaized.net vidtech.cbsinteractive.com
8 tpc.googlesyndication.com securepubads.g.doubleclick.net
www.zdnet.com
8 ml314.com 2 redirects tags.tiqcdn.com
ml314.com
www.zdnet.com
8 www.lightboxcdn.com www.zdnet.com
www.lightboxcdn.com
7 sb.scorecardresearch.com 1 redirects tags.tiqcdn.com
cdn.taboola.com
widget.perfectmarket.com
7 vidtech.cbsinteractive.com zdnet2.cbsistatic.com
vidtech.cbsinteractive.com
6 pagead2.googlesyndication.com optimized-by.rubiconproject.com
pagead2.googlesyndication.com
6 cdn.ampproject.org securepubads.g.doubleclick.net
6 ping.chartbeat.net www.zdnet.com
6 cdn.viglink.com tags.tiqcdn.com
www.zdnet.com
5 cdn-gl.imrworldwide.com vidtech.cbsinteractive.com
cdn-gl.imrworldwide.com
5 secure.adnxs.com js-sec.indexww.com
5 saa.cbsi.com tags.tiqcdn.com
5 dpm.demdex.net 1 redirects www.zdnet.com
tags.tiqcdn.com
vidtech.cbsinteractive.com
4 trc.taboola.com cdn.taboola.com
4 widget.perfectmarket.com cdn.taboola.com
widget.perfectmarket.com
4 cdn.taboola.com zdnet2.cbsistatic.com
cdn.taboola.com
4 cbsinteractive.hb.omtrdc.net vidtech.cbsinteractive.com
4 geo.moatads.com z.moatads.com
4 googleads.g.doubleclick.net 1 redirects pagead2.googlesyndication.com
4 secure-us.imrworldwide.com 1 redirects
4 pixel.everesttech.net 1 redirects
4 api.viglink.com cdn.viglink.com
4 dw.cbsi.com tags.tiqcdn.com
www.zdnet.com
4 adservice.google.com securepubads.g.doubleclick.net
www.googletagservices.com
pagead2.googlesyndication.com
4 adservice.google.de securepubads.g.doubleclick.net
www.googletagservices.com
pagead2.googlesyndication.com
4 c.go-mpulse.net www.zdnet.com
c.go-mpulse.net
zdnet1.cbsistatic.com
3 fonts.gstatic.com cdn.ampproject.org
www.lightboxcdn.com
3 ps.eyeota.net 2 redirects www.zdnet.com
3 www.everestjs.net tags.tiqcdn.com
www.everestjs.net
3 ad.doubleclick.net 1 redirects www.zdnet.com
2 www.google-analytics.com widget.perfectmarket.com
2 eus.rubiconproject.com www.zdnet.com
2 beacon-eu2.rubiconproject.com www.zdnet.com
2 inqlnfvog763mmf771rou737u.litix.io vidtech.cbsinteractive.com
2 optimized-by.rubiconproject.com ads.rubiconproject.com
2 ads.rubiconproject.com www.zdnet.com
2 fonts.googleapis.com securepubads.g.doubleclick.net
www.lightboxcdn.com
2 www.facebook.com connect.facebook.net
2 zdnet-1.disqus.com zdnet2.cbsistatic.com
zdnet-1.disqus.com
2 www.google.com 1 redirects www.zdnet.com
2 s0.2mdn.net zdnet2.cbsistatic.com
s0.2mdn.net
2 cm.everesttech.net 2 redirects
2 connect.facebook.net tags.tiqcdn.com
connect.facebook.net
2 as-sec.casalemedia.com js-sec.indexww.com
2 686eb71a.akstat.io zdnet1.cbsistatic.com
2 cbsi.demdex.net tags.tiqcdn.com
2 sync.crwdcntrl.net 2 redirects
2 pixel.mathtag.com 2 redirects
2 idsync.rlcdn.com 2 redirects
2 tru.am tags.tiqcdn.com
tru.am
2 l.betrad.com www.zdnet.com
1 cdn.jsdelivr.net www.lightboxcdn.com
1 cbsadsales-a.akamaihd.net
1 csi.gstatic.com s0.2mdn.net
1 rev.cbsi.com www.zdnet.com
1 imasdk.googleapis.com s0.2mdn.net
1 www.summerhamster.com
1 0211c83c.akstat.io c.go-mpulse.net
1 ad.yieldmanager.com
1 www.google.de
1 www.googleadservices.com 1 redirects
1 api1.lightboxcdn.com www.lightboxcdn.com
1 lightboxapi2.azurewebsites.net www.lightboxcdn.com
1 web-sdk.urbanairship.com zdnet3.cbsistatic.com
1 cm.g.doubleclick.net 1 redirects
1 cdn-magiclinks.trackonomics.net tags.tiqcdn.com
1 zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com tags.tiqcdn.com
1 beacon.tru.am tru.am
1 static.chartbeat.com zdnet2.cbsistatic.com
1 tags.bluekai.com 1 redirects
1 in.ml314.com ml314.com
1 iicbsi-a.akamaihd.net tags.tiqcdn.com
1 match.adsrvr.org js-sec.indexww.com
1 native.sharethrough.com www.zdnet.com
1 js-sec.indexww.com www.zdnet.com
1 urs.zdnet.com zdnet2.cbsistatic.com
1 c.evidon.com www.zdnet.com
408 90
Subject Issuer Validity Valid
www.cbs.com
GeoTrust RSA CA 2018
2019-04-23 -
2020-07-22
a year crt.sh
*.cbsistatic.com
DigiCert SHA2 High Assurance Server CA
2019-02-22 -
2021-02-26
2 years crt.sh
*.evidon.com
DigiCert ECC Secure Server CA
2019-02-01 -
2020-05-02
a year crt.sh
*.zdnet.com
DigiCert SHA2 High Assurance Server CA
2017-12-12 -
2020-12-15
3 years crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018
2019-07-17 -
2020-03-09
8 months crt.sh
akstat.io
DigiCert SHA2 Secure Server CA
2019-04-16 -
2020-06-14
a year crt.sh
*.g.doubleclick.net
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
*.sharethrough.com
Go Daddy Secure Certificate Authority - G2
2018-09-18 -
2019-11-17
a year crt.sh
l.betrad.com
Go Daddy Secure Certificate Authority - G2
2019-04-25 -
2021-06-24
2 years crt.sh
*.doubleclick.net
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
*.adsrvr.org
Trustwave Organization Validation SHA256 CA, Level 1
2019-03-07 -
2021-04-19
2 years crt.sh
*.tiqcdn.com
DigiCert SHA2 Secure Server CA
2017-10-25 -
2020-05-13
3 years crt.sh
*.google.com
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
a248.e.akamai.net
DigiCert Secure Site ECC CA-1
2019-08-13 -
2020-08-12
a year crt.sh
ssl418259.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-08-10 -
2020-02-16
6 months crt.sh
ssl516460.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-08-24 -
2020-03-01
6 months crt.sh
*.ml314.com
Amazon
2019-03-16 -
2020-04-16
a year crt.sh
www.everestjs.net
DigiCert SHA2 Secure Server CA
2018-10-15 -
2020-10-15
2 years crt.sh
ssl389962.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-09-11 -
2020-03-19
6 months crt.sh
*.cbsi.com
DigiCert SHA2 High Assurance Server CA
2017-11-07 -
2021-02-04
3 years crt.sh
*.eyeota.net
Let's Encrypt Authority X3
2019-09-19 -
2019-12-18
3 months crt.sh
*.demdex.net
DigiCert SHA2 High Assurance Server CA
2018-01-09 -
2021-02-12
3 years crt.sh
vidtech.cbsinteractive.com
DigiCert SHA2 High Assurance Server CA
2018-12-13 -
2020-12-17
2 years crt.sh
*.chartbeat.com
Gandi Standard SSL CA 2
2019-04-10 -
2020-04-10
a year crt.sh
*.chartbeat.net
Thawte RSA CA 2018
2018-12-20 -
2020-01-01
a year crt.sh
viglink.com
Amazon
2019-02-09 -
2020-03-09
a year crt.sh
saa.cbsi.com
DigiCert SHA2 High Assurance Server CA
2019-06-23 -
2020-09-25
a year crt.sh
*.adnxs.com
DigiCert ECC Secure Server CA
2019-01-23 -
2021-03-08
2 years crt.sh
*.scorecardresearch.com
COMODO RSA Organization Validation Secure Server CA
2018-11-28 -
2019-12-26
a year crt.sh
*.qualtrics.com
DigiCert SHA2 Secure Server CA
2018-10-08 -
2021-01-06
2 years crt.sh
*.imrworldwide.com
DigiCert SHA2 Secure Server CA
2019-02-25 -
2020-02-25
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2019-09-22 -
2019-12-20
3 months crt.sh
*.trackonomics.net
Go Daddy Secure Certificate Authority - G2
2018-12-22 -
2020-02-20
a year crt.sh
*.everesttech.net
DigiCert SHA2 Secure Server CA
2017-04-13 -
2020-04-17
3 years crt.sh
*.urbanairship.com
DigiCert ECC Secure Server CA
2018-06-20 -
2020-06-24
2 years crt.sh
*.azurewebsites.net
Microsoft IT TLS CA 5
2019-09-24 -
2021-09-24
2 years crt.sh
www.google.de
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
*.ads.yahoo.com
DigiCert SHA2 High Assurance Server CA
2019-06-27 -
2019-12-24
6 months crt.sh
*.disqus.com
DigiCert SHA2 Secure Server CA
2018-03-28 -
2020-04-27
2 years crt.sh
*.summerhamster.com
Let's Encrypt Authority X3
2019-09-30 -
2019-12-29
3 months crt.sh
tpc.googlesyndication.com
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
*.googleapis.com
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
moatads.com
DigiCert ECC Secure Server CA
2018-11-10 -
2020-02-09
a year crt.sh
misc-sni.google.com
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
*.rubiconproject.com
DigiCert SHA2 Secure Server CA
2019-02-13 -
2021-02-17
2 years crt.sh
www.google.com
GTS CA 1O1
2019-10-03 -
2019-12-26
3 months crt.sh
*.moatads.com
DigiCert SHA2 Secure Server CA
2019-03-12 -
2021-06-10
2 years crt.sh
*.litix.io
Amazon
2019-01-22 -
2020-02-22
a year crt.sh
*.hb.omtrdc.net
DigiCert SHA2 Secure Server CA
2017-12-22 -
2020-01-03
2 years crt.sh
f2.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-07-30 -
2020-07-25
a year crt.sh
p.ssl.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-09-03 -
2021-02-22
a year crt.sh
*.google-analytics.com
GTS CA 1O1
2019-09-17 -
2019-12-10
3 months crt.sh
ssl363648.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-09-14 -
2020-03-22
6 months crt.sh

This page contains 28 frames:

Primary Page: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Frame ID: 898682E5C42FF0C939B9672F69FA8E00
Requests: 319 HTTP requests in this frame

Frame: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Frame ID: AD4610326ADE4AA172A3BA7241654D6C
Requests: 2 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1571187400035&lv=1
Frame ID: AE7E8D939EC4FF0DA82FC63835C8C135
Requests: 2 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637048605067352348
Frame ID: 6499E714E954E4F5CA884CD96C90FE51
Requests: 1 HTTP requests in this frame

Frame: https://cbsi.demdex.net/dest5.html?d_nsid=undefined
Frame ID: 7235DCBB485CD5059153F1293EE742A3
Requests: 1 HTTP requests in this frame

Frame: https://www.everestjs.net/static/pixel_details.html
Frame ID: 7B88639C3546EB46535BF8A4C3DC8561
Requests: 1 HTTP requests in this frame

Frame: https://cbsi.demdex.net/dest5.html?d_nsid=0
Frame ID: FFA4B1FFFC7F4A7B36A623CCF63C2AF4
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.342.1_en.html
Frame ID: 9F11C715C1BBCE63D06F250EA7956778
Requests: 1 HTTP requests in this frame

Frame: https://cdn-gl.imrworldwide.com/novms/html/ls.html
Frame ID: CD3700DFCB8244034AAD087F5B556CD7
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstNa9nu0W34ou_M0dRilwv1U_SHg6NAj3EMs_2eExWvostdUedYksA-P-nCA5vwy5Xe8Bbfnv4R5uEEUrMlRaq3Se90Rl2BDfOWOFc7vvGxlPblUTind52BHl7aliZBLkQQfUrYX_NM5B9z-TUrLYNCdGFTnHU9cAOe2wEAsHsYzVmil42E902fULZVGx8i1VgouQf1yII266N10qv_LzPQvzvSjdLUHGaZf9pKEn9ST5u75rnPho2vovIv-GpxVncbY1FpApNC&sig=Cg0ArKJSzN4wzNu1EaDEEAE&urlfix=1&adurl=
Frame ID: F652AF2F99E89C6B2B3C6A23CE78770C
Requests: 4 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss-YXj4p1cUFmlFif-n_PYlLGjF5hKkV7wgIYBP6yFdr9B-CNM1EubPSR9db4WpasGMqIw5O50aqXFeeFnih0IuD2UXSx-m6jSLN1lggvdPV6voFGlQH9bK6GOVUUMaKuaN1t1rKWdGXeRKPnd1ie5i8vzeHKlnKyPyWTHsVOAqXZNEODkJw8mJmBel2wxnCsVMzLPN2SpCNVMsfZLkfwX3T3616E_niap0wf2ra229Qz-rYeDrcrmcVoZqaLRlkDMMUPpkvYGXjN4blw&sig=Cg0ArKJSzNftCcK0T8y2EAE&urlfix=1&adurl=
Frame ID: 54177FD7B62DBFFEAC414B6A0D31559F
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvuERxLZPyfwANm-LYRnsejMusPkm9uQGUutzpzmQUV4lqFFTb_2a-1BE3qhI5OEhLkW6cmcPG5YIF4iZ0d9Y7bY5y7ZGCBKdS7L4epz4yCbO8SINLEaqBlG0hFzrwMQKG0JRLQRPDLJQC-ecx0qVMlAWkqAV9fpjNfkds1gqpVueSFAgUsnE1IeOToqpI3Q2VDKf-G5O1CYXC5NKlLg0fzA9VE-jQQ0M_ZeRusuMXy0tXQtO8HZawRmVUIOaJYjfZuHkUFYM7rlZ5h6w&sig=Cg0ArKJSzCpyJxqpskjNEAE&urlfix=1&adurl=
Frame ID: BFC525CD07D316FAE0FC5AA7FB20B1DE
Requests: 7 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/011909241711100/amp4ads-v0.js
Frame ID: CE6252281C3C2C3BF54CC926259A96EF
Requests: 17 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsunmqZCZ4NMQOSWS4nJNJUDttqZ7slnEsVG_GD-FmgqyKX7e3AgaVY3GWjQmqJ5J_OlMSvWDDmArxSjIaJ2-mcsU-TW3ibsrac17nQp_npSQ9AEWCCSVCTuncL3rpzlxnN9bHEwDWfJSazozpCoc8Q13I2D8PW8uGfUiMg1wQjwXXBR0he2Ndq8v5Hx9-iYQM-zJt7AAMNU5Oi0Gh5uPcgSUsgPRDUUBsnSq57Kow734ng8t4oXAXqnsnbVJ7etSbwg-A4&sig=Cg0ArKJSzC0GgIPa-JxNEAE&urlfix=1&adurl=
Frame ID: 049FE05A364034EDD1EABD316F6DFD26
Requests: 12 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss88tzWhJlamnNhA6YJoMM5hqquoSEce3f570lDfOyCDjUxbF7CtjV1sqMTqJba0seviyKS8SBLNQY00v8CNwvHrp7EMdkMFO0Kbfd5n9I0ZGi-uJsd5t1mkB4rKojQs_boyCOYBxf-7v9g9Bi74JXUp8QGCrqwpTG4jPuxwQKDlX1vpdNa2V7a0W0Mv--fRfbHMfki4ERPQL8OzvQNkOcoPyy2yvsbasLgIR-_i1WUKq4jZr_TisgqH7L1btDXZMUPsl8&sig=Cg0ArKJSzD69mHIRw4fcEAE&urlfix=1&adurl=
Frame ID: 01DEAE82897925208C771BB334C3C6EA
Requests: 12 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv-MqnTA5awAxFhdooRnHtrdc1F3xUEW49h8d4nNld03wfaMqSvBkJJ0LtQfkfI9p8dVUq4zk2rIX5-28WWWOXNlv1Bspd9wiJuskGDkp15YGS8FWBanS4tNNYpdJw4AZLv1IuO_8c7DoVH1-V0Ysu21of0X0VWe9Fxxa9IrZ9oDHuGQg4lX5_M4ox8rc9lZCBg-vFajKE7NGAbpG2xqZfnmIdTJTeZHiJhEAdBZW0xqTgUPhbwdIiorzmNSuv326z12JUdxd9K&sig=Cg0ArKJSzGEWg90E8ApqEAE&urlfix=1&adurl=
Frame ID: 90E3966D549A8EB3D4A22D16FC880B93
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20191014/r20190131/zrt_lookup.html
Frame ID: 2F24D662B4423968EF1BEAC7BB20496D
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: 646AFA0379EDA47DA55F0FF9A88F3FD2
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: A9906947D32E2DE360545ABC6EA5E59E
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=2269224027&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1571187402363&bpp=11&bdt=423&fdt=143&idt=144&shv=r20191014&cbv=r20190131&saldr=sa&correlator=7885876762299&frm=23&ife=5&pv=2&ga_vid=1866455748.1571187403&ga_sid=1571187403&ga_hid=314382046&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=19&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=2458&biw=1585&bih=1200&isw=300&ish=250&ifk=1270051788&scr_x=0&scr_y=0&eid=20199338&oid=3&pvsid=1162078900323653&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.u9vmbhapfuqu&fsb=1&dtd=154
Frame ID: EC4876D153550580AB5B735C8BBF0965
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=2269224026&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1571187402377&bpp=11&bdt=430&fdt=151&idt=151&shv=r20191014&cbv=r20190131&saldr=sa&correlator=7885876762299&frm=23&ife=5&pv=1&ga_vid=30935616.1571187403&ga_sid=1571187403&ga_hid=546824717&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=19&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3997&biw=1585&bih=1200&isw=728&ish=90&ifk=2119417797&scr_x=0&scr_y=0&eid=20040009&oid=3&pvsid=1271412903126817&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.n6l1v2s2z3qk&fsb=1&dtd=161
Frame ID: FCA48416456104B0B8CE0ED9103A54AB
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssF9vw8XyZVoqUWFJvTVwob3S7yCexq026U5AZAk3Y1AdCodjFNIhN4PhvuPtzgJNabarCXItQJ26jkS2Rbo6T-E43wbzhLE7ZYqRxQM-SO5uhi49-9Oy0YtSfAYnqNsD1_1pMI1WLBGPk82GH6isUU20JzFnzEKSWi0I7o2qkK3oRj-CzEdXfk-LLIvjodeREI8g2WZIqukrbdUyov9MXpm8nxx2g0_tXHajLHlTi-g7kX8uqNCYFwnDJ3xmiEE9W-Fh1IK11o&sig=Cg0ArKJSzIEsEHhuSoaZEAE&urlfix=1&adurl=
Frame ID: C3575D029525AA459BDA5123E06C9FB2
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstVU2e7_9aMveijeZLaTMeqmEoO0X72MhnyPfz5H1jLmUmb9WKQfL2wmO8zBmzvHfP_QU5-PkzdL78kI7jsuAfY-QEftPgLD8vsGWrRDk__s7m13ZFRitXFW73t6Y662FlI1de7U6TuubQMAdiFh1r8XZsWBmHPppP3Xcu0QA0c95WeCmkf6VoE_FSEbQomDrgbZHbicjwvJ35ILoDuFS7ubK_aehgn0TNj6cPwafDiNEahUIxK_Z--GQEEac9yTGoMCEGW4IrT&sig=Cg0ArKJSzHwYFuJk0xEREAE&urlfix=1&adurl=
Frame ID: 2B6729E7EC19378714B8708511032A39
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuCoMZwAVTWy_y4Qm8_0uhAYZoulPpaI1w2U_aj0mTG0dmeqRi7SveUE7rjm0K4UgvOT2sFXGuuji3D0_aCd-hMFmQZ7f3sAuoY5cfdsZwXhg1RpoDigDbluO552Sh2CwYT3uc3yA0pDMD8uZajplpqc_1DJZQ-Ub_lBsd_mxZ2-q7PLlA3d5IKnhKPtoAdnphIZtBbdH3ohPqKv-oyWvCWuzwS9nEoOpAeXC7oAouAAlDGX5d4w9G6lUkeS-ZA_ywpnabJJIrn&sig=Cg0ArKJSzO_EkGQUxBiZEAE&urlfix=1&adurl=
Frame ID: AB1A19FE4762617497C04C4C51E3D79B
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvsoInLwKk_zqPva0h_SFXD2NkncT80MtAZxEh_YqtiM6DefLYYV901fN-aricNK_icrQsMfC9E0Otusy-DvWeCWTQU0I6Z3ipv57EpbX7Q1tZE2xRPs-K4YH7vcUUWZatfabZMuQ-nR7X8HjqGITPrew1HHFAWPnkK7bISDB6eQWELNOqaaQIL3ILZKDoFiGcqOZIEPFvxAC6NpmEfUek2d9mEcX0RV24d0A5ijgEHrUieinDwpHSNSu_hxt7BnFgUTNqLF3hd&sig=Cg0ArKJSzFbzm4HXv7kOEAE&urlfix=1&adurl=
Frame ID: F6C47EE9BD4DFD83024EE7CEB31040FF
Requests: 3 HTTP requests in this frame

Frame: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
Frame ID: 364B241D8EFDFDDEC18915E8545B0003
Requests: 1 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=637048605067352348
Frame ID: F4B9DEC1EE9272646598160D6BBF41DB
Requests: 3 HTTP requests in this frame

Frame: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
Frame ID: A40C26C7921E816B756710042BCA8DC7
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • script /2mdn\.net/i

Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Overall confidence: 100%
Detected patterns
  • script /2mdn\.net/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i


Overall confidence: 100%
Detected patterns
  • html /<iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
  • script /\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i

Page Statistics

408
Requests

99 %
HTTPS

36 %
IPv6

60
Domains

90
Subdomains

72
IPs

8
Countries

12940 kB
Transfer

24213 kB
Size

32
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 74
  • https://tags.bluekai.com/site/20486?limit=0&id=3605362246684770317&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=3605362246684770317%26eid=50056 HTTP 302
  • https://ml314.com/csync.ashx?fp=uM9z199999emm3j5&person_id=3605362246684770317&eid=50056
Request Chain 75
  • https://idsync.rlcdn.com/395886.gif?partner_uid=3605362246684770317 HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzYwNTM2MjI0NjY4NDc3MDMxNxAAGg0IyNWZ7QUSBQjoBxAAQgBKAA HTTP 307
  • https://ml314.com/csync.ashx?fp=42c3d6fd79b1293d1f4747018b988f72cb03ffa0554af2a5a207568c01f2cff9f4cb09cee1a4f8eb&person_id=3605362246684770317&eid=50082
Request Chain 76
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3605362246684770317%26eid=50220 HTTP 302
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3605362246684770317%26eid=50220&mm_bnc&mm_bct&UUID=16875da6-5e2a-4100-867c-4097849d44e3 HTTP 302
  • https://ml314.com/csync.ashx?fp=16875da6-5e2a-4100-867c-4097849d44e3&person_id=3605362246684770317&eid=50220
Request Chain 77
  • https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3605362246684770317 HTTP 302
  • https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3605362246684770317 HTTP 302
  • https://ml314.com/csync.ashx?fp=a5f17776bdd1f419a1805a99a0bb3e38&eid=50146&person_id=3605362246684770317
Request Chain 78
  • https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
  • https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
  • https://ml314.com/utsync.ashx?eid=50052&et=0&fp=22a1eC8KIZ76wp4z61rl13XhVnilr_MsducE6H32Mtn8&gdpr=1&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil HTTP 302
  • https://ml314.com/csync.ashx?fp=22a1eC8KIZ76wp4z61rl13XhVnilr_MsducE6H32Mtn8&person_id=3605362246684770317&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil HTTP 302
  • https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Request Chain 79
  • https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3605362246684770317&redir= HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3605362246684770317&redir=
Request Chain 113
  • https://pixel.everesttech.net/4083/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__EFOPTOUT__%26throttleCookie%3D__EFSYNC__%26time%3D__EFTIME__ HTTP 302
  • https://www.everestjs.net/static/pixel_details.html
Request Chain 134
  • https://sb.scorecardresearch.com/b?c1=2&c2=3005086&ns__t=1571187401233&ns_c=UTF-8&c8=Hacker%20backdoors%20popular%20JavaScript%20library%20to%20steal%20Bitcoin%20funds%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1571187401233&ns_c=UTF-8&c8=Hacker%20backdoors%20popular%20JavaScript%20library%20to%20steal%20Bitcoin%20funds%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&c9=
Request Chain 136
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/&rp=&ts=compact&rnd=1571187401234 HTTP 302
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/&rp=&ts=compact&rnd=1571187401234&ja=1
Request Chain 141
  • https://cm.everesttech.net/cm HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WGFacXlRQUFCU0ljMUFvSA HTTP 302
  • https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEL5jZHKCyv32x1aoYUhpRI8&google_cver=1 HTTP 302
  • https://pixel.everesttech.net/1x1
Request Chain 154
  • https://www.googleadservices.com/pagead/conversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&amp;guid=ON&amp;script=0 HTTP 302
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&amp;guid=ON&amp;script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=yWqmXYSdE4zC7gPAzY4I&random=413568637&sscte=1&crd=&gtd= HTTP 302
  • https://www.google.com/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=413568637&crd=&is_vtc=1&random=3396060450 HTTP 302
  • https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=413568637&crd=&is_vtc=1&random=3396060450&ipr=y
Request Chain 223
  • https://ad.doubleclick.net/ddm/trackimp/N718679.3159GOOGLE/B22124189.255033243;dc_trk_aid=450834198;dc_trk_cid=121088454;ord=2093272708;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua= HTTP 302
  • https://ad.doubleclick.net/ddm/trackimp/N718679.3159GOOGLE/B22124189.255033243;dc_pre=CLDA5ZfJn-UCFQ72dwod0vwBlA;dc_trk_aid=450834198;dc_trk_cid=121088454;ord=2093272708;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=

408 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
483 KB
108 KB
Document
General
Full URL
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
df566fecc893979ef7929b2152c69d75f604ad0df88d8b405ee2530e5f1d28d7
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.zdnet.com
:scheme
https
:path
/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
navigate
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

status
200
server
nginx
content-type
text/html; charset=UTF-8
set-cookie
fly_device=desktop; expires=Wed, 23-Oct-2019 00:56:38 GMT; path=/; domain=.zdnet.com; secure nemo_highlander-sharebar=sharebar%3a1%3aexclude; expires=Thu, 17 Oct 2019 06:59:59 GMT; path=/; domain=.zdnet.com; secure; fly_default_edition=eu; path=/; domain=.zdnet.com; secure fly_preferred_edition=eu; path=/; domain=.zdnet.com; secure fly_geo={"countryCode": "de"}; expires=Wed, 23-Oct-2019 00:56:38 GMT; path=/; domain=.zdnet.com; secure
x-enable-esi
true
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Accept-Encoding, User-Agent
access-control-allow-origin
https://www.zdnet.com
x-frame-options
SAMEORIGIN
content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
expires
Wed, 16 Oct 2019 02:26:38 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
referrer-policy
no-referrer-when-downgrade
x-content-type-options
nosniff
x-xss-protection
1; mode=block
x-tx-id
9e807ebc-bcb2-4e6b-b5b3-f0f013eb4427
content-encoding
gzip
date
Wed, 16 Oct 2019 00:56:39 GMT
main-3c565ba1f5-rev.css
zdnet2.cbsistatic.com/fly/1822-fly/css/core/
357 KB
64 KB
Stylesheet
General
Full URL
https://zdnet2.cbsistatic.com/fly/1822-fly/css/core/main-3c565ba1f5-rev.css
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
1ebc699ac3a4ade2e58d4c6fcd30cc56ae3927545275a36a5b03ab083e85ca6d
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
109176
status
200
vary
Accept-Encoding
content-length
65662
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:32:20 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da4bf34-59363"
strict-transport-security
max-age=31536000
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 21 Oct 2019 18:37:02 GMT
controls-ca7d9bab8e-rev.css
zdnet3.cbsistatic.com/fly/css/video/htmlPlayerControls/
41 KB
7 KB
Stylesheet
General
Full URL
https://zdnet3.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-ca7d9bab8e-rev.css
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
6b9b8448b9eabd3d7bc3578fa05235633f7105b19b16789262b910bb99c1adba
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
109176
status
200
vary
Accept-Encoding
content-length
6562
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:32:34 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da4bf42-a53d"
strict-transport-security
max-age=31536000
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 21 Oct 2019 18:37:02 GMT
catalin-cimpanu.jpg
zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/
910 B
1 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/catalin-cimpanu.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
ba2fa15976662b87f31dccdd53d415b927f2118760fdafc4ac21dd2c1b234ff3
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
x-content-type-options
nosniff
nncoection
close
age
1782072
status
200
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
910
x-xss-protection
1; mode=block
last-modified
Mon, 03 Sep 2018 02:32:23 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 24 Sep 2020 09:53:51 GMT
5be467c160b265527db468fa-1280x7201nov122018150906poster.jpg
zdnet2.cbsistatic.com/hub/i/r/2018/11/12/e8696bdd-64ed-4890-a079-e9f130ff979f/thumbnail/570x322/5afceb61d4f498373129991bfe5e34b4/
48 KB
48 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2018/11/12/e8696bdd-64ed-4890-a079-e9f130ff979f/thumbnail/570x322/5afceb61d4f498373129991bfe5e34b4/5be467c160b265527db468fa-1280x7201nov122018150906poster.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
61927323a0e9653fc2a967e3ae4d1869deb6ae82802f40b59393a8464afe6a45
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
16545
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
49295
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"b83a52c035258ed43d787106b1765e35"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
advertisement.js
zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/utils/
53 B
194 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/utils/advertisement.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
07b69027231d985f5bdcd4d5a539f120d26003feef6e9dc0a6b77a4b43a9b21f
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
380687
status
200
vary
Accept-Encoding
content-length
71
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:27:39 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d9e34ab-35"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 18 Oct 2019 15:11:52 GMT
screenshot-2018-11-26-at-19-05-32.png
zdnet4.cbsistatic.com/hub/i/r/2018/11/26/02b285d5-4a60-43a0-9a42-1fa22c9c7203/thumbnail/170x128/f5863af9033d349ae3c9244d9a9d6cf6/
42 KB
42 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2018/11/26/02b285d5-4a60-43a0-9a42-1fa22c9c7203/thumbnail/170x128/f5863af9033d349ae3c9244d9a9d6cf6/screenshot-2018-11-26-at-19-05-32.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d7bdcd5e1eceaa6e29eb451dbf0c748d2d4863f71af573ce993e8290bdbd9239
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
7021271
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
42997
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"ee5b912101bea6d7649532c3234c7fce"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2018-11-25-at-18-46-10.png
zdnet2.cbsistatic.com/hub/i/r/2018/11/25/1315309f-93af-40aa-ae8d-468b6b21b2a8/thumbnail/170x128/83557c0639b4a8027983405b0fd75b70/
36 KB
36 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2018/11/25/1315309f-93af-40aa-ae8d-468b6b21b2a8/thumbnail/170x128/83557c0639b4a8027983405b0fd75b70/screenshot-2018-11-25-at-18-46-10.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
1b385970b0125346c084e96e75044167f0513fd068ee3a98e546f2698bb63e1d
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
7033436
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
37233
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"1282361fd91dd7d33e973c529627e0a1"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2018-11-26-at-19-22-53.png
zdnet2.cbsistatic.com/hub/i/r/2018/11/26/7b4b87d6-72de-4f50-ad8a-0c9dd0b51bf5/thumbnail/170x128/a7b45c102b9177ab7e34f1118b05fd60/
10 KB
10 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2018/11/26/7b4b87d6-72de-4f50-ad8a-0c9dd0b51bf5/thumbnail/170x128/a7b45c102b9177ab7e34f1118b05fd60/screenshot-2018-11-26-at-19-22-53.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
33b6ea04e0217c65b24a23d1b34b3ddf405f47183949731200b4309b1620c25d
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
7033436
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
9939
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"db261d4f615f0e982983be499e57ccda"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2018-11-26-at-19-16-51.png
zdnet4.cbsistatic.com/hub/i/r/2018/11/26/c9f467ec-7b8c-446d-9a8e-1d742cafd7a5/thumbnail/170x128/4e0a5c0b13b2154ca45eaba8bca53cf5/
40 KB
40 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2018/11/26/c9f467ec-7b8c-446d-9a8e-1d742cafd7a5/thumbnail/170x128/4e0a5c0b13b2154ca45eaba8bca53cf5/screenshot-2018-11-26-at-19-16-51.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
02675fe5ef9e0a381f3eb2bf8024ebb3dc04f88c376b07d859cf8995e9e89f42
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
7002326
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
41262
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"8a7591885c84083e68131e312f132f44"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2018-11-25-at-18-55-38.png
zdnet2.cbsistatic.com/hub/i/r/2018/11/25/14aadb38-8e9e-4b83-91af-e29abd1869d4/thumbnail/170x128/1e6101f4367f015c1f8c57200d70b8da/
55 KB
55 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2018/11/25/14aadb38-8e9e-4b83-91af-e29abd1869d4/thumbnail/170x128/1e6101f4367f015c1f8c57200d70b8da/screenshot-2018-11-25-at-18-55-38.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
39a6fb5b2f6f6d979513b1e22f40eeab7a66104ad0c0282777997f3a7aadc431
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1251978
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
56278
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"4210187346dc0768537a080298c72dbb"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
npm.png
zdnet4.cbsistatic.com/hub/i/r/2019/10/15/54d57679-a8a4-483a-930c-dc701f67334a/thumbnail/170x128/276e15e65e2349185c52861b679f78ce/
13 KB
13 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/10/15/54d57679-a8a4-483a-930c-dc701f67334a/thumbnail/170x128/276e15e65e2349185c52861b679f78ce/npm.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
2b0b1309cfcad7590d9989bf5471456955197b15217ec8fcb811eded3996bc8b
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1205
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
12758
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"28542e7ec2f6c92bb1bfe25c58e0b28c"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
istock-949457754.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/07/12/04e5f598-aa44-4305-9b33-7d37c9556768/thumbnail/170x128/a2405483c8105edcf1f04c2d12f508a4/
8 KB
8 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/07/12/04e5f598-aa44-4305-9b33-7d37c9556768/thumbnail/170x128/a2405483c8105edcf1f04c2d12f508a4/istock-949457754.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
06225010455f67432ed8ce3267b9f677d5f780146aff2b49064ad239317ab32a
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
7304
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
7537
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"518fc66deea9d064d0a92eb73e4ea61b"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
not-hear-kermit-alexas-fotos.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/10/15/c9a7aa48-9ba5-43ba-a4ab-06a480e44c1f/thumbnail/170x128/ad7922f0368f62955235ceba76a6bc2a/
5 KB
5 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/10/15/c9a7aa48-9ba5-43ba-a4ab-06a480e44c1f/thumbnail/170x128/ad7922f0368f62955235ceba76a6bc2a/not-hear-kermit-alexas-fotos.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
6ebd4d2d9030877c6f99e2f82d56a711ef4558abf1b2f16987d1d95e73422431
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
16732
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4890
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"f1ababf130ee6a25f12da7478af8f1ac"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
win7endofsupportprodevices.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/10/15/555a859a-4ca8-4721-a47c-f151cd8824aa/thumbnail/170x128/adbd8521c936593d33237f4dc86b3b21/
6 KB
6 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/10/15/555a859a-4ca8-4721-a47c-f151cd8824aa/thumbnail/170x128/adbd8521c936593d33237f4dc86b3b21/win7endofsupportprodevices.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
0b025e60eaeed450c28bd2d98b4d71e1cf54414361e42bba58a0005fc1ac165f
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
22458
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
5660
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"c34a7191f6e9948068b83e7179ea3da8"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2019-01-09-at-09-35-58.png
zdnet2.cbsistatic.com/hub/i/r/2019/01/09/bee32c81-a7bd-4f9e-9990-41a9f5ad36d7/thumbnail/170x128/7d876b8afe9e5d5e1e582c9efd0ee110/
35 KB
35 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/01/09/bee32c81-a7bd-4f9e-9990-41a9f5ad36d7/thumbnail/170x128/7d876b8afe9e5d5e1e582c9efd0ee110/screenshot-2019-01-09-at-09-35-58.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
5c45b27a696b9cac6fa21c1f1f4bb8adb0b2dcf3b8e3cc38df7d939413d8adc3
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
22403
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
36150
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"c8c0c749da5056804a5bfcfe44b778e4"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
checkra1n.png
zdnet2.cbsistatic.com/hub/i/r/2019/10/15/df65fa06-099d-400a-8f67-07622a56c4fc/thumbnail/170x128/1fffaf59a39c10506aa2b0e9f5832ffd/
21 KB
21 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/10/15/df65fa06-099d-400a-8f67-07622a56c4fc/thumbnail/170x128/1fffaf59a39c10506aa2b0e9f5832ffd/checkra1n.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
767f0e1eba152bf65a0550c12e348717a5317b584d76aeb5ff2dea87fa8f9308
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
32691
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
21447
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5bc33927ca8779dcd219b9dfaa1195a5"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
harmless-bug-cute.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/10/15/cb4bac18-961f-479b-b6a1-938d687c90b4/thumbnail/170x128/ce25653dba5f25bf5570c070ffd98d56/
9 KB
9 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/10/15/cb4bac18-961f-479b-b6a1-938d687c90b4/thumbnail/170x128/ce25653dba5f25bf5570c070ffd98d56/harmless-bug-cute.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
fecc6a43ba8f509f7dfca9ea079e17ec1f741f9ad7fbd4437071a0af6aca34d3
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
33845
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
9325
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"0f20c77d6afb02422603acb0329b5a41"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
4-illumibowl-eileen-brown-zdnet.png
zdnet3.cbsistatic.com/hub/i/r/2017/12/19/d66e390e-9182-41f5-9e74-af1397ee0e9a/thumbnail/170x128/34236c305775494dd11cd0b75e843bac/
23 KB
23 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2017/12/19/d66e390e-9182-41f5-9e74-af1397ee0e9a/thumbnail/170x128/34236c305775494dd11cd0b75e843bac/4-illumibowl-eileen-brown-zdnet.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
96c0b52abad0655030169f3a2fb617f89a84162822448fc7a2fc143cf76ebff9
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
41541
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
23443
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"860f5834f8e7f8e2834fc2957042760e"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
istock-1031563502.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/10/10/f28e43a6-7dcf-49dd-822a-f7f37d33dd0e/thumbnail/170x128/8f07b1ff99af54778f2bd5d3c942ac14/
8 KB
7 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/10/10/f28e43a6-7dcf-49dd-822a-f7f37d33dd0e/thumbnail/170x128/8f07b1ff99af54778f2bd5d3c942ac14/istock-1031563502.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
b71c90e27cb9c3e86faeafd29b0d4569787d4082bc12d380e16e253e9960cb10
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
48371
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
7115
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"c5eee1896752e5ac19a3a0bb34fbab4b"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
require-2.1.2.js
zdnet2.cbsistatic.com/fly/1822-fly/js/libs/
16 KB
6 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
109176
status
200
vary
Accept-Encoding
content-length
6305
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:32:17 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da4bf31-3f09"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 21 Oct 2019 18:37:03 GMT
evidon-sitenotice-tag.js
zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/
69 KB
14 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
8998e68f9bb1686ca1e03fcf3f0d6ea669c32d1f3554aeea809f1b1824ff6625
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
336534
status
200
vary
Accept-Encoding
content-length
13960
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:27:39 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e34ab-1134e"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 19 Oct 2019 03:27:33 GMT
country.js
c.evidon.com/geo/
260 B
512 B
Script
General
Full URL
https://c.evidon.com/geo/country.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.45.108.200 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-45-108-200.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
f9784f57729f84391b084eed9e944e048f771129d65e9b58f34095fdfba86473

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
last-modified
Wed, 30 May 2018 22:23:16 GMT
server
AkamaiNetStorage
status
200
etag
"c1e367d098d326049811561575dbda4a:1527718996"
access-control-max-age
86400
access-control-allow-methods
GET,OPTIONS,POST
content-type
application/x-javascript
access-control-allow-origin
accept-ranges
bytes
access-control-allow-headers
*
content-length
260
snthemes.js
zdnet3.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/
94 KB
8 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/snthemes.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
39f0e13a96fd029965b5b5fd3504853b6fe6ded07b4dd8862a0e033be626e655
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
289377
status
200
vary
Accept-Encoding
content-length
7763
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:27:39 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e34ab-177f3"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 19 Oct 2019 16:22:54 GMT
settings.js
zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/
33 KB
2 KB
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/settings.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
ad7ed17bf4c8d9dd2511e7254670822d0f90c8fb89187f860cfbcb91821abc84
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
159989
status
200
vary
Accept-Encoding
content-length
1669
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:27:39 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e34ab-828e"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 21 Oct 2019 04:22:51 GMT
truncated
/
917 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
43 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/gif
mag-white01.png
zdnet4.cbsistatic.com/fly/1571077774-fly/bundles/zdnetcss/images/core/
1 KB
1 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/fly/1571077774-fly/bundles/zdnetcss/images/core/mag-white01.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet2.cbsistatic.com/fly/1822-fly/css/core/main-3c565ba1f5-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
109175
status
200
vary
Accept-Encoding
content-length
936
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:29:34 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da4be8e-4f1"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 21 Oct 2019 18:37:04 GMT
ring-animated.svg
zdnet3.cbsistatic.com/fly/1571077774-fly/bundles/zdnetcss/images/video/
704 B
496 B
Image
General
Full URL
https://zdnet3.cbsistatic.com/fly/1571077774-fly/bundles/zdnetcss/images/video/ring-animated.svg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
0025565f0cddfceb7ebdbc4b21d2552c894998e443153f97a6e8b353dfd9bebd
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet3.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-ca7d9bab8e-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
109173
status
200
vary
Accept-Encoding
content-length
364
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:29:34 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5da4be8e-2c0"
strict-transport-security
max-age=31536000
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 13 Oct 2020 18:37:03 GMT
logo.png
zdnet2.cbsistatic.com/fly/1571077774-fly/bundles/zdnetcss/images/core/
4 KB
4 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/fly/1571077774-fly/bundles/zdnetcss/images/core/logo.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet2.cbsistatic.com/fly/1822-fly/css/core/main-3c565ba1f5-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
109174
status
200
vary
Accept-Encoding
content-length
4128
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:29:34 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da4be8e-1009"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 21 Oct 2019 18:37:04 GMT
Raleway-Regular.woff2
zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
50 KB
51 KB
Font
General
Full URL
https://zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Regular.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
66ef1b7581d8ef7b82bfe2ca363a612a479d89b808e2241f68d3e8c75f4f06d4
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://zdnet2.cbsistatic.com/fly/1822-fly/css/core/main-3c565ba1f5-rev.css
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
x-content-type-options
nosniff
age
4046797
status
200
vary
Accept-Encoding
content-length
51572
x-xss-protection
1; mode=block
last-modified
Thu, 29 Aug 2019 19:30:36 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d6827dc-c974"
strict-transport-security
max-age=31536000
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 29 Aug 2020 04:43:37 GMT
Raleway-Bold.woff2
zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
51 KB
51 KB
Font
General
Full URL
https://zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Bold.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
9db8bd3e641dc88d54edf476a148e75e29b4e8ccd040cb340404d557578dcfbd
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://zdnet2.cbsistatic.com/fly/1822-fly/css/core/main-3c565ba1f5-rev.css
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
x-content-type-options
nosniff
age
7297467
status
200
vary
Accept-Encoding
content-length
52212
x-xss-protection
1; mode=block
last-modified
Tue, 23 Jul 2019 09:13:41 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d36cfc5-cbf4"
strict-transport-security
max-age=31536000
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Jul 2020 12:03:46 GMT
Raleway-Light.woff2
zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
50 KB
51 KB
Font
General
Full URL
https://zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Light.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
6de73873dd441f953668e77030299f082e0f3e6335bf944d88d44978162e6609
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://zdnet2.cbsistatic.com/fly/1822-fly/css/core/main-3c565ba1f5-rev.css
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
x-content-type-options
nosniff
age
7886985
status
200
vary
Accept-Encoding
content-length
51608
x-xss-protection
1; mode=block
last-modified
Tue, 16 Jul 2019 08:38:39 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d2d8d0f-c998"
strict-transport-security
max-age=31536000
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 15 Jul 2020 18:06:51 GMT
main.default.js
zdnet3.cbsistatic.com/fly/1822-fly/js/
209 KB
69 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/1822-fly/js/main.default.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
66c8429202a873c7d9a8af8754d2d3f01bc0812f865b7150d82d851fd9176d48
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
109174
status
200
vary
Accept-Encoding
content-length
70771
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:32:19 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da4bf33-342bc"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 21 Oct 2019 18:37:03 GMT
en.js
zdnet2.cbsistatic.com/fly/js/libs/evidon/translations/
311 KB
14 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/libs/evidon/translations/en.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
caab9bbec165591d5214448b624dae44a3cbc575721ba71da2f7130bbbcbc6dc
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
179543
status
200
vary
Accept-Encoding
content-length
14353
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:17 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e3585-4ddff"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 20 Oct 2019 23:04:15 GMT
vendorlist.js
zdnet2.cbsistatic.com/fly/js/libs/evidon/
113 KB
51 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/libs/evidon/vendorlist.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
eb07b53d262575cef96004e2be725ac235db39262e9bb8466a2a9b85cf532aa8
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
332183
status
200
vary
Accept-Encoding
content-length
52305
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:17 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e3585-1c3b9"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 19 Oct 2019 04:33:53 GMT
urs.js
urs.zdnet.com/sdk/
50 KB
50 KB
Script
General
Full URL
https://urs.zdnet.com/sdk/urs.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.38.167 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
167.38.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:40 GMT
via
1.1 google
last-modified
Thu, 07 Feb 2019 14:05:56 GMT
etag
"5c5c3b44-c7f5"
content-type
application/javascript
status
200
accept-ranges
bytes
alt-svc
clear
content-length
51189
scrolling-mpu-22779a851e-rev.js
zdnet3.cbsistatic.com/fly/js/components/
956 B
598 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/scrolling-mpu-22779a851e-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
4d565f67641c732365c3180ec1e37c7a987825faad3e8632de8a07a9101feedd
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
549331
status
200
vary
Accept-Encoding
content-length
491
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 13:12:44 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d9ddccc-3bc"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 16 Oct 2019 16:21:09 GMT
ls-zdnet.js
js-sec.indexww.com/ht/
85 KB
26 KB
Script
General
Full URL
https://js-sec.indexww.com/ht/ls-zdnet.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
57e1e8e64fe95a0acc0822d690633b9450b26919fcedc32958ebcf7d39393181

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:39 GMT
Content-Encoding
gzip
Last-Modified
Wed, 16 Oct 2019 00:30:56 GMT
Server
Apache
ETag
"da1344-15269-594fc36e013c8"
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=2079
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/javascript
Content-Length
26184
Expires
Wed, 16 Oct 2019 01:31:18 GMT
YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
c.go-mpulse.net/boomerang/ Frame AD46
187 KB
55 KB
Script
General
Full URL
https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.32.243.235 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-32-243-235.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:39 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/javascript;charset=UTF-8
Cache-Control
max-age=604800, s-maxage=604800
Transfer-Encoding
chunked
Connection
keep-alive, Transfer-Encoding
Timing-Allow-Origin
*
gpt.js
securepubads.g.doubleclick.net/tag/js/
45 KB
15 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
sffe /
Resource Hash
f7b71df270660f7958f60859209972586494aff37327672ef85951f29c151716
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"308 / 178 of 1000 / last-modified: 1571176937"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14544
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:39 GMT
sfp.js
native.sharethrough.com/assets/
441 KB
121 KB
Script
General
Full URL
https://native.sharethrough.com/assets/sfp.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.85.183.205 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-85-183-205.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
43b90922c0299971e08e778c343b6175bfca9dac50ea639bc6eb231a8c86b7b0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 15 Oct 2019 10:43:36 GMT
content-encoding
gzip
last-modified
Mon, 14 Oct 2019 20:48:03 GMT
server
AmazonS3
x-amz-cf-pop
FRA50
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/javascript
status
200
cache-control
public, max-age=3600
x-amz-cf-id
Qt1hk_yt3mQiQTsobTOLkC6cFEUDVIc0AmGq7mSyf5VjF6pQYt-flQ==
via
1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)
expires
Mon, 14 Oct 2019 21:48:01 GMT
evidon-banner.js
zdnet2.cbsistatic.com/fly/js/libs/evidon/
8 KB
2 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/libs/evidon/evidon-banner.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
c649aaa88ce29f86caa50dc08e1745c9783e049656ff2d5a93ef813b7f0c662a
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
159988
status
200
vary
Accept-Encoding
content-length
2440
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:14 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e3582-1faf"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 21 Oct 2019 04:22:52 GMT
18863
l.betrad.com/site/v3/425/3445/3/1/2/2/
0
120 B
Image
General
Full URL
https://l.betrad.com/site/v3/425/3445/3/1/2/2/18863?consent=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.168.89.158 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-168-89-158.compute-1.amazonaws.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Wed, 16 Oct 2019 00:56:40 GMT
content-encoding
gzip
x-powered-by
Express
etag
W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary
Accept-Encoding
;ord=1571187399933
ad.doubleclick.net/ddm/ad/jqtcyzh/uyqufw/kmpor/tnw/
43 B
194 B
Image
General
Full URL
https://ad.doubleclick.net/ddm/ad/jqtcyzh/uyqufw/kmpor/tnw/;ord=1571187399933?
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.198 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f6.1e100.net
Software
cafe /
Resource Hash
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 00:56:39 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
43
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
18863
l.betrad.com/site/v3/425/3445/3/4/2/2/
0
120 B
Image
General
Full URL
https://l.betrad.com/site/v3/425/3445/3/4/2/2/18863?consent=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.168.89.158 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-168-89-158.compute-1.amazonaws.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Wed, 16 Oct 2019 00:56:40 GMT
content-encoding
gzip
x-powered-by
Express
etag
W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary
Accept-Encoding
rid
match.adsrvr.org/track/
109 B
535 B
XHR
General
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=184216
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.48.102.50 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-48-102-50.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
78ab3d8877d2158f0a40aef1d87c0863e1d63112a55f88f3d66e0d517926cce2

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
x-aspnet-version
4.0.30319
status
200
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.zdnet.com
cache-control
private
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length
109
expires
Fri, 15 Nov 2019 00:56:39 GMT
utag.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
93 KB
19 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FC3) /
Resource Hash
64cfd2a647408273e2609b638b29d1f10370824f0169ee4db637edac660dfb66

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
last-modified
Mon, 16 Sep 2019 18:11:12 GMT
server
ECAcc (frc/8FC3)
etag
"4063075910"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=300
accept-ranges
bytes
content-length
19393
expires
Wed, 16 Oct 2019 01:01:39 GMT
config.json
c.go-mpulse.net/api/ Frame AD46
2 KB
1 KB
XHR
General
Full URL
https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5237291&v=1.571.0&if=&sl=0&si=zpp7bkif9kn-NaN&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,LOGN&acao=
Requested by
Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.32.243.235 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-32-243-235.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
1dd409bef92dcc031d66743fc06ef0d12077e8ee89933e0f97a673cc565e9d7f

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:40 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
693
integrator.js
adservice.google.de/adsid/
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 00:56:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 00:56:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
pubads_impl_2019100301.js
securepubads.g.doubleclick.net/gpt/
157 KB
58 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
sffe /
Resource Hash
d98e77e558ef5c298f4c28cdd1604914a16a3fcc9249904ba70c57d989fb6aab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 03 Oct 2019 13:06:21 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
58949
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:40 GMT
isInternalUser.js
iicbsi-a.akamaihd.net/common/js/esi/
22 B
272 B
Script
General
Full URL
https://iicbsi-a.akamaihd.net/common/js/esi/isInternalUser.js?cb=cbsiInternal
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a01:4a0:1338:28::c38a:ff18 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:40 GMT
Cache-Control
max-age=226769
Server
AkamaiNetStorage
Connection
keep-alive
ETag
"fb25287978f1b619e801f164a2dfd9ea:1473886414"
Content-Length
22
Content-Type
application/x-javascript
vglnk.js
cdn.viglink.com/api/
78 KB
27 KB
Script
General
Full URL
https://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a00d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:40 GMT
content-encoding
gzip
cf-cache-status
HIT
age
106868
cf-ray
526613021c28cbb8-VIE
status
200
content-length
27719
x-amz-id-2
HNEV4caKoOdziBrXGZIDp4CzG6boiBMb4TLu65nU6otYm4+p2OQwr1vWix1CX0FBodMy916W6w4=
last-modified
Mon, 16 Sep 2019 19:15:01 GMT
server
cloudflare
etag
"1545d811432c0074356408ee8f6c1e23"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
FB54A2C70C0BB866
cache-control
public, max-age=1800
accept-ranges
bytes
content-type
text/javascript
expires
Wed, 16 Oct 2019 01:26:40 GMT
utag.1779.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
3 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1779.js?utv=ut4.43.201812051842
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F05) /
Resource Hash
cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:40 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2016 20:43:57 GMT
server
ECAcc (frc/8F05)
etag
"392561602"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1785
expires
Thu, 31 Oct 2019 00:56:40 GMT
utag.1782.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F54) /
Resource Hash
791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:40 GMT
content-encoding
gzip
last-modified
Mon, 29 Oct 2018 17:20:42 GMT
server
ECAcc (frc/8F54)
etag
"3447796852"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1071
expires
Thu, 31 Oct 2019 00:56:40 GMT
utag.1787.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
142 KB
48 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F4A) /
Resource Hash
95ec4dea002be118a633dc5070c23358d10e179ad3de44f23ac97578c6971df7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:45 GMT
content-encoding
gzip
last-modified
Wed, 04 Sep 2019 18:05:01 GMT
server
ECAcc (frc/8F4A)
etag
"3504427907"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
48569
expires
Thu, 31 Oct 2019 00:56:45 GMT
utag.1790.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
935 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1790.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F4D) /
Resource Hash
10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:40 GMT
content-encoding
gzip
last-modified
Mon, 01 Aug 2016 14:31:10 GMT
server
ECAcc (frc/8F4D)
etag
"2267415266"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
872
expires
Thu, 31 Oct 2019 00:56:40 GMT
utag.1791.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1791.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FD1) /
Resource Hash
7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:40 GMT
content-encoding
gzip
last-modified
Mon, 01 Aug 2016 14:31:10 GMT
server
ECAcc (frc/8FD1)
etag
"3334871598+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1196
expires
Thu, 31 Oct 2019 00:56:40 GMT
utag.1792.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
4 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1792.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FD0) /
Resource Hash
dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:40 GMT
content-encoding
gzip
last-modified
Thu, 28 Jul 2016 14:28:47 GMT
server
ECAcc (frc/8FD0)
etag
"2022868805"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1664
expires
Thu, 31 Oct 2019 00:56:40 GMT
utag.1797.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
995 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F79) /
Resource Hash
3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:39 GMT
content-encoding
gzip
last-modified
Wed, 25 Jan 2017 20:07:58 GMT
server
ECAcc (frc/8F79)
etag
"1907756232+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
883
expires
Thu, 31 Oct 2019 00:56:39 GMT
pixel.gif
cdn.viglink.com/images/
43 B
105 B
Image
General
Full URL
https://cdn.viglink.com/images/pixel.gif?ch=1&rn=0.4671148009779378
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a00d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:40 GMT
cf-cache-status
HIT
age
6
cf-ray
526613024c59cbb8-VIE
status
200
content-length
43
x-amz-id-2
1mZ+cxwNG2syWohCFYvUscOgm4ABp6ZJYPPWOCCIpQflvsVnwWQdkXtJzi6TPlQTEBsCyHcJleQ=
last-modified
Tue, 10 Feb 2015 03:29:39 GMT
server
cloudflare
etag
"221d8352905f2c38b3cb2bd191d630b0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
398DB255F765F8AE
cache-control
max-age=15, must-revalidate
accept-ranges
bytes
content-type
image/gif
pixel.gif
cdn.viglink.com/images/
43 B
103 B
Image
General
Full URL
https://cdn.viglink.com/images/pixel.gif?ch=2&rn=0.4671148009779378
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a00d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:40 GMT
cf-cache-status
HIT
age
6
cf-ray
526613024c5acbb8-VIE
status
200
content-length
43
x-amz-id-2
1mZ+cxwNG2syWohCFYvUscOgm4ABp6ZJYPPWOCCIpQflvsVnwWQdkXtJzi6TPlQTEBsCyHcJleQ=
last-modified
Tue, 10 Feb 2015 03:29:39 GMT
server
cloudflare
etag
"221d8352905f2c38b3cb2bd191d630b0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
398DB255F765F8AE
cache-control
max-age=15, must-revalidate
accept-ranges
bytes
content-type
image/gif
lightbox.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame AE7E
326 B
381 B
Script
General
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1571187400035&lv=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4ea5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
d6a75907d2f5e09455d3cdd4197c508ef0d05ab6a77c6eac4fdebdbaf900bfd4

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:40 GMT
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
server
cloudflare
age
109225
x-powered-by
ASP.NET
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cf-ray
526613024945cbc0-VIE
tag.aspx
ml314.com/
26 KB
12 KB
Script
General
Full URL
https://ml314.com/tag.aspx?1692019
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
c293a28e23c66b27bd04bc1742f3aab0ebf6c382961c1e83140f035a08ea5e5d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:39 GMT
Content-Encoding
gzip
Last-Modified
Tue, 15 Oct 2019 04:40:59 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, max-age=13459
Connection
keep-alive
Content-Length
11932
Expires
Wed, 16 Oct 2019 04:40:59 GMT
st.v3.js
www.everestjs.net/static/
25 KB
7 KB
Script
General
Full URL
https://www.everestjs.net/static/st.v3.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.90.90 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a184-31-90-90.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
3624e97a6a4f6fb481369929e579039d00be03b0a2e5d1f5f961c44dfd98940c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:40 GMT
Content-Encoding
gzip
Last-Modified
Mon, 12 Aug 2019 09:05:18 GMT
Server
Apache
ETag
"1ff0663-624a-58fe7d2af0fea"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=26699
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
7175
Expires
Wed, 16 Oct 2019 08:21:39 GMT
cbsinteractive.js
tru.am/scripts/custom/
3 KB
1 KB
Script
General
Full URL
https://tru.am/scripts/custom/cbsinteractive.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:a222 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
885fb8b9c3d2738bd627def3899f26d4d42641bbb868cc99d1fbc16f0ed9f4c6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:40 GMT
content-encoding
br
cf-cache-status
MISS
x-guploader-uploadid
AEnB2Up0qnkTAzrvjDkCcg6Szr0v8qF4x4VQuwZnlquyaVJCGjh8SpXBC6CQ5611-wjep5L7Wrf3E8rPqNAfulbxeMHtCWFw4g
x-goog-storage-class
REGIONAL
status
200
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
text/javascript
last-modified
Tue, 30 Apr 2019 19:32:26 GMT
server
cloudflare
etag
W/"c486c91d1321adf59073588524182108"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=9gbW7g==, md5=xIbJHRMhrfWQc1iFJBghCA==
x-goog-generation
1556652746634603
cache-control
public, max-age=86400
x-goog-stored-content-length
2725
cf-ray
526613025b755982-VIE
expires
Thu, 17 Oct 2019 00:56:40 GMT
ds.js
dw.cbsi.com/js/cbsi/
18 KB
7 KB
Script
General
Full URL
https://dw.cbsi.com/js/cbsi/ds.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1791.js?utv=ut4.43.201805241512
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
d696da403b0169c2191d0ec0b0fcdaa85487b21b19fd58f4b1fb5b9edf40b153

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:40 GMT
Content-Encoding
gzip
Last-Modified
Wed, 13 Sep 2017 19:06:40 GMT
Server
Apache/2.4.25
ETag
"1917-55916dc13f000"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=43200, s-maxage=1800
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=80, max=410
Content-Length
6423
Expires
Wed, 16 Oct 2019 01:26:40 GMT
anonc.js
dw.cbsi.com/
73 B
620 B
Script
General
Full URL
https://dw.cbsi.com/anonc.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
56a92db0bfa0dea282298cd490a1cb25aa339907911737e089acbd55916494ee

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:40 GMT
Server
Apache/2.4.25
Etag
ZncAeF2masjAjdrk6Ns.1.dw_anonc
P3P
CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"
Cache-control
private, max-age=43200, s-max-age=0
Connection
Keep-Alive
Content-Type
application/javascript
Keep-Alive
timeout=80, max=274
Content-Length
73
Expires
Mon, 05 Jan 1970 12:12:12 GMT
user.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame AE7E
762 KB
124 KB
Script
General
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637057951420142886
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1571187400035&lv=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4ea5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3c9bb3631896aee1e930e140eb8fcbb4ad9cd9b96ec259b88b4b2fce0a55e805

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 16 Oct 2019 00:56:40 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
qP10qPK8evED/0zxduUG5Q==
age
109202
cf-polished
origSize=1198838
status
200
last-modified
Mon, 23 Sep 2019 18:35:07 GMT
x-ms-lease-status
unlocked
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
x-ms-request-id
21a330a5-b01e-013b-403e-7d51ca000000
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
526613027983cbc0-VIE
expires
Thu, 15 Oct 2020 00:56:40 GMT
utsync.ashx
ml314.com/
906 B
1 KB
Script
General
Full URL
https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=50070&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&pv=1571187400071_5j1iorf3y&bl=en-us&cb=8944&return=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D22052%26dpuuid%3D%5BPersonID%5D%26redir%3D&ht=&d=&dc=&si=1571187400071_5j1iorf3y&cid=2713c768-4b09-44e9-b2cd-eda8443c4c92&s=1600x1200&rp=
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?1692019
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
99754ea7d5ab93c9e5dee12af52b2375ea34d32a4d0c9efd346deb64db0169c9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:39 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
p3P
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control
private
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
523
Expires
0
ud.ashx
in.ml314.com/
20 B
698 B
Script
General
Full URL
https://in.ml314.com/ud.ashx?topiclimit=&cb=1692019
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?1692019
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.44.237.33 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-44-237-33.compute-1.amazonaws.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:39 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, no-cache="set-cookie"
Connection
keep-alive
Content-Length
138
Expires
Thu, 17 Oct 2019 00:56:40 GMT
csync.ashx
ml314.com/
Redirect Chain
  • https://tags.bluekai.com/site/20486?limit=0&id=3605362246684770317&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=3605362246684770317%26eid=50056
  • https://ml314.com/csync.ashx?fp=uM9z199999emm3j5&person_id=3605362246684770317&eid=50056
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=uM9z199999emm3j5&person_id=3605362246684770317&eid=50056
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:39 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Wed, 16 Oct 2019 20:56:40 GMT

Redirect headers

Location
https://ml314.com/csync.ashx?fp=uM9z199999emm3j5&person_id=3605362246684770317&eid=50056
Date
Wed, 16 Oct 2019 00:56:40 GMT
Connection
keep-alive
Content-Length
0
BK-Server
e40d
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
csync.ashx
ml314.com/
Redirect Chain
  • https://idsync.rlcdn.com/395886.gif?partner_uid=3605362246684770317
  • https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzYwNTM2MjI0NjY4NDc3MDMxNxAAGg0IyNWZ7QUSBQjoBxAAQgBKAA
  • https://ml314.com/csync.ashx?fp=42c3d6fd79b1293d1f4747018b988f72cb03ffa0554af2a5a207568c01f2cff9f4cb09cee1a4f8eb&person_id=3605362246684770317&eid=50082
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=42c3d6fd79b1293d1f4747018b988f72cb03ffa0554af2a5a207568c01f2cff9f4cb09cee1a4f8eb&person_id=3605362246684770317&eid=50082
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.106.135 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-31-106-135.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:39 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Wed, 16 Oct 2019 20:56:40 GMT

Redirect headers

date
Wed, 16 Oct 2019 00:56:40 GMT
via
1.1 google
status
307
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://ml314.com/csync.ashx?fp=42c3d6fd79b1293d1f4747018b988f72cb03ffa0554af2a5a207568c01f2cff9f4cb09cee1a4f8eb&person_id=3605362246684770317&eid=50082
cache-control
no-cache, no-store
timing-allow-origin
*
alt-svc
clear
content-length
0
csync.ashx
ml314.com/
Redirect Chain
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3605362246684770317%26eid=50220
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3605362246684770317%26eid=50220&mm_bnc&mm_bct&UUID=16875da6-5e2a-4100-867c-4097849d44e3
  • https://ml314.com/csync.ashx?fp=16875da6-5e2a-4100-867c-4097849d44e3&person_id=3605362246684770317&eid=50220
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=16875da6-5e2a-4100-867c-4097849d44e3&person_id=3605362246684770317&eid=50220
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.248.158.173 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-248-158-173.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:39 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Wed, 16 Oct 2019 20:56:40 GMT

Redirect headers

Date
Wed, 16 Oct 2019 00:56:40 GMT
Server
MT3 1796 9706391 master zrh-pixel-x23
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location
https://ml314.com/csync.ashx?fp=16875da6-5e2a-4100-867c-4097849d44e3&person_id=3605362246684770317&eid=50220
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
0
Expires
Wed, 16 Oct 2019 00:56:39 GMT
csync.ashx
ml314.com/
Redirect Chain
  • https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3605362246684770317
  • https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3605362246684770317
  • https://ml314.com/csync.ashx?fp=a5f17776bdd1f419a1805a99a0bb3e38&eid=50146&person_id=3605362246684770317
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=a5f17776bdd1f419a1805a99a0bb3e38&eid=50146&person_id=3605362246684770317
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.106.135 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-31-106-135.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:40 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Wed, 16 Oct 2019 20:56:40 GMT

Redirect headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:40 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Location
https://ml314.com/csync.ashx?fp=a5f17776bdd1f419a1805a99a0bb3e38&eid=50146&person_id=3605362246684770317
Cache-Control
no-cache
X-Server
10.45.7.229
Connection
keep-alive
Content-Length
0
Expires
0
match
ps.eyeota.net/
Redirect Chain
  • https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
  • https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
  • https://ml314.com/utsync.ashx?eid=50052&et=0&fp=22a1eC8KIZ76wp4z61rl13XhVnilr_MsducE6H32Mtn8&gdpr=1&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil
  • https://ml314.com/csync.ashx?fp=22a1eC8KIZ76wp4z61rl13XhVnilr_MsducE6H32Mtn8&person_id=3605362246684770317&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil
  • https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
70 B
171 B
Image
General
Full URL
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
18.195.251.148 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-195-251-148.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:40 GMT
Content-Length
70
Content-Type
image/gif

Redirect headers

Date
Wed, 16 Oct 2019 00:56:40 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
text/html; charset=utf-8
Location
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Cache-Control
private
Connection
keep-alive
Content-Length
168
Expires
Wed, 16 Oct 2019 20:56:40 GMT
demconf.jpg
dpm.demdex.net/
Redirect Chain
  • https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3605362246684770317&redir=
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3605362246684770317&redir=
42 B
840 B
Image
General
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3605362246684770317&redir=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.241.149.220 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-241-149-220.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v047-06e180463.edge-irl1.demdex.com 5.60.0.20191014092846 3ms (+1ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
HYM1YdyhScM=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
J/G1tM2wQdY=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3605362246684770317&redir=
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
article-646651a118-rev.js
zdnet4.cbsistatic.com/fly/js/pages/
160 KB
45 KB
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/js/pages/article-646651a118-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
992e73adb3e1f6f91021aec811784c5c06708c938bc3843583f56ea3fac5c1a2
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
97526
status
200
vary
Accept-Encoding
content-length
45961
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:32:20 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da4bf34-28124"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 21 Oct 2019 21:51:13 GMT
CBSI-PLAYER.js
vidtech.cbsinteractive.com/uvpjs/0.42.297/
1 MB
281 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:40 GMT
content-encoding
gzip
age
1616004
x-cache
HIT, HIT
status
200
content-length
286838
x-amz-id-2
eFLdg4aPXUFc7W4j8Nhh9UdduMDflMLRIufQ6v/Vh6+pWt+vfGcNnF3gpKRr47exsFfoiPpv1MY=
x-served-by
cache-dca17747-DCA, cache-hhn4049-HHN
last-modified
Fri, 01 Feb 2019 18:20:56 GMT
server
AmazonS3
x-timer
S1571187400.325648,VS0,VE1
etag
"eb5dd4ed3dcb7641ebbcb604d7ddb038"
vary
Accept-Encoding
x-amz-request-id
F767A360D0453B01
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
1, 1
chartbeat_video.js
static.chartbeat.com/js/
66 KB
23 KB
Script
General
Full URL
https://static.chartbeat.com/js/chartbeat_video.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:fc00:18:1fcd:349:ca21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
88762480fb084c0725cf9c3abde10e540ebf64884fd50a86789b5eb661c38cdd

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 15 Oct 2019 23:13:31 GMT
content-encoding
gzip
last-modified
Thu, 01 Aug 2019 01:36:07 GMT
server
nginx
age
6188
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/x-javascript
status
200
cache-control
max-age=7200
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
eFL7usw9ivvKUZNFhzbAukrt2C3EI5X431RQd9O8vJEDBPwUr2cB1Q==
via
1.1 1b73451818d2dd47a574604c0b84f692.cloudfront.net (CloudFront)
expires
Wed, 16 Oct 2019 01:13:31 GMT
mpulse-1.0.2.js
zdnet1.cbsistatic.com/fly/js/libs/
12 KB
5 KB
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
383827
status
200
vary
Accept-Encoding
content-length
4877
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:19 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e3587-2fdf"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 18 Oct 2019 14:19:33 GMT
ta-pagesocial-sdk.js
tru.am/scripts/
35 KB
12 KB
Script
General
Full URL
https://tru.am/scripts/ta-pagesocial-sdk.js
Requested by
Host: tru.am
URL: https://tru.am/scripts/custom/cbsinteractive.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:a222 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:40 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 18 Apr 2019 03:51:14 GMT
server
cloudflare
age
3217
etag
W/"942d5ae1e512ccdf18813550428dd002"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
cf-ray
526613043bec5982-VIE
expires
Thu, 17 Oct 2019 00:56:40 GMT
fb_lightbox.2.1.5.css
www.lightboxcdn.com/static/
4 KB
1 KB
Stylesheet
General
Full URL
https://www.lightboxcdn.com/static/fb_lightbox.2.1.5.css?cb=637048605067352348
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637057951420142886
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4ea5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b9028c7ecccf4f31fafcfca176cd6ed38197d7b3d6ea4c107b98af8eecc525b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 16 Oct 2019 00:56:40 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
q4B4xYJoZwx9ikt94o1nCA==
age
109163
cf-polished
origSize=6016
x-ms-meta-cbmodifiedtime
Wed, 10 Apr 2019 18:50:43 GMT
status
200
last-modified
Wed, 10 Apr 2019 19:06:17 GMT
x-ms-lease-status
unlocked
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
x-ms-request-id
a8c06077-501e-007a-013d-723f8c000000
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
52661303fb4bcbc0-VIE
expires
Thu, 15 Oct 2020 00:56:40 GMT
ls.html
www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 6499
0
0
Document
General
Full URL
https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637048605067352348
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637057951420142886
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4ea5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
www.lightboxcdn.com
:scheme
https
:path
/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637048605067352348
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
accept-encoding
gzip, deflate, br
cookie
__cfduid=dbad183137bfb0e73cea566933111d80a1571187400
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/

Response headers

status
200
date
Wed, 16 Oct 2019 00:56:41 GMT
content-type
text/html
content-md5
xa1/rdPe0J6SwxlD7atkzw==
last-modified
Mon, 23 Sep 2019 18:35:06 GMT
x-ms-request-id
ce9728fa-001e-00c3-05bc-83dc82000000
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
cf-cache-status
MISS
expires
Thu, 15 Oct 2020 00:56:41 GMT
cache-control
public, max-age=31536000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
server
cloudflare
cf-ray
52661303fb4fcbc0-VIE
content-encoding
br
t.gif
www.lightboxcdn.com/z9g/
35 B
191 B
Image
General
Full URL
https://www.lightboxcdn.com/z9g/t.gif?c=1571187400310&h=www.zdnet.com&e=p&u=40913
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4ea5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 16 Oct 2019 00:56:40 GMT
cf-cache-status
HIT
content-md5
KNaBTzCeoon4R8ac+RGUxg==
age
1014925
cf-polished
status=not_needed
x-ms-meta-cbmodifiedtime
Tue, 26 Feb 2019 00:59:40 GMT
status
200
content-length
35
x-ms-lease-status
unlocked
last-modified
Tue, 26 Feb 2019 01:15:02 GMT
server
cloudflare
etag
0x8D69B87D5A1B25F
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
x-ms-request-id
48b7eafb-401e-010c-457d-f6fd65000000
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
526613043b9fcbc0-VIE
cf-bgj
imgq:85
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&u=DvWRf3UzokkBiMKZL&d=zdnet.com&g=65713&g0=security&g1=catalin%20cimpanu&n=1&f=00001&c=0&x=0&m=0&y=4113&o=1585&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=2841&t=CwhrkWC4-rpXl9-DyDTeLs_Die8I&V=116&i=Hacker%20backdoors%20popular%20JavaScript%20library%20to%20steal%20Bitcoin%20funds%20%7C%20ZDNet&tz=-120&_acct=anon&sn=1&sv=DdzkKK388AQCYnA6HmM5k9B8P4bO&sd=1&im=067b2ff3&_
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.86.231.246 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-231-246.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Wed, 16 Oct 2019 00:56:40 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
config.json
c.go-mpulse.net/api/v2/
2 KB
1 KB
XHR
General
Full URL
https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1571187400464&s=c19705056d47cc23383dedd703ecaecba85c8aef8269a0f3c1126636e349f696
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.32.243.235 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-32-243-235.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
196a6fadc902aef6f16f732c62380de7012bd936d3172b523975ac2a8497fed2

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:40 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
801
beacon
beacon.tru.am/
0
171 B
Fetch
General
Full URL
https://beacon.tru.am/beacon
Requested by
Host: tru.am
URL: https://tru.am/scripts/ta-pagesocial-sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:a322 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded;charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 00:56:40 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
status
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, private, max-age=0
cf-ray
52661304f8445988-VIE
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 UTC
ping
api.viglink.com/api/
266 B
946 B
XHR
General
Full URL
https://api.viglink.com/api/ping
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.246.252.247 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-246-252-247.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
0843433e0e5a504fdb70309fb4a88836faf0afb18da5197bf5597bd8f3f9b7fe

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:40 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
266
Expires
Thu, 01 Jan 1970 00:00:00 GMT
id
dpm.demdex.net/
2 KB
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&ts=1571187400573
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.241.149.220 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-241-149-220.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
a693479b4bd3304a7570679adaab4e643ef2045d3dadd8eaa9b634dd63053b07
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v047-037b1f745.edge-irl1.demdex.com 5.60.0.20191014092846 3ms (+1ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
X-TID
ES4NMcCQTko=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
674
Expires
Thu, 01 Jan 1970 00:00:00 GMT
utag.v.js
tags.tiqcdn.com/utag/tiqapp/
2 B
116 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=cbsi/zdnetglobalsite/201909161811&cb=1571187400575
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8E8A) /
Resource Hash
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:40 GMT
last-modified
Thu, 14 Apr 2016 16:59:33 GMT
server
ECAcc (frc/8E8A)
etag
"2243872957"
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=600
accept-ranges
bytes
content-length
2
expires
Wed, 16 Oct 2019 01:06:40 GMT
Cookie set dest5.html
cbsi.demdex.net/ Frame 7235
0
0
Document
General
Full URL
https://cbsi.demdex.net/dest5.html?d_nsid=undefined
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.30.105.51 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-30-105-51.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Host
cbsi.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Accept-Encoding
gzip, deflate, br
Cookie
demdex=67923397887247179930058594082167488428
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Mon, 14 Oct 2019 13:04:13 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=67923397887247179930058594082167488428;Path=/;Domain=.demdex.net;Expires=Mon, 13-Apr-2020 00:56:40 GMT;Max-Age=15552000
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding, User-Agent
X-TID
xy5chAvdQZI=
Content-Length
2764
Connection
keep-alive
id
saa.cbsi.com/
90 B
574 B
XHR
General
Full URL
https://saa.cbsi.com/id?d_visid_ver=2.3.0&d_fieldgroup=A&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&mid=67792456393505865770038177176228707028&ts=1571187400612
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.188.31.119 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-15-188-31-119.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
7519515446f120487635529eb54a8ae944c4accb9a1c4e24bcdc593720d3f3c5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

status
200
date
Wed, 16 Oct 2019 00:56:40 GMT
x-content-type-options
nosniff
server
jag
xserver
anedge-95484cfc6-dhmvf
vary
Origin
x-c
master-1047.I1d1c81.M0-302
p3p
CP="This is not a P3P policy"
access-control-allow-origin
https://www.zdnet.com
access-control-allow-credentials
true
content-type
application/x-javascript
content-length
90
x-xss-protection
1; mode=block
domains
api.viglink.com/api/
76 B
521 B
XHR
General
Full URL
https://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.246.252.247 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-246-252-247.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
c49acffa07f9cac138c900d59bcaea97386cbb7e38cfe412384a2572548d2c80

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:39 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
76
Expires
Thu, 01 Jan 1970 00:00:00 GMT
c.gif
dw.cbsi.com/clear/
42 B
346 B
Image
General
Full URL
https://dw.cbsi.com/clear/c.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=157b9f8e-dd1a-4d3b-ae1a-c84c6ef29cb9&assettitle=hacker%20backdoors%20popular%20javascript%20library%20to%20steal%20bitcoin%20funds&assettype=content_article&pubdate=2018-11-26%2020%3A31%3A00&viewguid=2713c768-4b09-44e9-b2cd-eda8443c4c92&devicetype=desktop&sitetype=responsive%20web&author=catalin%20cimpanu&authorid=85fd8691-f525-4ea2-a601-af296f629f7f&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&ts=1571187400699&ld=www.zdnet.com&ldc=55925cef-1a8f-492a-afd0-fcac44faa528&brwinsz=1600x1200&brscrsz=1600x1200&brlang=en-US&tcset=utf8&im=dsjs&clgf=ZncAeF2masjAjdrk6Ns&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&title=Hacker%20backdoors%20popular%20JavaScript%20library%20to%20steal%20Bitcoin%20funds%20%7C%20ZDNet
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:40 GMT
Server
Apache/2.4.25
Vary
*
Content-Type
image/gif
Cache-control
no-cache, must-revalidate, no-transform
Connection
Keep-Alive
Keep-Alive
timeout=80, max=199
Content-Length
42
Expires
Mon, 05 Jan 1970 12:12:12 GMT
/
686eb71a.akstat.io/
0
354 B
XHR
General
Full URL
https://686eb71a.akstat.io/?h.pg=article&when=1571187400710&t_other=custom4%7C2065&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=7e301601a1a4363de771774b2b755bf60a331e02&h.t=1571187400482&http.initiator=api&rt.start=api&rt.si=d4327e14-fbbf-41a3-8ce8-4cb293d42ecd&rt.ss=1571187403334&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.32.243.235 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-32-243-235.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:40 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Wed, 16 Oct 2019 00:56:40 GMT
id
dpm.demdex.net/
2 KB
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&d_mid=67792456393505865770038177176228707028&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%012ED3356405158000-400F2721603365D6&ts=1571187400741
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.241.149.220 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-241-149-220.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
fe661e9869d2893d4e62558c00f821ff07320ef0fde7e1c313998f590f8eaed6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v047-0b0d47c7e.edge-irl1.demdex.com 5.60.0.20191014092846 6ms (+1ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
X-TID
nOcDVZ0URVA=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
674
Expires
Thu, 01 Jan 1970 00:00:00 GMT
s09347724914766
saa.cbsi.com/b/ss/cnetzdnetglobalsite/10/JS-2.3.0/
2 KB
2 KB
Script
General
Full URL
https://saa.cbsi.com/b/ss/cnetzdnetglobalsite/10/JS-2.3.0/s09347724914766?AQB=1&ndh=1&pf=1&callback=s_c_il[0].doPostbacks&et=1&t=16%2F9%2F2019%202%3A56%3A40%203%20-120&d.&nsid=0&jsonv=1&.d&mid=67792456393505865770038177176228707028&aid=2ED3356405158000-400F2721603365D6&aamlh=6&ce=UTF-8&ns=cbsinteractive&pageName=zdnet%3A%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&g=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&cc=USD&ch=editorial&server=www.zdnet.com&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c1=zdnet&v1=zdnet&h1=editorial%7Carticle&l1=bitcoin&c2=D%3Dv2&v2=eu&l2=113c25b6-ec91-11e3-95d2-02911863765e%7C10f422bf-ec91-11e3-95d2-02911863765e%7C5d68ddc2-d682-11e4-9a74-d4ae52e95e57&c3=D%3Dv3&v3=responsive%20web%7Cdesktop&l3=85fd8691-f525-4ea2-a601-af296f629f7f&c4=D%3Dv4&c5=D%3Dv5&v5=cnetzdnetglobalsite&c6=D%3Dv6&v6=editorial%7Carticle&c7=D%3Dv7&v7=D%3Dg&c8=D%3Dv8&v8=Hacker%20backdoors%20popular%20JavaScript%20library%20to%20steal%20Bitcoin%20funds%20%7C%20ZDNet&c9=D%3DUser-Agent&c10=D%3Dv10&v10=article&c11=D%3Dv11&v15=not%20authenticated%7Canon&c20=D%3Dv20&v20=hacker%20backdoors%20popular%20javascript%20library%20to%20steal%20bitcoin%20funds&c22=D%3Dv22&v22=content_article&c23=D%3Dv23&v23=113c25b6-ec91-11e3-95d2-02911863765e&c24=D%3Dv24&v24=2713c768-4b09-44e9-b2cd-eda8443c4c92&c25=D%3Dv25&c26=D%3Dv26&c28=D%3Dv28&c30=D%3Dv30&v30=157b9f8e-dd1a-4d3b-ae1a-c84c6ef29cb9&c31=D%3Dv31&c33=D%3Dv33&c34=D%3Dv34&c35=D%3Dv35&v35=ZncAeF2masjAjdrk6Ns&c44=D%3Dv44&v44=zdnet&c50=D%3Dv50&c51=D%3Dv51&c52=D%3Dv52&c53=D%3Dv53&c54=D%3Dv54&c65=D%3Dv65&v65=discover&c69=D%3Dv69&v85=true&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&AQE=1
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.188.31.119 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-15-188-31-119.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
73750c75f42413cef3530520a3124063951f93d0a8411b1db8f4f78a61f53fa0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-aam-tid
B6yz/tSzQqk=
date
Wed, 16 Oct 2019 00:56:40 GMT
x-content-type-options
nosniff
x-c
master-1047.I1d1c81.M0-302
p3p
CP="This is not a P3P policy"
status
200
content-length
1671
x-xss-protection
1; mode=block
dcs
dcs-prod-irl1-v047-0f3dc1a68.edge-irl1.demdex.com 5.60.0.20191014092846 6ms (+2ms)
pragma
no-cache
last-modified
Thu, 17 Oct 2019 00:56:40 GMT
server
jag
xserver
anedge-95484cfc6-d8ctr
etag
3374099251591086080-4616365487842099773
vary
*
content-type
application/x-javascript;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Tue, 15 Oct 2019 00:56:40 GMT
jpt
secure.adnxs.com/
99 B
1 KB
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834629&size=728x90&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=oYAvrvyt&psa=0&promo_sizes=970x250&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
584c36808fe1afaa466888c8eeea28c541088a71d237bd5804b0e2399007a286
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
X-Proxy-Origin
185.151.58.114; 185.151.58.114; 535.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.111:80
AN-X-Request-Uuid
78d1266d-704e-4e20-b3c6-5846a0d6927e
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
99
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/
99 B
1 KB
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834625&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=U381yIzV&psa=0&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
eedd64fdbf051dd4c7d461ad402eb774c36b3b7383cb01559d10c9f90d2020ac
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
X-Proxy-Origin
185.151.58.114; 185.151.58.114; 535.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.252:80
AN-X-Request-Uuid
a7403353-1e72-4eab-9d6a-681b7b2e40de
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
99
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/
99 B
1 KB
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834627&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=ZEbHAIEO&psa=0&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
a80ab85ac04322aefb57441850c8bac767f406605b57c95ea616a29961178aa3
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
X-Proxy-Origin
185.151.58.114; 185.151.58.114; 535.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.39:80
AN-X-Request-Uuid
76fc5d98-694a-435d-b78e-487ce3b3e4ca
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
99
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/
99 B
1 KB
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834631&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=05KfOOqb&psa=0&promo_sizes=300x600&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
e93a0940e4230e519049eb4c56979c4c42d6a522dac7443f8b624f91380455e3
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
X-Proxy-Origin
185.151.58.114; 185.151.58.114; 535.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.49:80
AN-X-Request-Uuid
dbafaf48-678d-4f90-b6d2-02bdc0c6ab10
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
99
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/
99 B
1 KB
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834632&size=728x90&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=cOjs50XP&psa=0&promo_sizes=970x250&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
26c03dfc87a6c421e0f9b9dae9ff719806c47cc01ea6c5e102ae262b70348075
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
X-Proxy-Origin
185.151.58.114; 185.151.58.114; 535.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.13:80
AN-X-Request-Uuid
fbea3a0b-5bb5-46b9-bd66-eeb485eae542
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
99
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cygnus
as-sec.casalemedia.com/
66 B
943 B
XHR
General
Full URL
https://as-sec.casalemedia.com/cygnus?v=7.2&s=182823&fn=headertag.IndexExchangeHtb.adResponseCallback&r=%7B%22id%22%3A27681021%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F%22%7D%2C%22imp%22%3A%5B%7B%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22202%22%2C%22siteID%22%3A%22182829%22%7D%2C%22id%22%3A%221%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22220%22%2C%22siteID%22%3A%22183316%22%7D%2C%22id%22%3A%222%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22209%22%2C%22siteID%22%3A%22182828%22%7D%2C%22id%22%3A%223%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22210%22%2C%22siteID%22%3A%22182826%22%7D%2C%22id%22%3A%224%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22208%22%2C%22siteID%22%3A%22182824%22%7D%2C%22id%22%3A%225%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22222%22%2C%22siteID%22%3A%22182825%22%7D%2C%22id%22%3A%226%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22219%22%2C%22siteID%22%3A%22183315%22%7D%2C%22id%22%3A%227%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22201%22%2C%22siteID%22%3A%22182823%22%7D%2C%22id%22%3A%228%22%7D%5D%2C%22ext%22%3A%7B%22source%22%3A%22ixwrapper%22%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22adserver.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%223b5edc31-9944-4ca6-997e-2c22c3112f5e%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID%22%7D%7D%2C%7B%22id%22%3A%22FALSE%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_LOOKUP%22%7D%7D%2C%7B%22id%22%3A%222019-10-16T00%3A56%3A39%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_CREATED_AT%22%7D%7D%5D%7D%5D%7D%7D
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
bb3b204aa2a86992cd0d767e0a2ba2ffa2db9c2691a190f3f35613c54621537d

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:41 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript
Content-Length
86
Expires
Wed, 16 Oct 2019 00:56:41 GMT
vglnk.js
cdn.viglink.com/api/
78 KB
27 KB
Script
General
Full URL
https://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a00d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
cf-cache-status
HIT
age
106869
cf-ray
526613091c8bcbb8-VIE
status
200
content-length
27719
x-amz-id-2
HNEV4caKoOdziBrXGZIDp4CzG6boiBMb4TLu65nU6otYm4+p2OQwr1vWix1CX0FBodMy916W6w4=
last-modified
Mon, 16 Sep 2019 19:15:01 GMT
server
cloudflare
etag
"1545d811432c0074356408ee8f6c1e23"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
FB54A2C70C0BB866
cache-control
public, max-age=1800
accept-ranges
bytes
content-type
text/javascript
expires
Wed, 16 Oct 2019 01:26:41 GMT
utag.1775.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
26 KB
9 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.43.201909161811
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F51) /
Resource Hash
0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
last-modified
Thu, 10 Nov 2016 20:41:55 GMT
server
ECAcc (frc/8F51)
etag
"1112944691"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
8960
expires
Thu, 31 Oct 2019 00:56:41 GMT
utag.277.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
947 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.43.201909161811
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F67) /
Resource Hash
0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2016 20:43:58 GMT
server
ECAcc (frc/8F67)
etag
"461771432"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
863
expires
Thu, 31 Oct 2019 00:56:41 GMT
utag.1772.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1772.js?utv=ut4.43.201909161811
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F3A) /
Resource Hash
e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:38 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2016 20:43:58 GMT
server
ECAcc (frc/8F3A)
etag
"4198895974"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
959
expires
Thu, 31 Oct 2019 00:56:38 GMT
utag.1796.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
8 KB
3 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1796.js?utv=ut4.43.201909161811
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F27) /
Resource Hash
9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:22 GMT
content-encoding
gzip
last-modified
Mon, 28 Nov 2016 15:09:53 GMT
server
ECAcc (frc/8F27)
etag
"931235332"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
2762
expires
Thu, 31 Oct 2019 00:56:22 GMT
utag.1810.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1810.js?utv=ut4.43.201909161811
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F3D) /
Resource Hash
07178558c596bc2fe33d99750a349d5413fa4571fc778cefbe4f4f367404f6d6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:40 GMT
content-encoding
gzip
last-modified
Mon, 08 Jul 2019 17:22:10 GMT
server
ECAcc (frc/8F3D)
etag
"4274102907"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
988
expires
Thu, 31 Oct 2019 00:56:40 GMT
pixel_details.html
www.everestjs.net/static/ Frame 7B88
Redirect Chain
  • https://pixel.everesttech.net/4083/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__EFOPTOUT__%26throttleCook...
  • https://www.everestjs.net/static/pixel_details.html
0
0
Document
General
Full URL
https://www.everestjs.net/static/pixel_details.html
Requested by
Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.90.90 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a184-31-90-90.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
www.everestjs.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/

Response headers

Server
Apache
Last-Modified
Tue, 04 Oct 2011 16:14:21 GMT
ETag
"8623-a6-4ae7b62583140"
Accept-Ranges
bytes
Content-Type
text/html
Content-Encoding
gzip
Content-Length
146
Cache-Control
max-age=12780
Expires
Wed, 16 Oct 2019 04:29:41 GMT
Date
Wed, 16 Oct 2019 00:56:41 GMT
Connection
keep-alive
Vary
Accept-Encoding

Redirect headers

Date
Wed, 16 Oct 2019 00:56:41 GMT
Server
Apache
Set-Cookie
everest_session_v2=XaZqyQAABSIc1AoH; path=/; domain=.everesttech.net everest_g_v2=g_surferid~XaZqyQAABSIc1AoH; path=/; domain=.everesttech.net; expires=Thu, 09-Sep-2021 11:36:41 GMT
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control
no-cache
Location
https://www.everestjs.net/static/pixel_details.html#google=XaZqyQAABSIc1AoH&gsurfer=XaZqyQAABSIc1AoH&optout=0&throttleCookie=&time=20191016005641
Content-Length
345
Keep-Alive
timeout=15, max=998911
Connection
Keep-Alive
Content-Type
text/html; charset=iso-8859-1
Cookie set dest5.html
cbsi.demdex.net/ Frame FFA4
0
0
Document
General
Full URL
https://cbsi.demdex.net/dest5.html?d_nsid=0
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.30.105.51 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-30-105-51.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Host
cbsi.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Accept-Encoding
gzip, deflate, br
Cookie
demdex=67923397887247179930058594082167488428; dextp=269-1-1571187400745|477-1-1571187400845|771-1-1571187400947|22052-1-1571187401048
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Mon, 14 Oct 2019 13:09:27 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=67923397887247179930058594082167488428;Path=/;Domain=.demdex.net;Expires=Mon, 13-Apr-2020 00:56:41 GMT;Max-Age=15552000
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding, User-Agent
X-TID
hDmkNwOXSV4=
Content-Length
2764
Connection
keep-alive
/
www.zdnet.com/components/breaking-news/xhr/
1 KB
1 KB
XHR
General
Full URL
https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1822-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
bd59a9a9a753359b29a450a279438e6fe56d852c2e67b1aec214d1016ae76d85
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
504
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 16 Oct 2019 00:48:26 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 16 Oct 2019 00:56:41 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
b5b05d29-5422-4d5c-829a-423d0558aac7
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Wed, 16 Oct 2019 02:18:26 GMT
disqus-count-5922ea1c53-rev.js
zdnet2.cbsistatic.com/fly/js/components/
406 B
522 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/disqus-count-5922ea1c53-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
b8c15c61feffdfe68b168cf2ac8cf58867f38547da3b15d7971a75c44f16bc26
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
380690
status
200
vary
Accept-Encoding
content-length
270
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:12 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d9e3580-196"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 18 Oct 2019 15:11:51 GMT
image-gallery-modal-e49526b449-rev.js
zdnet1.cbsistatic.com/fly/js/components/
5 KB
2 KB
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/components/image-gallery-modal-e49526b449-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f5b52ad70c5d645388b52d2fadaf8a5311aee9a01436866ab9b3e2c5f02e1c22
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
146582
status
200
vary
Accept-Encoding
content-length
1909
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:13 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e3581-13d0"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 21 Oct 2019 08:13:38 GMT
screenshot-2018-11-25-at-18-31-31.png
zdnet3.cbsistatic.com/hub/i/r/2018/11/25/fb02af0e-f3fe-4658-84ff-7ac3145b23f3/thumbnail/170x128/0ac7581c156d33fa202e0046f1fc0985/
41 KB
41 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2018/11/25/fb02af0e-f3fe-4658-84ff-7ac3145b23f3/thumbnail/170x128/0ac7581c156d33fa202e0046f1fc0985/screenshot-2018-11-25-at-18-31-31.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
c5e61d79eb0a41b0681009bdc9c7babaddeb5c513f082f942078fcec9b7e1958
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
312299
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
41599
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"50809a3cabc234a84659bb41cfce0f9e"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2018-11-26-at-18-57-39.png
zdnet4.cbsistatic.com/hub/i/r/2018/11/26/7b0d2187-fcee-4baf-a988-0da446b82909/thumbnail/170x128/143b3c28fcee52e393fbb8125573a4e3/
46 KB
46 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2018/11/26/7b0d2187-fcee-4baf-a988-0da446b82909/thumbnail/170x128/143b3c28fcee52e393fbb8125573a4e3/screenshot-2018-11-26-at-18-57-39.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
06f0a9dab713f74a8425ce5ac3e9970c90911c7cfb9fbb65d0d793bcd6efb12d
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
7012304
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
46671
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"c31cd9eb0233c998e5d682c4d826d8c6"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2018-11-26-at-19-15-23.png
zdnet3.cbsistatic.com/hub/i/r/2018/11/26/d001ccda-19ac-4b5d-9048-9479d732c455/thumbnail/170x128/c5d07ca0db13171205cd2a6bd70d9b2a/
34 KB
34 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2018/11/26/d001ccda-19ac-4b5d-9048-9479d732c455/thumbnail/170x128/c5d07ca0db13171205cd2a6bd70d9b2a/screenshot-2018-11-26-at-19-15-23.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
5c700fe27a919dc843ce90ea9175a0e2eea9d24397b66a2b72a92ebdbaff0252
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
5805528
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
34446
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"2bb054c14409adcb28cb8d922e10a383"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2018-11-26-at-16-08-57.png
zdnet2.cbsistatic.com/hub/i/r/2018/11/26/da1f34c2-2bce-4bd5-99b4-f93760bb25fb/thumbnail/170x128/3514848ad66caa0e86b6377f6ffa3061/
38 KB
38 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2018/11/26/da1f34c2-2bce-4bd5-99b4-f93760bb25fb/thumbnail/170x128/3514848ad66caa0e86b6377f6ffa3061/screenshot-2018-11-26-at-16-08-57.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
06d17db7c7c608e4f8f02c58f7b2dd955cac95d7ded45967ce9f29fd6bb1d2d3
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1187250
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
39141
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"de3a8280fcdb3da95e3b4626cead3986"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
screenshot-2018-11-26-at-19-17-47.png
zdnet3.cbsistatic.com/hub/i/r/2018/11/26/63654239-e0c3-4518-8706-a819cf4a9b1f/thumbnail/170x128/58a32920a245cfeb51f29a9791c294fd/
19 KB
19 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2018/11/26/63654239-e0c3-4518-8706-a819cf4a9b1f/thumbnail/170x128/58a32920a245cfeb51f29a9791c294fd/screenshot-2018-11-26-at-19-17-47.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
b79fafb9e9f80ecaaf7c1722d1e6e290625add1be52cf8b5fa3e51fb51deb098
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1189882
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
19060
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5ef7f68d74e8de904b773669eff12e1d"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
disqus-loader-db6fae9369-rev.js
zdnet3.cbsistatic.com/fly/js/components/
1 KB
811 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/disqus-loader-db6fae9369-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
4bb0f33f40b38593e1cba1c8b2f15703d33753bbd80f30511dd9c464a959afe7
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
155716
status
200
vary
Accept-Encoding
content-length
642
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:12 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e3580-580"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 21 Oct 2019 05:41:25 GMT
npm.png
zdnet4.cbsistatic.com/hub/i/r/2019/10/15/54d57679-a8a4-483a-930c-dc701f67334a/thumbnail/70x53/337203aeb802850478c36aa24e050888/
4 KB
4 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/10/15/54d57679-a8a4-483a-930c-dc701f67334a/thumbnail/70x53/337203aeb802850478c36aa24e050888/npm.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
e4b558a63bcfe3c7a628d50c22d0f9feba81649fa34e284d5de80cc3a93f53bc
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1180
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
3981
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"9ca8c9b0996bbf05ae7753d34667a6fd"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
checkra1n.png
zdnet4.cbsistatic.com/hub/i/r/2019/10/15/df65fa06-099d-400a-8f67-07622a56c4fc/thumbnail/70x53/c9339508441bfb11e66a4da2f5a47aa6/
8 KB
8 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/10/15/df65fa06-099d-400a-8f67-07622a56c4fc/thumbnail/70x53/c9339508441bfb11e66a4da2f5a47aa6/checkra1n.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
506e446fb023828ecde7a5f7ce2ecf30b2e7b0bcd42443034a42453fb1d50462
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
32687
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
7977
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"a992a9e939240ce589accf70240bddda"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
smaldone-tweet.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/10/15/28f496cf-7f9c-49a5-93e9-a3a6240bb6e0/thumbnail/70x53/19989d4427540d15c997f730f2441ab2/
1 KB
1 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/10/15/28f496cf-7f9c-49a5-93e9-a3a6240bb6e0/thumbnail/70x53/19989d4427540d15c997f730f2441ab2/smaldone-tweet.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
b0a6dc928fb823a631d75370ab5fe817c74c28601c8a3c36d16e6a0f89df79fa
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
49562
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
1087
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"dd77279f7d325eec933f05b1672f6a1f"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
cameraman-tv-broadcast-station.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/10/14/7161022a-6732-428e-aa76-a00621793acf/thumbnail/70x53/fda1f4ab76b942444ed7333c80b5e994/
5 KB
4 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/10/14/7161022a-6732-428e-aa76-a00621793acf/thumbnail/70x53/fda1f4ab76b942444ed7333c80b5e994/cameraman-tv-broadcast-station.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
8056cc5c66433142afbb70bcb1dd84cabf405a83fe65e249dd96c2d37bd4b1db
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
94259
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4205
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"f720ec3e5486f090fd382b68e230b435"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
/
www.zdnet.com/newsletter/xhr/widget-login/
2 KB
2 KB
XHR
General
Full URL
https://www.zdnet.com/newsletter/xhr/widget-login/?topic=security
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1822-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
8df4e978497b47faa09ff1ce8ca1fb28e040062d10b5487233b44d97766405b2
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
728
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 16 Oct 2019 00:56:41 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
f320bbbc-44b6-4525-96e4-81409a62e3a7
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Wed, 16 Oct 2019 00:56:41 GMT
front-door-carousel-56427878d9-rev.js
zdnet1.cbsistatic.com/fly/js/components/
5 KB
2 KB
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/components/front-door-carousel-56427878d9-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
5ecc6a93ec2939faa8dbf80084346c7d940f5a2181ee69343810da52902eb92d
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
383824
status
200
vary
Accept-Encoding
content-length
1564
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:12 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e3580-124a"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 18 Oct 2019 14:19:37 GMT
urban-airship-29ae327ed0-rev.js
zdnet3.cbsistatic.com/fly/js/components/
1 KB
935 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-29ae327ed0-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
fa33d1db535d783b0baf4e74bdc7ce9e54633f87a03669b2803e567088d64ccb
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
17018
status
200
vary
Accept-Encoding
content-length
827
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:32:12 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da4bf2c-514"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 22 Oct 2019 20:13:03 GMT
advertisement-d41d8cd98f-rev.js
zdnet2.cbsistatic.com/fly/js/utils/
0
103 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/utils/advertisement-d41d8cd98f-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
x-content-type-options
nosniff
age
574455
status
200
vary
Accept-Encoding
content-length
0
x-xss-protection
1; mode=block
last-modified
Mon, 07 Oct 2019 21:09:40 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d9ba994-0"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 16 Oct 2019 09:22:24 GMT
comscore.streaming.6.1.1.171219.min.js
vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/comscore/
104 KB
19 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/comscore/comscore.streaming.6.1.1.171219.min.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
081873caa83744b6d819ab294b08927e20b60841dd8f23a87c2a57e15f65591c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
age
1366311
x-cache
HIT, HIT
status
200
content-length
18881
x-amz-id-2
neN7zmXGABIZIsD8sbebZF9DlZwNnRoW8FayLQeAr6iI61AA4xefpinkv4fSD61J73FNfhwdnmU=
x-served-by
cache-dca17772-DCA, cache-hhn4049-HHN
last-modified
Fri, 01 Feb 2019 18:21:03 GMT
server
AmazonS3
x-timer
S1571187401.228042,VS0,VE0
etag
"c3c30c0ebfc35a9426296256fc3133d8"
vary
Accept-Encoding
x-amz-request-id
2141EBE8710B207D
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
173, 11
cs.js
sb.scorecardresearch.com/c2/3005086/
0
400 B
Script
General
Full URL
https://sb.scorecardresearch.com/c2/3005086/cs.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.43.201909161811
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:41 GMT
Content-Encoding
gzip
Last-Modified
Fri, 08 Apr 2011 23:11:26 GMT
ETag
"d41d8cd98f00b204e9800998ecf8427e:1349196464"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=259200
Connection
keep-alive
Content-Length
20
Expires
Sat, 19 Oct 2019 00:56:41 GMT
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=3005086&ns__t=1571187401233&ns_c=UTF-8&c8=Hacker%20backdoors%20popular%20JavaScript%20library%20to%20steal%20Bitcoin%20funds%20%7C%20ZDNet&c7=https%3A%2F%...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1571187401233&ns_c=UTF-8&c8=Hacker%20backdoors%20popular%20JavaScript%20library%20to%20steal%20Bitcoin%20funds%20%7C%20ZDNet&c7=https%3A%2F...
0
248 B
Image
General
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1571187401233&ns_c=UTF-8&c8=Hacker%20backdoors%20popular%20JavaScript%20library%20to%20steal%20Bitcoin%20funds%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&c9=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:41 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1571187401233&ns_c=UTF-8&c8=Hacker%20backdoors%20popular%20JavaScript%20library%20to%20steal%20Bitcoin%20funds%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&c9=
Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:41 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
/
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/
60 KB
15 KB
Script
General
Full URL
https://zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_3xeBFJDuSs0SRW5&Q_LOC=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.43.201909161811
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
78f602a77cadacf7f6825a039e9e0e8901e42ea5c674837351ce82d5f58b7dea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
79980
cf-polished
origSize=62065
status
200
edge-control
max-age=604800
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-bgj
minify
server
cloudflare
x-powered-by
Express
etag
W/"f271-hRKxnJl0+9aHAqBR1SrTUAe+RRE"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=60, s-maxage=604800
cf-ray
52661309ea502742-FRA
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
m
secure-us.imrworldwide.com/cgi-bin/
Redirect Chain
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/&rp=&ts=compact&rnd=157118...
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/&rp=&ts=compact&rnd=157118...
44 B
332 B
Image
General
Full URL
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/&rp=&ts=compact&rnd=1571187401234&ja=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.17.222.87 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-17-222-87.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 00:56:41 GMT
server
nginx
status
200
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin
*
cache-control
no-cache
content-type
image/gif
content-length
44
expires
Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 16 Oct 2019 00:56:41 GMT
server
nginx
status
302
location
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/&rp=&ts=compact&rnd=1571187401234&ja=1
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin
*
cache-control
no-cache
content-length
0
expires
Thu, 01 Dec 1994 16:00:00 GMT
fbevents.js
connect.facebook.net/en_US/
105 KB
23 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
0629946fe142c676784daa479fe86526051bfa44bdeb5e3f4608fa22b8e153ae
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
content-length
23413
x-xss-protection
0
pragma
public
x-fb-debug
mHSdUgvXjUsxl/ljPBrji+ZpjJHlCfRnkEagVffoMeB6CYg0chM8QQgAf4RoK69+8+DQXP0qcH0F4rmh9yPPaw==
x-fb-trip-id
136226023
x-frame-options
DENY
date
Wed, 16 Oct 2019 00:56:41 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
cbs_zQTp2H_zdnet.js
cdn-magiclinks.trackonomics.net/client/static/v2/
95 KB
18 KB
Script
General
Full URL
https://cdn-magiclinks.trackonomics.net/client/static/v2/cbs_zQTp2H_zdnet.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1810.js?utv=ut4.43.201909161811
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:4200:1d:8c8c:47c0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
Apache/2.4.34 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.8 /
Resource Hash
6b58782f772eaeb73d36b47159ed802f146182cf5d8fe4cfd838e6e629e6bd1a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 15 Oct 2019 01:22:40 GMT
content-encoding
gzip
last-modified
Thu, 10 Oct 2019 06:53:39 GMT
server
Apache/2.4.34 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.8
age
84798
status
200
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
access-control-allow-origin
*
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
9HAoqSA-pdQldn4SCG2DgPZTbpbFGXui_kA3nMcn6F34FwHLdom6mw==
via
1.1 04ce5a607a98db6d08257633417b84d7.cloudfront.net (CloudFront)
4083-12969.js
www.everestjs.net/dl/4083/
484 B
664 B
Script
General
Full URL
https://www.everestjs.net/dl/4083/4083-12969.js
Requested by
Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.90.90 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a184-31-90-90.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:41 GMT
Content-Encoding
gzip
Last-Modified
Mon, 25 Nov 2013 14:23:10 GMT
Server
Apache
ETag
"4a5a49-1e4-4ec011a776f80"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=68999
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
288
Expires
Wed, 16 Oct 2019 20:06:40 GMT
v
pixel.everesttech.net/4083/
128 B
716 B
Image
General
Full URL
https://pixel.everesttech.net/4083/v?ev___loc=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&ev___ref=%2F%2F
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:41 GMT
Last-Modified
Wed, 19 Oct 2016 22:11:25 GMT
Server
Apache
ETag
"1433c2-80-53f3f17013d40"
Vary
Cookie
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/png
Keep-Alive
timeout=15, max=999603
Content-Length
128
1x1
pixel.everesttech.net/
Redirect Chain
  • https://cm.everesttech.net/cm
  • https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WGFacXlRQUFCU0ljMUFvSA
  • https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEL5jZHKCyv32x1aoYUhpRI8&google_cver=1
  • https://pixel.everesttech.net/1x1
128 B
407 B
Image
General
Full URL
https://pixel.everesttech.net/1x1
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:41 GMT
Last-Modified
Wed, 19 Oct 2016 22:11:25 GMT
Server
Apache
ETag
"1433c2-80-53f3f17013d40"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=999601
Content-Length
128

Redirect headers

Date
Wed, 16 Oct 2019 00:56:41 GMT
Server
AMO-cookiemap/1.1
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location
https://pixel.everesttech.net/1x1
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=15,max=100
Content-Length
0
checkra1n.png
zdnet4.cbsistatic.com/hub/i/r/2019/10/15/df65fa06-099d-400a-8f67-07622a56c4fc/thumbnail/70x53/c9339508441bfb11e66a4da2f5a47aa6/
8 KB
8 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/10/15/df65fa06-099d-400a-8f67-07622a56c4fc/thumbnail/70x53/c9339508441bfb11e66a4da2f5a47aa6/checkra1n.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1822-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
506e446fb023828ecde7a5f7ce2ecf30b2e7b0bcd42443034a42453fb1d50462
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
32687
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
7977
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"a992a9e939240ce589accf70240bddda"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
ima3.js
s0.2mdn.net/instream/html5/
271 KB
92 KB
Script
General
Full URL
https://s0.2mdn.net/instream/html5/ima3.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
0e581297b1902f5a598a760e1e4b864b0178db76b0ac86f4712d001a58d397ec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
93961
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:41 GMT
feature-disabled-d41d8cd98f-rev.js
zdnet3.cbsistatic.com/fly/js/
0
162 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/feature-disabled-d41d8cd98f-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
x-content-type-options
nosniff
age
24356
status
200
vary
Accept-Encoding
content-length
0
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:32:12 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5da4bf2c-0"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 22 Oct 2019 18:10:45 GMT
smaldone-tweet.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/10/15/28f496cf-7f9c-49a5-93e9-a3a6240bb6e0/thumbnail/70x53/19989d4427540d15c997f730f2441ab2/
1 KB
1 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/10/15/28f496cf-7f9c-49a5-93e9-a3a6240bb6e0/thumbnail/70x53/19989d4427540d15c997f730f2441ab2/smaldone-tweet.jpg
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1822-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
b0a6dc928fb823a631d75370ab5fe817c74c28601c8a3c36d16e6a0f89df79fa
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
49562
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
1087
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"dd77279f7d325eec933f05b1672f6a1f"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
cameraman-tv-broadcast-station.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/10/14/7161022a-6732-428e-aa76-a00621793acf/thumbnail/70x53/fda1f4ab76b942444ed7333c80b5e994/
5 KB
4 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/10/14/7161022a-6732-428e-aa76-a00621793acf/thumbnail/70x53/fda1f4ab76b942444ed7333c80b5e994/cameraman-tv-broadcast-station.jpg
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1822-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
8056cc5c66433142afbb70bcb1dd84cabf405a83fe65e249dd96c2d37bd4b1db
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
94259
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4205
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"f720ec3e5486f090fd382b68e230b435"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
npm.png
zdnet4.cbsistatic.com/hub/i/r/2019/10/15/54d57679-a8a4-483a-930c-dc701f67334a/thumbnail/70x53/337203aeb802850478c36aa24e050888/
4 KB
4 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/10/15/54d57679-a8a4-483a-930c-dc701f67334a/thumbnail/70x53/337203aeb802850478c36aa24e050888/npm.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1822-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
e4b558a63bcfe3c7a628d50c22d0f9feba81649fa34e284d5de80cc3a93f53bc
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1180
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
3981
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"9ca8c9b0996bbf05ae7753d34667a6fd"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
fly-disqus-count-1f604770a3-rev.js
zdnet2.cbsistatic.com/fly/js/components/
882 B
568 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/fly-disqus-count-1f604770a3-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
b2ab8784d5ca4bc5e4e1990ba55c6d9f041b8fe8cf41ad9afa37bc1c3dd12756
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
153270
status
200
vary
Accept-Encoding
content-length
460
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:12 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d9e3580-372"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 21 Oct 2019 06:22:10 GMT
ua-sdk.min.js
web-sdk.urbanairship.com/notify/v1/
78 KB
17 KB
Script
General
Full URL
https://web-sdk.urbanairship.com/notify/v1/ua-sdk.min.js
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-29ae327ed0-rev.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
35.227.208.151 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
151.208.227.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
e59c8c655db8c097ed0067789aeb44ed58f25f8c68a5772bbb3f1fdc18e5e336

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:52:25 GMT
content-encoding
gzip
x-goog-meta-goog-reserved-file-mtime
1556302399
age
256
x-guploader-uploadid
AEnB2Uqnx_btRiMrfJp5Q-6SdzLRptegRs-s0kIItWjuWGBWd3siPms7BiHyoQRvR2UUDM0WUbn52NUF7MML-q0H2Qf6SZRgMA
x-goog-storage-class
MULTI_REGIONAL
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
16960
last-modified
Fri, 26 Apr 2019 18:13:21 GMT
server
UploadServer
etag
"251defdc0ecc8a3bad8ae4cf9aab1923"
vary
Accept-Encoding
x-goog-hash
crc32c=A7yEjg==, md5=JR3v3A7MijutiuTPmqsZIw==
x-goog-generation
1556302401249893
cache-control
public, max-age=300
x-goog-stored-content-length
16960
accept-ranges
bytes
content-type
application/javascript
expires
Wed, 16 Oct 2019 00:57:25 GMT
z
lightboxapi2.azurewebsites.net/z9l/40913/www.zdnet.com/jsonp/
219 B
505 B
Script
General
Full URL
https://lightboxapi2.azurewebsites.net/z9l/40913/www.zdnet.com/jsonp/z?cb=1571187401273&callback=jQuery17104678823948288011_1571187400302&_=1571187401274
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637057951420142886
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.99.128.52 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
waws-prod-dm1-001.cloudapp.net
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
4dd9331c0388eccbb0cc9be153a68fe514d97028532c20ea7c88deb6a47146fa

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:41 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
Content-Length
292
Vary
Accept-Encoding
Content-Type
application/javascript
z.gif
api1.lightboxcdn.com/z9u/LIewXglgNlCGD0BWAdABgAQApiwMYQDsAXEAZwAsBudASWIFMp0dd0B5AZXQA10BGVAH0-AFkGIAlOgCCAB1lR6AdXoAjANIQiSAMwB2ZDoBsWdQAkAKsAAyAGnRQIAa3roA4vVxOQUgMLkAJxAAW3p4PRE0Qz0AJgBOZD4jOPQO...
183 B
362 B
XHR
General
Full URL
https://api1.lightboxcdn.com/z9u/LIewXglgNlCGD0BWAdABgAQApiwMYQDsAXEAZwAsBudASWIFMp0dd0B5AZXQA10BGVAH0-AFkGIAlOgCCAB1lR6AdXoAjANIQiSAMwB2ZDoBsWdQAkAKsAAyAGnRQIAa3roA4vVxOQUgMLkAJxAAW3p4PRE0Qz0AJgBOZD4jOPQOWAAzWACIXQNjIA__XZX/z.gif
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637057951420142886
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4da5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
dd787044f07fb551657e198707ea27bfddcf6cf53bd6e8bf5efd6322a5273cba

Request headers

Accept
*/*
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
br
cf-cache-status
HIT
age
9139
x-powered-by
ASP.NET
status
200
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin,Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
access-control-allow-credentials
true
cf-ray
5266130a08f48c8c-VIE
expires
Thu, 17 Oct 2019 00:56:41 GMT
309391486091569
connect.facebook.net/signals/config/
281 KB
66 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/309391486091569?v=2.9.6&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
e9861478977dbf62d4a69be6936c96a1534a62caf67dcd476299ab89fe0c9f19
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-fb-trip-id
136226023
pragma
public
x-fb-debug
s08pw61+IH4+1gFDIlV7jBXblm7q+YVY+MgeCsat5idCYZDLOjX7yNpx1gTZuRPKYIhK3m2VmWeDy1BkcG/zAQ==
content-encoding
gzip
x-content-type-options
nosniff
x-frame-options
DENY
date
Wed, 16 Oct 2019 00:56:41 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
status
200
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
vary
Accept-Encoding
x-xss-protection
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
show-hide-1.0-7dc26ff326-rev.js
zdnet3.cbsistatic.com/fly/js/components/
2 KB
819 B
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/show-hide-1.0-7dc26ff326-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f92514f4e39c16da9037f964148a09a79419744b77d611860ffc81c86aeace0a
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
485331
status
200
vary
Accept-Encoding
content-length
710
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:13 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e3581-7a5"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 17 Oct 2019 10:07:50 GMT
/
www.google.de/pagead/1p-user-list/1036174608/
Redirect Chain
  • https://www.googleadservices.com/pagead/conversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&amp;guid=ON&amp;script=0
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&amp;guid=ON&amp;script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=yWqmXYSdE4zC7g...
  • https://www.google.com/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=413568637&crd=&is_vtc=1&random=3396060450
  • https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=413568637&crd=&is_vtc=1&random=3396060450&ipr=y
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=413568637&crd=&is_vtc=1&random=3396060450&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 00:56:41 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 16 Oct 2019 00:56:41 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
content-type
image/gif
location
https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=413568637&crd=&is_vtc=1&random=3396060450&ipr=y
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
ad.yieldmanager.com/
0
341 B
Image
General
Full URL
https://ad.yieldmanager.com/pixel?id=2447099&t=2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1288:110:c305::9000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:41 GMT
X-Content-Type-Options
nosniff
Server
ATS
Age
0
Expect-CT
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security
max-age=31536000
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
s
pixel.everesttech.net/4083/
128 B
716 B
Image
General
Full URL
https://pixel.everesttech.net/4083/s?s=12969
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:41 GMT
Last-Modified
Wed, 19 Oct 2016 22:11:25 GMT
Server
Apache
ETag
"443742-80-53f3f17013d40"
Vary
Cookie
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/png
Keep-Alive
timeout=15, max=998910
Content-Length
128
count.js
zdnet-1.disqus.com/
1 KB
1 KB
Script
General
Full URL
https://zdnet-1.disqus.com/count.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:46 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Age
634892
P3P
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
871
X-XSS-Protection
1; mode=block
Last-Modified
Tue, 01 Oct 2019 21:53:32 GMT
Server
nginx
ETag
"5d93cadc-367"
Strict-Transport-Security
max-age=300; includeSubdomains
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, max-age=300
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
/
0211c83c.akstat.io/
0
354 B
Other
General
Full URL
https://0211c83c.akstat.io/
Requested by
Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.32.243.235 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-32-243-235.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:41 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Wed, 16 Oct 2019 00:56:41 GMT
VideoHeartbeat-2.0.2.min.js
vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/
143 KB
29 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e08209b44a15fd9f6b9977d2580034e8d3da36542235802c2722ff8db4c0a461

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
age
2159094
x-cache
HIT, HIT
status
200
content-length
28977
x-amz-id-2
+2U9dXma+eMS0pCyjOsjSQxM2XeIVTtFChnnV0tNV/KxKbDrO0L+Wu3OXPxKg3U2iN4g4fPtx3Y=
x-served-by
cache-dca17740-DCA, cache-hhn4049-HHN
last-modified
Fri, 01 Feb 2019 18:21:02 GMT
server
AmazonS3
x-timer
S1571187401.345100,VS0,VE0
etag
"215943f0e77b4fcc9cc72b98a8ea1cfc"
vary
Accept-Encoding
x-amz-request-id
B56B3145A1D646B8
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
162, 11
bcn
www.summerhamster.com/
43 B
181 B
Image
General
Full URL
https://www.summerhamster.com/bcn?fe=1571187401344&y=2.0.1105&elg=250607805&flg=68&x=zzz.cgqhw.frp%2Fduwlfoh%2Fkdfnhu-edfngrruv-srsxodu-mdydvfulsw-oleudub-wr-vwhdo-elwfrlq-ixqgv%2F&vqwo=1&deo=0&g0=vg%3A%3Aer%2Cxd%3A%3Aqexd%3A%3Aqsu%7Cvg%3A%3Ask%3A%3Aqsk%3A%3Aqsu%7Cgisl%3A%3Alp%2Clqi%2Cqh%3A%3Aqoe%3A%3Aqsu%3A%3Axuo%3D%2F%2Fdg.grxeohfolfn.qhw%2Fggp%2Fdg%2Fmtwfbck%2Fxbtxiz%2Fnpsru%2Fwqz%2F%3Brug%3D1571187399933%3F%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cddg%2Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.des_re_halvw%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Csu%3A%3Aid%3A%3Aquiv%3A%3Aqsu&hu=0&g2=0%3A%3A0%3A%3A0%3A%3A0%3A%3A0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.28.51.75 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-28-51-75.eu-central-1.compute.amazonaws.com
Software
Jetty(9.2.10.v20150310) /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Wed, 16 Oct 2019 00:56:41 GMT
server
Jetty(9.2.10.v20150310)
access-control-allow-origin
*
content-length
43
access-control-allow-methods
*
content-type
image/gif
/
www.facebook.com/tr/
44 B
248 B
Image
General
Full URL
https://www.facebook.com/tr/?id=309391486091569&ev=PageView&dl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&rl=&if=false&ts=1571187401374&sw=1600&sh=1200&v=2.9.6&r=stable&a=tmtealium&ec=0&o=30&fbp=fb.1.1571187401373.1720240756&it=1571187401282&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
content-length
44
expires
Wed, 16 Oct 2019 00:56:41 GMT
AppMeasurement-2.3.0.min.js
vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/
77 KB
27 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/AppMeasurement-2.3.0.min.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4974c54f5183f50fd1f3c3d49c496fd79602f8159b6d393d3fab09e4433555dd

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
age
776432
x-cache
HIT, HIT
status
200
content-length
27260
x-amz-id-2
kLgdw2sQfzW8EBCh5gIdAjguNFSLxkDKLDKkIhVUuGHzfy43GfeyKZQFej1nTwA00aYX5B/mtiI=
x-served-by
cache-dca17775-DCA, cache-hhn4049-HHN
last-modified
Fri, 01 Feb 2019 18:21:02 GMT
server
AmazonS3
x-timer
S1571187401.381001,VS0,VE0
etag
"d71ba6c9a930b6864408830c3e2705f9"
vary
Accept-Encoding
x-amz-request-id
C7320C852C9DB622
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
16, 12
config.json
c.go-mpulse.net/api/v2/
2 KB
1 KB
XHR
General
Full URL
https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1571187401386&s=8d525f2043f4af1bb6ff28fa05c89abb188b1bf9e3159d49ee51c137b55cb5b0
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.32.243.235 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-32-243-235.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
af8c2376edddd95dc21bdcc85a22c52e4ade7196ef311c0053bc16bc10ab38f8

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:41 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
735
ads
securepubads.g.doubleclick.net/gampad/
134 KB
25 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1521057445033877&correlator=4308186782980222&output=ldjh&impl=fifs&adsid=NT&eid=21062415%2C21062818&vrg=2019100301&guci=1.2.0.0.2.2.0.0&plat=1%3A536903688%2C2%3A536903688%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20191016&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=7x7%7C5x5%2C1x1%2C728x90%7C970x66%7C970x250%2C300x250%7C300x600%7C300x1050%2C300x250%2C300x250%2C728x90%7C970x66%7C970x250%2C371x771&ists=64&prev_scp=pos%3Dnav%7C%7Cpos%3Dtop%7Cpos%3Dtop%7Cpos%3Dmiddle%7Cpos%3Dbottom%7Cpos%3Dbottom%7Cpos%3Dtop&eri=1&cust_params=buyingcycle%3Ddiscover%26topic%3Dsecurity%252Copen-source%252Cdeveloper%26tag%3Dbitcoin%252Ctarget%26mfr%3Dbitcoin%26prodtype%3Dprojection%252Cpackaging%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%26env%3Dprod%26firstpg%3D1%26vguid%3D2713c768-4b09-44e9-b2cd-eda8443c4c92%26session%3Dg%26subses%3D5&cookie_enabled=1&bc=31&abxe=1&lmt=1571187401&dt=1571187401429&dlt=1571187399651&idt=408&frm=20&biw=1585&bih=1200&oid=3&adxs=-12245933%2C0%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933&adys=-12245933%2C87%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933&adks=367244727%2C3949122752%2C2607015740%2C3564425803%2C1996480139%2C3354405643%2C3136553998%2C4222694796&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&dssz=94&icsg=0&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x4177%7C1585x0%7C1585x0%7C370x0%7C370x0%7C370x250%7C1210x0%7C370x0&msz=7x7%7C1585x0%7C688x105%7C300x280%7C300x280%7C300x280%7C728x130%7C371x771&ga_vid=1407702978.1571187401&ga_sid=1571187401&ga_hid=2052576964&fws=132%2C4%2C132%2C132%2C132%2C132%2C132%2C132&ohw=1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
2e7b0ab8cd79e6f2e704e000185d40a8f0601c8f0464a02ad6f6a700d8c8a079
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
24624
x-xss-protection
0
google-lineitem-id
4745699004,-2,5192378298,5192378298,-1,253246569,241984809,4825966980
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138239468890,-2,138290557510,138290277353,-1,138271735246,138271463474,138247024569
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
x-google-amp-ad-validated-version
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2019100301.js
securepubads.g.doubleclick.net/gpt/
63 KB
24 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
sffe /
Resource Hash
33e7cfb629c6fc28bec6f0039c2b843ac7d63cb54a883599ca33ce2384e251fa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 03 Oct 2019 13:06:21 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
24653
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:41 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

headerstats
as-sec.casalemedia.com/
0
337 B
XHR
General
Full URL
https://as-sec.casalemedia.com/headerstats?s=182823&u=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&v=3
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:41 GMT
Server
Apache
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Wed, 16 Oct 2019 00:56:41 GMT
ggcmb510.js
cdn-gl.imrworldwide.com/novms/js/2/
12 KB
5 KB
Script
General
Full URL
https://cdn-gl.imrworldwide.com/novms/js/2/ggcmb510.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:7e00:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f68ec7cf550e86cb14e4d992724157c4f625ea3f0cd7d06e9e533c17c735401d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
7mioloFf72U0Qkc4Taa4MD_zEyvZEgsP
content-encoding
gzip
last-modified
Tue, 10 Sep 2019 15:40:32 GMT
server
AmazonS3
age
4116
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=86400
date
Wed, 16 Oct 2019 00:18:26 GMT
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
WXS41lA5gea1kV-O54jbjjX5eiK1L8n4E1y8RcIkMFw_aQJlgdDN3g==
via
1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
mux.js
vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/
81 KB
25 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/mux.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e812da2f13362e348f887e6eb8361bc247f6d043588aa436df4c64e4bd04e7f7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
age
1793449
x-cache
HIT, HIT
status
200
content-length
25193
x-amz-id-2
TGcpi0DTUixP906ah+mUc5NccBcsisIooRo5Bctp8JdEs70Aa2+LP6DbaRc35WRNcZSF0h29Qqw=
x-served-by
cache-dca17731-DCA, cache-hhn4049-HHN
last-modified
Fri, 01 Feb 2019 18:21:06 GMT
server
AmazonS3
x-timer
S1571187402.506573,VS0,VE0
etag
"5d69e0e991739e9cd3f544944c8b3739"
vary
Accept-Encoding
x-amz-request-id
22D38B7EB978846A
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
169, 11
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
715 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
uvp_blank.mp4
vidtech.cbsinteractive.com/h5/blanks/
11 KB
11 KB
Media
General
Full URL
https://vidtech.cbsinteractive.com/h5/blanks/uvp_blank.mp4
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6227f18e898e5b7c708fc1eb1763bd1b2186bdecd6f8b81f4bc1bf84f4d7d4e6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range
bytes=0-

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
via
1.1 varnish, 1.1 varnish
age
2398596
x-cache
HIT, HIT
status
206
x-cache-hits
558763, 19981
Content-Length
11247
x-amz-id-2
RWSuYoveoPlVL8+CKVrvoJOxvT/jZR2ccK055Pg68MOkg2YkaejHy+1cH72KSfRTxtYrLSmSGpM=
x-served-by
cache-dca17731-DCA, cache-hhn4049-HHN
Content-Range
bytes 0-11246/11247
last-modified
Fri, 21 Dec 2018 00:54:05 GMT
server
AmazonS3
x-timer
S1571187402.540367,VS0,VE0
etag
"707bb2a4c9141aba1068d851f5be0409"
x-amz-request-id
4F6B1AEF2D270DCA
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
video/mp4
x-amz-meta-mtime
1296432000
glcfg510.js
cdn-gl.imrworldwide.com/novms/js/2/configs/
2 KB
1 KB
Script
General
Full URL
https://cdn-gl.imrworldwide.com/novms/js/2/configs/glcfg510.js
Requested by
Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/ggcmb510.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:7e00:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
acf3b5b3ade1391096f23120b725a032dce430448ba8aff2a6f0c3f9c598b2a3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
ZJiEbv2M481M7rFnKGpdF6EvgKpUMdZ4
content-encoding
gzip
last-modified
Thu, 10 Oct 2019 14:18:42 GMT
server
AmazonS3
age
3310
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=86400
date
Wed, 16 Oct 2019 00:26:12 GMT
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
LJgp63pmAxdMEBPEg-oQeLFVL5JQok5p_tLB6gdjnyOxLQ2LosuFCQ==
via
1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
id
dpm.demdex.net/
2 KB
2 KB
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&d_mid=67792456393505865770038177176228707028&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%012ED3356405158000-400F2721603365D6&d_cid_ic=userId%01&d_cid_ic=puuid%01&ts=1571187401561
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/AppMeasurement-2.3.0.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.241.149.220 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-241-149-220.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ccef1976013530f24afb6071e29f518d5679927531631712734f0c06c8742aa9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v047-09beb2159.edge-irl1.demdex.com 5.60.0.20191014092846 5ms (+0ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
X-Error
300,300
X-TID
C+z2NLu2TC0=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
675
Expires
Thu, 01 Jan 1970 00:00:00 GMT
truncated
/
9 KB
9 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c872580af551ba7c07a453c4a0b45a1ca614e3246afe7fc08f7bf2c7de4bd0b6

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin
https://www.zdnet.com

Response headers

Content-Type
application/font-woff;charset=utf-8
bridge3.342.1_en.html
imasdk.googleapis.com/js/core/ Frame 9F11
0
0
Document
General
Full URL
https://imasdk.googleapis.com/js/core/bridge3.342.1_en.html
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/instream/html5/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
imasdk.googleapis.com
:scheme
https
:path
/js/core/bridge3.342.1_en.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
193054
date
Tue, 15 Oct 2019 19:51:01 GMT
expires
Wed, 14 Oct 2020 19:51:01 GMT
last-modified
Tue, 15 Oct 2019 16:39:09 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
18340
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
client.js
s0.2mdn.net/instream/video/
26 KB
10 KB
Script
General
Full URL
https://s0.2mdn.net/instream/video/client.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/instream/html5/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
10523
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:41 GMT
/
www.zdnet.com/video/related-videos-xhr/university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme/
34 KB
6 KB
XHR
General
Full URL
https://www.zdnet.com/video/related-videos-xhr/university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1822-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
4f0d370e63829a91c62eb3146b33244d039125fe2636014c5d1ea63e5da077f6
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
5523
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 16 Oct 2019 00:56:42 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 16 Oct 2019 00:56:42 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
61a34930-1a20-44ae-9a8f-0ec26ecb9535
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Wed, 16 Oct 2019 02:26:42 GMT
36A8CE_2_0.woff2
vidtech.cbsinteractive.com/uvpjs/0.42.297/css_assets/
53 KB
54 KB
Font
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/0.42.297/css_assets/36A8CE_2_0.woff2
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
02f3b82bf48c364a56b75c12695031ce9fa6dbc0e39af44b677d65bab6fe90fd

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
via
1.1 varnish, 1.1 varnish
age
358926
x-cache
HIT, HIT
status
200
content-length
54767
x-amz-id-2
MB4kz71c4pCgKqmbxlPCRwopnXgRkM+K6PNPBZydd9jschWqEK3QWyQXFkKNxNrVPNecOxrwKKc=
x-served-by
cache-dca17720-DCA, cache-hhn4075-HHN
last-modified
Fri, 01 Feb 2019 18:20:56 GMT
server
AmazonS3
x-timer
S1571187402.630630,VS0,VE0
etag
"22d779c809ed11e380d62c76e1f202e8"
access-control-max-age
3600
x-amz-request-id
3ADB3AE2E6D210C6
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
binary/octet-stream
x-cache-hits
157, 8961
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=video%40zdnet.com&g=65713&p=%2Fvideo%2Fmanifest%2Funiversity-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme.m3u8&i=University%20forced%20to%20shut%20down%20network%20to%20stop%20Bitcoin%20mining%20scheme&g0=security&g1=catalin%20cimpanu&u=B40IB0BGUCd0Dx0PTI&t=DZ-AVqC2QR6JDOKktDD1XDxKBDWApr&x=0&y=0&V=116&VS=VS&n=1&b=3503&r=&_vd=46000&_vi=Hacker%20backdoors%20popular%20JavaScript%20library%20to%20steal%20Bitcoin%20funds%20%7C%20ZDNet&_vp=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&_vh=zdnet.com&_pu=DvWRf3UzokkBiMKZL&_pt=CwhrkWC4-rpXl9-DyDTeLs_Die8I&_pr=&_vdd=zdnet.com&_vt=ct&_vs=s1&_vcs=0&_vvs=0&_vpt=0&_vaup=man&_vplt=0.42.297&_vce=0&c=0&W=0&R=0&I=1&E=0&j=75&tz=-120&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.86.231.246 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-231-246.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Wed, 16 Oct 2019 00:56:41 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
PF7B87067-BF4D-F80F-E040-070AAD316CE6.js
cdn-gl.imrworldwide.com/conf/
41 KB
8 KB
Script
General
Full URL
https://cdn-gl.imrworldwide.com/conf/PF7B87067-BF4D-F80F-E040-070AAD316CE6.js
Requested by
Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/configs/glcfg510.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:7e00:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
420203ca7b0395ca062903c765b681e27062360484f8274a389461e4a4a071d6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
h6vUD0w3qBUsDiAOZIJHl73TXD82poNU
content-encoding
gzip
last-modified
Tue, 01 Oct 2019 04:36:23 GMT
server
AmazonS3
age
3245
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=86400,s-maxage=86400
date
Wed, 16 Oct 2019 00:02:37 GMT
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
uIYrKM6PUEhWVNODoRlMWTwAZPJYKy5QPFGwa12OhBbTzZs6DQ10bA==
via
1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
nlsSDK600.bundle.min.js
cdn-gl.imrworldwide.com/novms/js/2/
161 KB
46 KB
Script
General
Full URL
https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Requested by
Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/conf/PF7B87067-BF4D-F80F-E040-070AAD316CE6.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:7e00:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
787b34ffd7cd823938ab8b1f40b6651327291f1b00540438e3b291d6882ee360

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
z3RpiFEb4FORg3Dvu1Sq02u.JgvOcWP1
content-encoding
gzip
last-modified
Tue, 15 Oct 2019 14:09:42 GMT
server
AmazonS3
age
2801
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=86400
date
Wed, 16 Oct 2019 00:12:29 GMT
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
8rZdDs9Z7UtS8WynoolvNT4sNWXS1IocYXoKwFz03y9OQ2tWkrrxBg==
via
1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
ls.html
cdn-gl.imrworldwide.com/novms/html/ Frame CD37
0
0
Document
General
Full URL
https://cdn-gl.imrworldwide.com/novms/html/ls.html
Requested by
Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:7e00:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

:method
GET
:authority
cdn-gl.imrworldwide.com
:scheme
https
:path
/novms/html/ls.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
accept-encoding
gzip, deflate, br
cookie
IMRID=752e258a-328f-4e2e-b730-f07927e565db
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/

Response headers

status
200
content-type
text/html
last-modified
Tue, 10 Sep 2019 15:40:31 GMT
x-amz-server-side-encryption
AES256
x-amz-version-id
uAbI7PyDqpdaBfF0dOR8YxPk4jP3l6SI
server
AmazonS3
content-encoding
gzip
date
Wed, 16 Oct 2019 00:45:51 GMT
cache-control
max-age=86400
vary
Accept-Encoding
x-cache
Hit from cloudfront
via
1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
Ne5EY1kCf3bRx3icWMSlmxSGhTbplYeeuohLYzXvPBDZ4utK01KAIg==
age
1071
/
www.facebook.com/tr/
0
48 B
Other
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundarySgvFEGzVAAiembUd

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
server
proxygen-bolt
date
Wed, 16 Oct 2019 00:56:41 GMT
status
200
content-type
text/plain
access-control-allow-origin
https://www.zdnet.com
access-control-allow-credentials
true
content-length
0
view
securepubads.g.doubleclick.net/pcs/ Frame F652
0
66 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstNa9nu0W34ou_M0dRilwv1U_SHg6NAj3EMs_2eExWvostdUedYksA-P-nCA5vwy5Xe8Bbfnv4R5uEEUrMlRaq3Se90Rl2BDfOWOFc7vvGxlPblUTind52BHl7aliZBLkQQfUrYX_NM5B9z-TUrLYNCdGFTnHU9cAOe2wEAsHsYzVmil42E902fULZVGx8i1VgouQf1yII266N10qv_LzPQvzvSjdLUHGaZf9pKEn9ST5u75rnPho2vovIv-GpxVncbY1FpApNC&sig=Cg0ArKJSzN4wzNu1EaDEEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 00:56:41 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame F652
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29551
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:41 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame F652
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:41 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=44637
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
osd.js
www.googletagservices.com/activeview/js/current/
77 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f425f66d90f1150499b36ab47b56fa6fb1a68136e4f42befca20a920ff85306b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29055
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:41 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 5417
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss-YXj4p1cUFmlFif-n_PYlLGjF5hKkV7wgIYBP6yFdr9B-CNM1EubPSR9db4WpasGMqIw5O50aqXFeeFnih0IuD2UXSx-m6jSLN1lggvdPV6voFGlQH9bK6GOVUUMaKuaN1t1rKWdGXeRKPnd1ie5i8vzeHKlnKyPyWTHsVOAqXZNEODkJw8mJmBel2wxnCsVMzLPN2SpCNVMsfZLkfwX3T3616E_niap0wf2ra229Qz-rYeDrcrmcVoZqaLRlkDMMUPpkvYGXjN4blw&sig=Cg0ArKJSzNftCcK0T8y2EAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 00:56:41 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 5417
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29551
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:41 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 5417
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:41 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=44637
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
view
securepubads.g.doubleclick.net/pcs/ Frame BFC5
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvuERxLZPyfwANm-LYRnsejMusPkm9uQGUutzpzmQUV4lqFFTb_2a-1BE3qhI5OEhLkW6cmcPG5YIF4iZ0d9Y7bY5y7ZGCBKdS7L4epz4yCbO8SINLEaqBlG0hFzrwMQKG0JRLQRPDLJQC-ecx0qVMlAWkqAV9fpjNfkds1gqpVueSFAgUsnE1IeOToqpI3Q2VDKf-G5O1CYXC5NKlLg0fzA9VE-jQQ0M_ZeRusuMXy0tXQtO8HZawRmVUIOaJYjfZuHkUFYM7rlZ5h6w&sig=Cg0ArKJSzCpyJxqpskjNEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 00:56:41 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame BFC5
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29551
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:41 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame BFC5
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:41 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=44637
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
amp4ads-host-v0.js
cdn.ampproject.org/rtv/011909241711100/
20 KB
7 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/011909241711100/amp4ads-host-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
37a8b06eab08134f2037c797f4596c7688dd564a8395cb7e072577f371d8f993
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding
br
etag
"beb093e69c81d951"
age
371071
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
7119
x-xss-protection
0
server
sffe
date
Fri, 11 Oct 2019 17:52:10 GMT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-content-type-options
nosniff
expires
Sat, 10 Oct 2020 17:52:10 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/011909241711100/ Frame CE62
252 KB
69 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/011909241711100/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
6d157866400e2e50e077448f9cf06a9f29f70e031612ad6679d3626909a4c4e5
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding
br
etag
"96c1a383c63a0e85"
age
470018
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
70044
x-xss-protection
0
server
sffe
date
Thu, 10 Oct 2019 14:23:03 GMT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-content-type-options
nosniff
expires
Fri, 09 Oct 2020 14:23:03 GMT
amp-ad-exit-0.1.js
cdn.ampproject.org/rtv/011909241711100/v0/ Frame CE62
15 KB
5 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/011909241711100/v0/amp-ad-exit-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4a9174ab8670879484f0dc42afea0ccaa3803217a9700ef9e1fb8262aa68c651
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding
br
etag
"047aa8cc2c1326e6"
age
370395
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
5411
x-xss-protection
0
server
sffe
date
Fri, 11 Oct 2019 18:03:26 GMT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-content-type-options
nosniff
expires
Sat, 10 Oct 2020 18:03:26 GMT
amp-analytics-0.1.js
cdn.ampproject.org/rtv/011909241711100/v0/ Frame CE62
150 KB
40 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/011909241711100/v0/amp-analytics-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
197c294e1520b32d787d2678660c02fd195c1c93fee3441de596ef22c34ed425
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding
br
etag
"31e12d286572e15e"
age
619360
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
40838
x-xss-protection
0
server
sffe
date
Tue, 08 Oct 2019 20:54:01 GMT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-content-type-options
nosniff
expires
Wed, 07 Oct 2020 20:54:01 GMT
amp-fit-text-0.1.js
cdn.ampproject.org/rtv/011909241711100/v0/ Frame CE62
3 KB
1 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/011909241711100/v0/amp-fit-text-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f6460a62bcb64a288196db0162ebd1ea5e2bbc95b3725ed6ca7c08eed129d767
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding
br
etag
"4547d0ff209c44ea"
age
490445
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
1388
x-xss-protection
0
server
sffe
date
Thu, 10 Oct 2019 08:42:36 GMT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-content-type-options
nosniff
expires
Fri, 09 Oct 2020 08:42:36 GMT
amp-form-0.1.js
cdn.ampproject.org/rtv/011909241711100/v0/ Frame CE62
43 KB
14 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/011909241711100/v0/amp-form-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b801741390d0087dafca6ddd145ead69628e42ed4e3a4e0a662c96bac969e6fe
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding
br
etag
"098505ab236e9001"
age
538469
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
13920
x-xss-protection
0
server
sffe
date
Wed, 09 Oct 2019 19:22:12 GMT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-content-type-options
nosniff
expires
Thu, 08 Oct 2020 19:22:12 GMT
css
fonts.googleapis.com/ Frame CE62
7 KB
737 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
2c459af038b187354a6342ef343b41451f024d3791bb4456c68d998ed9027ec9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 16 Oct 2019 00:56:41 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Wed, 16 Oct 2019 00:56:41 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:41 GMT
17588804266547201531
tpc.googlesyndication.com/daca_images/simgad/ Frame CE62
48 KB
48 KB
Image
General
Full URL
https://tpc.googlesyndication.com/daca_images/simgad/17588804266547201531
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
d93075b1032a4aafe288899e4dcbe046028f20ec78595728c4650f928a6b9b72
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 10 Oct 2019 08:28:56 GMT
x-content-type-options
nosniff
age
491265
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
48944
x-xss-protection
0
last-modified
Sat, 05 Oct 2019 12:05:49 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 09 Oct 2020 08:28:56 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/8578129967820296872/ Frame CE62
3 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/8578129967820296872/downsize_200k_v1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
dd67767c31dc810b77952c560b17434acdcf7037101f63d20994ae7960ea5076
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 10 Oct 2019 08:40:53 GMT
x-content-type-options
nosniff
age
490548
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
3096
x-xss-protection
0
last-modified
Tue, 08 Jan 2019 00:33:08 GMT
server
sffe
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 09 Oct 2020 08:40:53 GMT
truncated
/ Frame CE62
221 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ Frame CE62
214 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
47fde6978580115677071d003782c9dd6c3d5b66ce77b13d29d1d0f4e0b2db45

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
view
securepubads.g.doubleclick.net/pcs/ Frame 049F
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsunmqZCZ4NMQOSWS4nJNJUDttqZ7slnEsVG_GD-FmgqyKX7e3AgaVY3GWjQmqJ5J_OlMSvWDDmArxSjIaJ2-mcsU-TW3ibsrac17nQp_npSQ9AEWCCSVCTuncL3rpzlxnN9bHEwDWfJSazozpCoc8Q13I2D8PW8uGfUiMg1wQjwXXBR0he2Ndq8v5Hx9-iYQM-zJt7AAMNU5Oi0Gh5uPcgSUsgPRDUUBsnSq57Kow734ng8t4oXAXqnsnbVJ7etSbwg-A4&sig=Cg0ArKJSzC0GgIPa-JxNEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 00:56:41 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
9818.js
ads.rubiconproject.com/ad/ Frame 049F
26 KB
8 KB
Script
General
Full URL
https://ads.rubiconproject.com/ad/9818.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.38.84 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-38-84.deploy.static.akamaitechnologies.com
Software
Apache / PHP/5.3.3
Resource Hash
d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:41 GMT
Content-Encoding
gzip
Server
Apache
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=8838
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
7558
Expires
Wed, 16 Oct 2019 03:23:59 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 049F
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29551
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:41 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 049F
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:41 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=44637
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
view
securepubads.g.doubleclick.net/pcs/ Frame 01DE
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss88tzWhJlamnNhA6YJoMM5hqquoSEce3f570lDfOyCDjUxbF7CtjV1sqMTqJba0seviyKS8SBLNQY00v8CNwvHrp7EMdkMFO0Kbfd5n9I0ZGi-uJsd5t1mkB4rKojQs_boyCOYBxf-7v9g9Bi74JXUp8QGCrqwpTG4jPuxwQKDlX1vpdNa2V7a0W0Mv--fRfbHMfki4ERPQL8OzvQNkOcoPyy2yvsbasLgIR-_i1WUKq4jZr_TisgqH7L1btDXZMUPsl8&sig=Cg0ArKJSzD69mHIRw4fcEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 00:56:42 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
9818.js
ads.rubiconproject.com/ad/ Frame 01DE
26 KB
8 KB
Script
General
Full URL
https://ads.rubiconproject.com/ad/9818.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.38.84 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-38-84.deploy.static.akamaitechnologies.com
Software
Apache / PHP/5.3.3
Resource Hash
d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:41 GMT
Content-Encoding
gzip
Server
Apache
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=8838
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
7558
Expires
Wed, 16 Oct 2019 03:23:59 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 01DE
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29551
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:41 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 01DE
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:41 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=44637
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
view
securepubads.g.doubleclick.net/pcs/ Frame 90E3
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv-MqnTA5awAxFhdooRnHtrdc1F3xUEW49h8d4nNld03wfaMqSvBkJJ0LtQfkfI9p8dVUq4zk2rIX5-28WWWOXNlv1Bspd9wiJuskGDkp15YGS8FWBanS4tNNYpdJw4AZLv1IuO_8c7DoVH1-V0Ysu21of0X0VWe9Fxxa9IrZ9oDHuGQg4lX5_M4ox8rc9lZCBg-vFajKE7NGAbpG2xqZfnmIdTJTeZHiJhEAdBZW0xqTgUPhbwdIiorzmNSuv326z12JUdxd9K&sig=Cg0ArKJSzGEWg90E8ApqEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 00:56:42 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
adKit.min.js
rev.cbsi.com/common/js/ Frame 90E3
6 KB
2 KB
Script
General
Full URL
https://rev.cbsi.com/common/js/adKit.min.js?196196910
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
last-modified
Mon, 13 May 2019 18:29:20 GMT
server
Apache
etag
"e524dc608d5c7c30eef57b6ed95dc6a8:1557772160"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
accept-ranges
bytes
content-length
2149
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 90E3
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29551
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:42 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 90E3
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:42 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=44636
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
imgad
tpc.googlesyndication.com/pagead/ Frame 5417
16 KB
17 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKDnq4jGnwEQARgBMgguiTiJ14FAEw
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
617dcd02ee694a177e9e039ee5c2b3eaaa7cb1f02aa9d5155fd5db80863dda63
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 09 Oct 2019 19:28:02 GMT
x-content-type-options
nosniff
server
cafe
age
538120
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/png
status
200
cache-control
public, max-age=604800
content-disposition
attachment; filename="image.png"
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
16822
x-xss-protection
0
expires
Wed, 16 Oct 2019 19:28:02 GMT
imgad
tpc.googlesyndication.com/pagead/ Frame BFC5
17 KB
18 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKDnq4jLywEQARgBMgjX70vz2jfgkw
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
a6d7c4beeaf8bda515ef93af343a3b2e950cd6deb797fc9989c222e775ae8dcf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 17:50:27 GMT
x-content-type-options
nosniff
server
cafe
age
371175
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/png
status
200
cache-control
public, max-age=604800
content-disposition
attachment; filename="image.png"
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17863
x-xss-protection
0
expires
Fri, 18 Oct 2019 17:50:27 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame CE62
2 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 15 Oct 2019 20:45:12 GMT
x-content-type-options
nosniff
server
cafe
age
15090
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
2502
x-xss-protection
0
expires
Wed, 16 Oct 2019 20:45:12 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame CE62
295 B
371 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 00:36:05 GMT
x-content-type-options
nosniff
server
cafe
age
1237
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Thu, 17 Oct 2019 00:36:05 GMT
l
www.google.com/ads/measurement/ Frame CE62
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaRfi5Zp7bH8zHi5J6j66OOvOXWkelFehjiLLY_MYINr72sa1m-1SZtVbXlzlSx98V2kvKO8vJiSw_MiTVsI6hRjiYikuQ
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

B22124189.255033243;dc_pre=CLDA5ZfJn-UCFQ72dwod0vwBlA;dc_trk_aid=450834198;dc_trk_cid=121088454;ord=2093272708;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=
ad.doubleclick.net/ddm/trackimp/N718679.3159GOOGLE/ Frame CE62
Redirect Chain
  • https://ad.doubleclick.net/ddm/trackimp/N718679.3159GOOGLE/B22124189.255033243;dc_trk_aid=450834198;dc_trk_cid=121088454;ord=2093272708;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
  • https://ad.doubleclick.net/ddm/trackimp/N718679.3159GOOGLE/B22124189.255033243;dc_pre=CLDA5ZfJn-UCFQ72dwod0vwBlA;dc_trk_aid=450834198;dc_trk_cid=121088454;ord=2093272708;dc_lat=;dc_rdid=;tag_for_ch...
42 B
109 B
Image
General
Full URL
https://ad.doubleclick.net/ddm/trackimp/N718679.3159GOOGLE/B22124189.255033243;dc_pre=CLDA5ZfJn-UCFQ72dwod0vwBlA;dc_trk_aid=450834198;dc_trk_cid=121088454;ord=2093272708;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.198 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f6.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 00:56:42 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 16 Oct 2019 00:56:42 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
302
content-type
text/html; charset=UTF-8
location
https://ad.doubleclick.net/ddm/trackimp/N718679.3159GOOGLE/B22124189.255033243;dc_pre=CLDA5ZfJn-UCFQ72dwod0vwBlA;dc_trk_aid=450834198;dc_trk_cid=121088454;ord=2093272708;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame CE62
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CnqciyWqmXYiIINWBgQevjZjID9mj5NpY3ru2_4EKv-EeEAEgzJGuImCVgoCAmAegAdL4y-IDyAEJ4AIAqAMByAMKqgSlAk_QsVTQqU3piNfdpYZz0_R_-ZZQL-uSEM4ExTxw7V1mpNXm20wuozyWOWZcQac46O72LWisALH55U2LsU9Qunr3_qs86eVnUyevHctXloB6WL8KE6dbWHbcNU8ye3pujEvj7855BMywGMRHLHvdjgQPOcKM-flosLonsMkWeEgtyM4VWx1W58w_MEXeBIUtWwOs55WiE4x44xNn7RSmtR9eAluywlxuY8cVFA14-JEpO3xTBSsYRZgCbT7xVfDKBE2PuTxmDX9bDigtqM971d9Mtq6xvU21cMPQKFZH9diIu7Vk44ld2QbtTN74zPSUCkuKryDpxEFDk8N-GcR8qvlwmKDr4fYd50ZcrEXBIBLUgHBp5EkLu8vWLuMXO1fGuTzWETFV4AQBoAYugAeBiNZDqAeOzhuoB9XJG6gHwdMbqAeF1BuoB4HUG6gHgtQbqAeG1BuoB4TUG6gHk9gbqAfg0xuoB7oGqAfZyxuoB8_MG6gHpr4b2AcA8gcEENLSCNIICQiA4YAQEAEYHYAKA9gTA4gUAw&sigh=oCADG_Z5aLE&template_id=484&tpd=AGWhJmtSqL1daCNSjE_PCgnZsqdeAchfCMNx6lwJ32lbaXR6WA
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

283812-15.js
optimized-by.rubiconproject.com/a/9818/59604/ Frame 049F
2 KB
1 KB
Script
General
Full URL
https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.25190405732878296&tk_st=1&rf=https%3A//www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Requested by
Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.142 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
3fafc77ea10f00519e4507fef8fb5620dfd2af85518930a9af2ca3c6ae907b56

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:42 GMT
Content-Encoding
gzip
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Connection
Keep-Alive
Content-Type
text/javascript
Keep-Alive
timeout=5, max=488
Content-Length
915
Expires
Wed, 17 Sep 1975 21:32:10 GMT
283812-2.js
optimized-by.rubiconproject.com/a/9818/59604/ Frame 01DE
2 KB
1 KB
Script
General
Full URL
https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.2562391241137887&tk_st=1&rf=https%3A//www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1
Requested by
Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.142 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
ff27db1c928674d49dd76d6685ccc1adeea8ac488e701c3a792c006bf7653c0d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:42 GMT
Content-Encoding
gzip
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Connection
Keep-Alive
Content-Type
text/javascript
Keep-Alive
timeout=5, max=426
Content-Length
916
Expires
Wed, 17 Sep 1975 21:32:10 GMT
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ Frame CE62
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/011909241711100/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 14:50:26 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:58 GMT
server
sffe
age
381976
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
11020
x-xss-protection
0
expires
Sat, 10 Oct 2020 14:50:26 GMT
KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ Frame CE62
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/011909241711100/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 09 Oct 2019 12:53:28 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:52 GMT
server
sffe
age
561794
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
11180
x-xss-protection
0
expires
Thu, 08 Oct 2020 12:53:28 GMT
truncated
/ Frame 5417
215 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3eb8b6be66b47fda8df8d590af76e23e138b32b52b9cd583974f738e2534bab0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame BFC5
216 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6b6fe84622b5fa3ed762d66c7e9e131c8ceb55da281d03292e6c43c71e111604

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
n.js
geo.moatads.com/ Frame 5417
135 B
309 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571187402144&de=954172403795&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=2&cb=0&ym=0&cu=1571187402144&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=4797955119%3A2608978925%3A5192378298%3A138290557510&zMoatPS=top&zMoatPT=article&zMoatW=728&zMoatH=90&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=728x90&zMoatSZPS=728x90%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=292255616&cs=0&callback=MoatSuperV26.gna105518
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.10.83.173 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-10-83-173.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
1e327c1a5ca1e053c252b1d5a26538b369b96c0d7f12a6c4c9a57b372f2f92ac

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
server
TornadoServer/4.5.3
etag
"651ff9b8f234f755e143e7ee1223143d3a6fde02"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
135
n.js
geo.moatads.com/
133 B
307 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571187402144&de=954172403795&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=3&cb=0&ym=0&cu=1571187402144&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=4797955119%3A2608978925%3A5192378298%3A138290557510&zMoatPS=top&zMoatPT=article&zMoatW=728&zMoatH=90&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=728x90&zMoatSZPS=728x90%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=714812287&cs=0&callback=MoatDataJsonpRequest
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.10.83.173 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-10-83-173.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
64cde7db6b394925c3a99e1aac6758f54dac1b13f79f7126ef1893f1453641aa

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
server
TornadoServer/4.5.3
etag
"e648799ebf14f695a66105ccb0d1c60c889cfb57"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
133
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571187402144&de=954172403795&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=4&cb=0&ym=0&cu=1571187402144&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=4797955119%3A2608978925%3A5192378298%3A138290557510&zMoatPS=top&zMoatPT=article&zMoatW=728&zMoatH=90&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=728x90&zMoatSZPS=728x90%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=229505807&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:42 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:42 GMT
n.js
geo.moatads.com/ Frame F652
133 B
307 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571187402196&de=693979796519&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=7&cb=0&ym=0&cu=1571187402196&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745699004%3A138239468890&zMoatPS=nav&zMoatPT=article&zMoatW=5&zMoatH=5&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=5x5&zMoatSZPS=5x5%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=2013178805&cs=0&callback=MoatSuperV26.gna202709
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.10.83.173 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-10-83-173.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
768b3795bc9fe26a19482781f11dc096d52875e31e6a07e505554dce037ca11a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
server
TornadoServer/4.5.3
etag
"dfee9757bced7f3cd3d224cf20c0686c99225bda"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
133
n.js
geo.moatads.com/ Frame BFC5
135 B
310 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571187402232&de=518729050864&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=12&cb=0&ym=0&cu=1571187402232&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=4797955119%3A2608978925%3A5192378298%3A138290277353&zMoatPS=top&zMoatPT=article&zMoatW=300&zMoatH=250&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=2093205642&cs=0&callback=MoatSuperV26.gna532332
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.10.83.173 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-10-83-173.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
f0fadc8f08429a9142ced1da00a5c8e0cae836e3f0112e64e27ea502ebbbb01c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
server
TornadoServer/4.5.3
etag
"317b35768a634e5368762c98f0015b1be6668a35"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
135
/
inqlnfvog763mmf771rou737u.litix.io/
43 B
349 B
XHR
General
Full URL
https://inqlnfvog763mmf771rou737u.litix.io/
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/mux.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.199.164.63 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-199-164-63.compute-1.amazonaws.com
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:42 GMT
Access-Control-Allow-Methods
POST, GET
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache,no-store,must-revalidate
Connection
keep-alive
Content-Length
43
Expires
Mon, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/
0
56 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~k1skettg&c=7885876762299&slotId=3942938381149.5&eee=missing-element&bi=missing-id
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/instream/html5/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4006:803::2003 Sydney, Australia, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 00:56:42 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame 90E3
45 KB
14 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: rev.cbsi.com
URL: https://rev.cbsi.com/common/js/adKit.min.js?196196910
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f7b71df270660f7958f60859209972586494aff37327672ef85951f29c151716
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"308 / 887 of 1000 / last-modified: 1571176937"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14544
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:42 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 01DE
77 KB
28 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.2562391241137887&tk_st=1&rf=https%3A//www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
1f2d966fcdd7b1152e8138d86b6a4d29d875245fc802475352295b4bbbc85360
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28310
x-xss-protection
0
server
cafe
etag
4194519252683833926
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Wed, 16 Oct 2019 00:56:42 GMT
1028526f-0a83-4828-993b-dddecf2bcd2f
beacon-eu2.rubiconproject.com/beacon/d/ Frame 01DE
43 B
268 B
Image
General
Full URL
https://beacon-eu2.rubiconproject.com/beacon/d/1028526f-0a83-4828-993b-dddecf2bcd2f?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=2&e=6A1E40E384DA563B3B70DAB77504B069FB27B679195D18FADFC3B16F8A663CF0472ADAF9E2FA970ACA39C900A9664D97E4A9AFA6E089EF842C0B89E7E5B8E556B8C20870272849753570ECD3831C9446AC237D6FA0EBFC9A6240B348FC26EBCF80CDDB0C851D81C683009FDB9DE7981633F8630F2FDB6069
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.154 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
Rubicon Project /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:41 GMT
Cache-Control
private, max-age=0, no-cache
Server
Rubicon Project
Content-Type
image/webp
Content-Length
43
Expires
01 Jan 1970 10:00:00 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 049F
77 KB
28 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.25190405732878296&tk_st=1&rf=https%3A//www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
1f2d966fcdd7b1152e8138d86b6a4d29d875245fc802475352295b4bbbc85360
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28310
x-xss-protection
0
server
cafe
etag
4194519252683833926
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Wed, 16 Oct 2019 00:56:42 GMT
a3f36c73-f7ac-4015-883c-0ec290e82c68
beacon-eu2.rubiconproject.com/beacon/d/ Frame 049F
43 B
268 B
Image
General
Full URL
https://beacon-eu2.rubiconproject.com/beacon/d/a3f36c73-f7ac-4015-883c-0ec290e82c68?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=15&e=6A1E40E384DA563BF9202BD6E463DC1B2F16AB67B4C25D6AB57265AD7F8E6647DBFC0B43FE2AB919B4C547BB604600DEE4A9AFA6E089EF842C0B89E7E5B8E556B8C20870272849753570ECD3831C9446AC237D6FA0EBFC9A6240B348FC26EBCF349C7F93FE7A61D883009FDB9DE7981633F8630F2FDB6069
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.154 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
Rubicon Project /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:41 GMT
Cache-Control
private, max-age=0, no-cache
Server
Rubicon Project
Content-Type
image/webp
Content-Length
43
Expires
01 Jan 1970 10:00:00 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCICAgKDnq4jGnwEQARgBMgguiTiJ14FAEw&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&f=0&j=&t=1571187402144&de=954172403795&cu=1571187402144&m=49&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4412&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&as=0&ag=16&an=0&gf=16&gg=0&ix=16&ic=16&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=16&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=32&cd=0&ah=32&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=4797955119%3A2608978925%3A5192378298%3A138290557510&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=728x90&zMoatPS=top&zMoatSZPS=728x90%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=728&zMoatH=90&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatSlotId=leader-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-top-5da66ac669b2d&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1404039922&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:42 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:42 GMT
/
686eb71a.akstat.io/
0
354 B
XHR
General
Full URL
https://686eb71a.akstat.io/?h.pg=article&when=1571187402293&cdim.Site_View=desktop&t_other=custom3%7C686&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=f133d9fd2edce01ff11519a215771aac5e63bff9&h.t=1571187401403&http.initiator=api&rt.start=api&rt.si=ee9865fb-95ca-4265-897e-ffee9cd16d18&rt.ss=1571187404256&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.32.243.235 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-32-243-235.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:42 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Wed, 16 Oct 2019 00:56:42 GMT
OAS_Countdown_EG_5_700.webm
cbsadsales-a.akamaihd.net/Q1/
16 B
184 B
Media
General
Full URL
https://cbsadsales-a.akamaihd.net/Q1/OAS_Countdown_EG_5_700.webm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-72.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1e3b732162edb42ae45db702e9833d67a58ae5132f2541e78028a1425c3c83df

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range
bytes=0-

Response headers

Date
Wed, 16 Oct 2019 00:56:43 GMT
Server
Apache
Connection
keep-alive
Content-Length
16
Content-Type
text/html; charset=iso-8859-1
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=16&fi=1&apd=32&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=4797955119&L2id=2608978925&L3id=5192378298&L4id=138290557510&S1id=23605329&S2id=23619609&ord=1571187402144&r=954172403795&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatPS=top&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=16&fi=1&apd=32&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=4797955119&L2id=2608978925&L3id=5192378298&L4id=138290557510&S1id=23605329&S2id=23619609&ord=1571187402144&r=954172403795&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatPS=top&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=2&fi=1&apd=4&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=4797955119&L2id=2608978925&L3id=5192378298&L4id=138290277353&S1id=23605329&S2id=23619609&ord=1571187402232&r=518729050864&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatPS=top&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=2&fi=1&apd=4&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=4797955119&L2id=2608978925&L3id=5192378298&L4id=138290277353&S1id=23605329&S2id=23619609&ord=1571187402232&r=518729050864&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatPS=top&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571187402196&de=693979796519&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=9&cb=0&ym=0&cu=1571187402196&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745699004%3A138239468890&zMoatPS=nav&zMoatPT=article&zMoatW=5&zMoatH=5&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=5x5&zMoatSZPS=5x5%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=256734236&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:42 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:42 GMT
integrator.js
adservice.google.de/adsid/ Frame 90E3
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 90E3
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
pubads_impl_2019100301.js
securepubads.g.doubleclick.net/gpt/ Frame 90E3
157 KB
58 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
sffe /
Resource Hash
d98e77e558ef5c298f4c28cdd1604914a16a3fcc9249904ba70c57d989fb6aab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 03 Oct 2019 13:06:21 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
58949
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:42 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=190&fi=1&apd=206&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=4797955119&L2id=2608978925&L3id=5192378298&L4id=138290557510&S1id=23605329&S2id=23619609&ord=1571187402144&r=954172403795&t=hdn&os=1&fi2=0&div1=0&ait=87&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatPS=top&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=190&fi=1&apd=206&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=4797955119&L2id=2608978925&L3id=5192378298&L4id=138290557510&S1id=23605329&S2id=23619609&ord=1571187402144&r=954172403795&t=nht&os=1&fi2=0&div1=0&ait=87&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatPS=top&zMoatPT=article&bedc=1&q=4&nu=1&ib=0&dc=1&ob=1&oh=1&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571187402232&de=518729050864&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=14&cb=0&ym=0&cu=1571187402232&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=4797955119%3A2608978925%3A5192378298%3A138290277353&zMoatPS=top&zMoatPT=article&zMoatW=300&zMoatH=250&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=237200093&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:42 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:42 GMT
integrator.js
adservice.google.de/adsid/ Frame 049F
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 049F
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20191014/r20190131/ Frame 049F
238 KB
88 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191014/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
44ac654a5d74e0f55d383818e9fb4782ea064fdc7cac8e5a4bcb71a011cad952
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
89450
x-xss-protection
0
server
cafe
etag
1429027213900407418
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Wed, 16 Oct 2019 00:56:42 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20191014/r20190131/ Frame 2F24
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20191014/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20191014/r20190131/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
accept-encoding
gzip, deflate, br
cookie
IDE=AHWqTUldJD6qDT68AE7SbOoIaeXSqtSKIVyAaog3cOFt1XHRjlnO894VyQLHkmom
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
vary
Accept-Encoding
date
Mon, 14 Oct 2019 14:21:56 GMT
expires
Mon, 28 Oct 2019 14:21:56 GMT
content-type
text/html; charset=UTF-8
etag
8648543205226238674
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
7402
x-xss-protection
0
cache-control
public, max-age=1209600
age
124486
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
usync.html
eus.rubiconproject.com/ Frame 646A
0
0
Document
General
Full URL
https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.78.125 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host
eus.rubiconproject.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/

Response headers

Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified
Mon, 14 Oct 2019 17:50:03 GMT
Content-Encoding
gzip
Content-Length
7684
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=51004
Expires
Wed, 16 Oct 2019 15:06:46 GMT
Date
Wed, 16 Oct 2019 00:56:42 GMT
Connection
keep-alive
Vary
Accept-Encoding
integrator.js
adservice.google.de/adsid/ Frame 01DE
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 01DE
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl_fy2019.js
pagead2.googlesyndication.com/pagead/js/r20191014/r20190131/ Frame 01DE
220 KB
83 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191014/r20190131/show_ads_impl_fy2019.js?cache=bust
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
5e68830dc559aaaff190a56ff90d4b57ced977c79c9e177109bbb913b4443e0f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
84537
x-xss-protection
0
server
cafe
etag
5373409261949809942
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Wed, 16 Oct 2019 00:56:42 GMT
usync.html
eus.rubiconproject.com/ Frame A990
0
0
Document
General
Full URL
https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.78.125 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host
eus.rubiconproject.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/

Response headers

Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified
Mon, 14 Oct 2019 17:50:03 GMT
Content-Encoding
gzip
Content-Length
7684
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=51004
Expires
Wed, 16 Oct 2019 15:06:46 GMT
Date
Wed, 16 Oct 2019 00:56:42 GMT
Connection
keep-alive
Vary
Accept-Encoding
truncated
/ Frame 049F
221 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c016c8161912be075cfe0484bd6f79648c36c47f68687ab0fee2606ca39905fc

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 01DE
215 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
efd6198c3b51231f63382a066849dc8dd8d409af5bb9056265c14a1b564c3a1d

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCICAgKDnq4jLywEQARgBMgjX70vz2jfgkw&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&f=0&j=&t=1571187402232&de=518729050864&cu=1571187402232&m=9&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4412&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&as=0&ag=2&an=0&gf=2&gg=0&ix=2&ic=2&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=2&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4&cd=0&ah=4&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=4797955119%3A2608978925%3A5192378298%3A138290277353&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x250&zMoatPS=top&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatSlotId=mpu-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-plus-top-5da66ac669b2d&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=886365353&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:42 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:42 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=3&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271735246&S1id=23605329&S2id=23619609&ord=1571187402414&r=438583099005&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatPS=bottom&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=3&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271735246&S1id=23605329&S2id=23619609&ord=1571187402414&r=438583099005&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatPS=bottom&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=3&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=138271463474&S1id=23605329&S2id=23619609&ord=1571187402428&r=795714297490&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatPS=bottom&zMoatPT=article&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=3&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=138271463474&S1id=23605329&S2id=23619609&ord=1571187402428&r=795714297490&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatPS=bottom&zMoatPT=article&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame 90E3
29 KB
7 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=822746573023895&correlator=1775936008316559&output=ldjh&impl=fifs&adsid=NT&eid=21061507%2C21062421%2C21064521&vrg=2019100301&guci=1.2.0.0.2.2.0.0&plat=1%3A536903688%2C2%3A536903688%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20191016&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=372x142%2C372x142&prev_scp=env%3Dprod%26session%3Dg%26subses%3D5%26ptype%3Darticle%26vguid%3D2713c768-4b09-44e9-b2cd-eda8443c4c92%7Cenv%3Dprod%26session%3Dg%26subses%3D5%26ptype%3Darticle%26vguid%3D2713c768-4b09-44e9-b2cd-eda8443c4c92&cookie=ID%3D4c9557f773ab92b8%3AT%3D1571187401%3AS%3DALNI_MbPjUx26l_qjQ8CDA4g7FcsRkQGfA&cdm=www.zdnet.com&bc=31&abxe=1&lmt=1571187402&dt=1571187402475&dlt=1571187401987&idt=476&frm=23&biw=1585&bih=1200&isw=371&ish=771&oid=3&adxs=-12245933%2C-12245933&adys=-12245933%2C-12245933&adks=3261246841%2C3261246840&ucis=m9otk4oad544%7Cfjhhd09w7kp8&ifi=1&ifk=3584362996&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&top=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&dssz=16&icsg=10888&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0%7C0x0&msz=0x0%7C0x0&ga_vid=1694256991.1571187402&ga_sid=1571187402&ga_hid=936647174&fws=256%2C256&ohw=0%2C0
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
5b73d2f81a662e7fded807866dd1457e5f74eb7b750237d81ff4baba483329f7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
7070
x-xss-protection
0
google-lineitem-id
4746066197,4746066197
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138239375540,138239468731
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2019100301.js
securepubads.g.doubleclick.net/gpt/ Frame 90E3
63 KB
24 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
sffe /
Resource Hash
33e7cfb629c6fc28bec6f0039c2b843ac7d63cb54a883599ca33ce2384e251fa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 03 Oct 2019 13:06:21 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
24653
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:42 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ Frame 90E3
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

fbi-warns-about-attacks-that-bypass-mult-5d9f3e61b93c140001af20be-1-oct-15-2019-13-46-29-poster.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/10/15/67b5bee4-08fe-4c69-94b2-c7649e9fb653/thumbnail/170x96/58ad3c71b8a6467987d6e07b89069337/
5 KB
5 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/10/15/67b5bee4-08fe-4c69-94b2-c7649e9fb653/thumbnail/170x96/58ad3c71b8a6467987d6e07b89069337/fbi-warns-about-attacks-that-bypass-mult-5d9f3e61b93c140001af20be-1-oct-15-2019-13-46-29-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
9d33210cfff83efe9300385679fe9129399a9e6cd0cc3924784d19236d83522a
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
27944
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
5151
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"3b8c6dc0b282e4aa77ac2a109dbc83c8"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
ransomware-some-hackers-are-just-interes-5da44ad2dc406100013dad4b-1-oct-14-2019-11-46-19-poster.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/10/14/92b1f246-f68c-4787-a5e4-78486c28de09/thumbnail/170x96/5d885203b8ffbfc30d35b430a4f2a14a/
4 KB
4 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/10/14/92b1f246-f68c-4787-a5e4-78486c28de09/thumbnail/170x96/5d885203b8ffbfc30d35b430a4f2a14a/ransomware-some-hackers-are-just-interes-5da44ad2dc406100013dad4b-1-oct-14-2019-11-46-19-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d998db90f2c6420bf38e129e55b4499c575fe00b0a42af249b1e6b62987e3be8
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
132692
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
3827
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"7da18d0326a9f46a4817e19c805819ae"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
apple-pulls-hkmaplive-from-app-store-5d9febccb93c140001af62bc-1-oct-11-2019-4-22-02-poster.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/10/11/cdcc0d4d-b067-4eea-b774-152362807e30/thumbnail/170x96/15e36d67d27e7a6c7db4dd14a6549af0/
5 KB
5 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/10/11/cdcc0d4d-b067-4eea-b774-152362807e30/thumbnail/170x96/15e36d67d27e7a6c7db4dd14a6549af0/apple-pulls-hkmaplive-from-app-store-5d9febccb93c140001af62bc-1-oct-11-2019-4-22-02-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
a125ca8593289acb781a8e37646fd9ae9e6cb99ab2497f57ce3820b35d1a0f57
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
179734
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4831
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d40954183d62a82257835477ccad3d2"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
20191011-adrian-karen-bluetooth.png
zdnet1.cbsistatic.com/hub/i/r/2019/10/11/3262487d-e0c7-4868-843b-31cf6b605095/thumbnail/170x96/dd6829489290c73d563e6956a124ca90/
33 KB
33 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/10/11/3262487d-e0c7-4868-843b-31cf6b605095/thumbnail/170x96/dd6829489290c73d563e6956a124ca90/20191011-adrian-karen-bluetooth.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
351a3d51b623903e7766210a1167f8ae41057424c42bcb4f443b334c83d4d7d7
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
386467
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
33185
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"6cdc8dc1dd8a5460f1798cb9f460fc6b"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
thumb.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/10/10/2835865e-9a78-4bf1-8a4a-0062712a8b46/thumbnail/170x96/b589b8e100c7ec95bfe6ce44787f3bf6/
8 KB
7 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/10/10/2835865e-9a78-4bf1-8a4a-0062712a8b46/thumbnail/170x96/b589b8e100c7ec95bfe6ce44787f3bf6/thumb.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d256df058aa5ec69a69d76cb3794b4bce945123dcd788c6b3f8d5a103bc9ea14
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
466014
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
7417
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"74627b65e6e6a4c21e06809b8e02114a"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
over-500-us-schools-were-hit-by-ransomwa-5d95e706800f320001e31312-1-oct-08-2019-14-22-08-poster.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/10/08/03041a74-d495-4031-89e7-ef021827ec99/thumbnail/170x96/9aeabe3661709bf7414a38850eb35385/
5 KB
6 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/10/08/03041a74-d495-4031-89e7-ef021827ec99/thumbnail/170x96/9aeabe3661709bf7414a38850eb35385/over-500-us-schools-were-hit-by-ransomwa-5d95e706800f320001e31312-1-oct-08-2019-14-22-08-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f4e897262433ce7aa0a7e81d5b43d66d199627bb16045cf573f6d0afaf008286
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
468950
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
5574
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"227e072d131ba77451d8f27ab9afdfb7"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
facebook-unfurls-new-measures-in-singapo-5d937945800f320001e22942-1-oct-08-2019-14-23-49-poster.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/10/08/3565ed88-c7ad-4b06-a03c-10b5828ad3d0/thumbnail/170x96/8a935d194a75663ffca3ae46a6b03c95/
4 KB
4 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/10/08/3565ed88-c7ad-4b06-a03c-10b5828ad3d0/thumbnail/170x96/8a935d194a75663ffca3ae46a6b03c95/facebook-unfurls-new-measures-in-singapo-5d937945800f320001e22942-1-oct-08-2019-14-23-49-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
ed943dbf0f0e8f22e867bcdaabe5a1e5d7275f117907fc29626e9e1430184700
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
545076
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4178
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"331cc28f8747a032890d0429b5a5f0e5"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
vimeo-embroiled-in-biometric-face-map-la-5d9378f99fad230001ca583d-1-oct-08-2019-14-19-09-poster.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/10/08/56e6b5ad-cafd-475a-b349-3d8ae1e01ebd/thumbnail/170x96/0a0aa9a4e23b0bfc9dd58c361ed64882/
3 KB
4 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/10/08/56e6b5ad-cafd-475a-b349-3d8ae1e01ebd/thumbnail/170x96/0a0aa9a4e23b0bfc9dd58c361ed64882/vimeo-embroiled-in-biometric-face-map-la-5d9378f99fad230001ca583d-1-oct-08-2019-14-19-09-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
05c23cf9af6842f0505891056a5c8f2d100729227ef486f0662576a7fe33c197
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
558957
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
3523
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5a9d8bf5b7a4b35f3110dde8673bdda2"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
cyber-security-research-centre-data61-pe-5d9553429fad230001cb1a5c-1-oct-03-2019-4-58-20-poster.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/10/03/3576f5c2-d959-4599-96cf-ccb934fb3fc6/thumbnail/170x96/9a7bf942a7986c45487eacab0abe9200/
4 KB
4 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/10/03/3576f5c2-d959-4599-96cf-ccb934fb3fc6/thumbnail/170x96/9a7bf942a7986c45487eacab0abe9200/cyber-security-research-centre-data61-pe-5d9553429fad230001cb1a5c-1-oct-03-2019-4-58-20-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
11c0a5242dcc31758eb337d7ebbd8022a4463fe918761d8d7b664172ea7793d7
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
590013
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4226
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"be3ac64e67e84198f03f45b661f2124a"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
this-huge-android-trojan-malware-campaig-5d9b3d0ab93c140001ad824b-1-oct-08-2019-11-24-47-poster.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/10/08/08dbbff3-e977-4032-a347-59765bcfe516/thumbnail/170x96/a9e89096c1636e739301b72ced00b99b/
4 KB
5 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/10/08/08dbbff3-e977-4032-a347-59765bcfe516/thumbnail/170x96/a9e89096c1636e739301b72ced00b99b/this-huge-android-trojan-malware-campaig-5d9b3d0ab93c140001ad824b-1-oct-08-2019-11-24-47-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
fc2f74ca713090cca3ada9937e3236d3881bda70c638894ce09648116e8019f3
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
606850
status
200
content-transfer-encoding
binary
vary
Accept-Image-Webp,Accept-Image-Webv
content-length
4585
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"85e5526a360b0bcf082d8d42e7bf100b"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=263&fi=1&apd=265&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=4797955119&L2id=2608978925&L3id=5192378298&L4id=138290277353&S1id=23605329&S2id=23619609&ord=1571187402232&r=518729050864&t=hdn&os=1&fi2=0&div1=0&ait=131&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatPS=top&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=263&fi=1&apd=265&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=4797955119&L2id=2608978925&L3id=5192378298&L4id=138290277353&S1id=23605329&S2id=23619609&ord=1571187402232&r=518729050864&t=nht&os=1&fi2=0&div1=0&ait=131&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatPS=top&zMoatPT=article&bedc=1&q=4&nu=1&ib=0&dc=1&ob=1&oh=1&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame EC48
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=2269224027&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1571187402363&bpp=11&bdt=423&fdt=143&idt=144&shv=r20191014&cbv=r20190131&saldr=sa&correlator=7885876762299&frm=23&ife=5&pv=2&ga_vid=1866455748.1571187403&ga_sid=1571187403&ga_hid=314382046&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=19&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=2458&biw=1585&bih=1200&isw=300&ish=250&ifk=1270051788&scr_x=0&scr_y=0&eid=20199338&oid=3&pvsid=1162078900323653&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.u9vmbhapfuqu&fsb=1&dtd=154
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191014/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=418362401&adf=2269224027&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1571187402363&bpp=11&bdt=423&fdt=143&idt=144&shv=r20191014&cbv=r20190131&saldr=sa&correlator=7885876762299&frm=23&ife=5&pv=2&ga_vid=1866455748.1571187403&ga_sid=1571187403&ga_hid=314382046&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=19&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=2458&biw=1585&bih=1200&isw=300&ish=250&ifk=1270051788&scr_x=0&scr_y=0&eid=20199338&oid=3&pvsid=1162078900323653&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.u9vmbhapfuqu&fsb=1&dtd=154
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
accept-encoding
gzip, deflate, br
cookie
IDE=AHWqTUldJD6qDT68AE7SbOoIaeXSqtSKIVyAaog3cOFt1XHRjlnO894VyQLHkmom
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Wed, 16 Oct 2019 00:56:42 GMT
server
cafe
content-length
4133
x-xss-protection
0
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
osd.js
www.googletagservices.com/activeview/js/current/ Frame 049F
77 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191014/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f425f66d90f1150499b36ab47b56fa6fb1a68136e4f42befca20a920ff85306b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29055
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:42 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571187402348&de=318947023756&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=18&cb=0&ym=0&cu=1571187402348&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4825966980%3A138247024569&zMoatPS=top&zMoatPT=article&zMoatW=371&zMoatH=771&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=371x771&zMoatSZPS=371x771%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=365073386&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:42 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:42 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame FCA4
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=2269224026&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1571187402377&bpp=11&bdt=430&fdt=151&idt=151&shv=r20191014&cbv=r20190131&saldr=sa&correlator=7885876762299&frm=23&ife=5&pv=1&ga_vid=30935616.1571187403&ga_sid=1571187403&ga_hid=546824717&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=19&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3997&biw=1585&bih=1200&isw=728&ish=90&ifk=2119417797&scr_x=0&scr_y=0&eid=20040009&oid=3&pvsid=1271412903126817&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.n6l1v2s2z3qk&fsb=1&dtd=161
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191014/r20190131/show_ads_impl_fy2019.js?cache=bust
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=2606246846&adf=2269224026&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1571187402377&bpp=11&bdt=430&fdt=151&idt=151&shv=r20191014&cbv=r20190131&saldr=sa&correlator=7885876762299&frm=23&ife=5&pv=1&ga_vid=30935616.1571187403&ga_sid=1571187403&ga_hid=546824717&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=19&mdo=0&mso=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3997&biw=1585&bih=1200&isw=728&ish=90&ifk=2119417797&scr_x=0&scr_y=0&eid=20040009&oid=3&pvsid=1271412903126817&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.n6l1v2s2z3qk&fsb=1&dtd=161
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
accept-encoding
gzip, deflate, br
cookie
IDE=AHWqTUldJD6qDT68AE7SbOoIaeXSqtSKIVyAaog3cOFt1XHRjlnO894VyQLHkmom
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Wed, 16 Oct 2019 00:56:42 GMT
server
cafe
content-length
21510
x-xss-protection
0
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
osd.js
www.googletagservices.com/activeview/js/current/ Frame 01DE
77 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191014/r20190131/show_ads_impl_fy2019.js?cache=bust
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f425f66d90f1150499b36ab47b56fa6fb1a68136e4f42befca20a920ff85306b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29055
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:42 GMT
carousel-f3b9253e16-rev.js
zdnet2.cbsistatic.com/fly/js/components/
312 B
443 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/carousel-f3b9253e16-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
77682498c3ae319a10c59528b8e39180f6e08e6d5be63ef79b54cf21b8a6ec47
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
nncoection
close
age
380678
status
200
vary
Accept-Encoding
content-length
215
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:12 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d9e3580-138"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 18 Oct 2019 15:12:03 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame C357
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssF9vw8XyZVoqUWFJvTVwob3S7yCexq026U5AZAk3Y1AdCodjFNIhN4PhvuPtzgJNabarCXItQJ26jkS2Rbo6T-E43wbzhLE7ZYqRxQM-SO5uhi49-9Oy0YtSfAYnqNsD1_1pMI1WLBGPk82GH6isUU20JzFnzEKSWi0I7o2qkK3oRj-CzEdXfk-LLIvjodeREI8g2WZIqukrbdUyov9MXpm8nxx2g0_tXHajLHlTi-g7kX8uqNCYFwnDJ3xmiEE9W-Fh1IK11o&sig=Cg0ArKJSzIEsEHhuSoaZEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 00:56:42 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame C357
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29551
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:42 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame C357
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:42 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=44636
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
osd.js
www.googletagservices.com/activeview/js/current/ Frame 90E3
77 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f425f66d90f1150499b36ab47b56fa6fb1a68136e4f42befca20a920ff85306b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29055
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:42 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 2B67
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstVU2e7_9aMveijeZLaTMeqmEoO0X72MhnyPfz5H1jLmUmb9WKQfL2wmO8zBmzvHfP_QU5-PkzdL78kI7jsuAfY-QEftPgLD8vsGWrRDk__s7m13ZFRitXFW73t6Y662FlI1de7U6TuubQMAdiFh1r8XZsWBmHPppP3Xcu0QA0c95WeCmkf6VoE_FSEbQomDrgbZHbicjwvJ35ILoDuFS7ubK_aehgn0TNj6cPwafDiNEahUIxK_Z--GQEEac9yTGoMCEGW4IrT&sig=Cg0ArKJSzHwYFuJk0xEREAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 00:56:42 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 2B67
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29551
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:42 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 2B67
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:42 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=44636
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571187402414&de=438583099005&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=22&cb=0&ym=0&cu=1571187402414&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25299489%3A251370729%3A253246569%3A138271735246&zMoatPS=bottom&zMoatPT=article&zMoatW=300&zMoatH=250&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=249426699&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:42 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:42 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=229&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=138271735246&S1id=23605329&S2id=23619609&ord=1571187402414&r=438583099005&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatPS=bottom&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&u=DvWRf3UzokkBiMKZL&d=zdnet.com&g=65713&g0=security&g1=catalin%20cimpanu&n=1&f=00001&c=0.04&x=0&m=0&y=4412&o=1585&w=1200&j=30&R=1&W=0&I=0&E=2&e=2&r=&b=2841&t=CwhrkWC4-rpXl9-DyDTeLs_Die8I&V=116&tz=-120&_acct=anon&_vi=University%20forced%20to%20shut%20down%20network%20to%20stop%20Bitcoin%20mining%20scheme&_vp=/video/manifest/university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme.m3u8&_vdd=video%40zdnet.com&_vs=s1&_vt=ct&_vtn=null&_vd=46000&sn=2&sv=DdzkKK388AQCYnA6HmM5k9B8P4bO&sd=1&im=067b2ff3&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.86.231.246 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-231-246.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Wed, 16 Oct 2019 00:56:42 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=205&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=138271463474&S1id=23605329&S2id=23619609&ord=1571187402428&r=795714297490&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatPS=bottom&zMoatPT=article&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=https%3A%2F%2Fbeacon-eu2.rubiconproject.com%2Fbeacon%2Fd%2Fa3f36c73-f7ac-4015-883c-0ec290e82c68&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&f=0&j=&t=1571187402414&de=438583099005&cu=1571187402414&m=10&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4412&le=1&lf=0&lg=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A-%3A-&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=0&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=3&cd=0&ah=3&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A138271735246&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x250&zMoatPS=bottom&zMoatSZPS=300x250%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatSlotId=mpu-bottom&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-bottom-5da66ac669b2d&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-bottom&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=461506253&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:42 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:42 GMT
carousel-1.0.js
zdnet3.cbsistatic.com/fly/bundles/flyjs/js/components/
21 KB
4 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/bundles/flyjs/js/components/carousel-1.0.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
0bfe19716cf9c9ba0b1343bf813585bf7970dd9b3ad96d82c88874b28130edbf
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
464838
status
200
vary
Accept-Encoding
content-length
4361
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:29:35 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d9e351f-5590"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 17 Oct 2019 15:49:23 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571187402428&de=795714297490&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=26&cb=0&ym=0&cu=1571187402428&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25299489%3A251370729%3A241984809%3A138271463474&zMoatPS=bottom&zMoatPT=article&zMoatW=728&zMoatH=90&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=728x90&zMoatSZPS=728x90%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=779688707&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:42 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:42 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=https%3A%2F%2Fbeacon-eu2.rubiconproject.com%2Fbeacon%2Fd%2F1028526f-0a83-4828-993b-dddecf2bcd2f&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&f=0&j=&t=1571187402428&de=795714297490&cu=1571187402428&m=29&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4412&le=1&lf=0&lg=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A-%3A-&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=0&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=3&cd=0&ah=3&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=25299489%3A251370729%3A241984809%3A138271463474&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=728x90&zMoatPS=bottom&zMoatSZPS=728x90%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=728&zMoatH=90&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatSlotId=leader-plus-bottom&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-bottom-5da66ac669b2d&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-bottom&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1916923693&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:42 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:42 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571187402630&de=283483501679&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=30&cb=0&ym=0&cu=1571187402630&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4746066197%3A138239375540&zMoatPT=article&zMoatW=372&zMoatH=142&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&bo=23605329&bp=23619609&bd=-&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=372x142&zMoatPS=Not%20Specified&zMoatSZPS=Not%20Specified&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1155420502&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:42 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:42 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571187402641&de=800737432489&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=34&cb=0&ym=0&cu=1571187402641&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4746066197%3A138239468731&zMoatPT=article&zMoatW=372&zMoatH=142&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&bo=23605329&bp=23619609&bd=-&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=372x142&zMoatPS=Not%20Specified&zMoatSZPS=Not%20Specified&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1683038580&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:42 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:42 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&f=0&j=&t=1571187402144&de=954172403795&cu=1571187402144&m=1043&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4412&le=1&lf=164&lg=1&lh=110&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1017&an=16&gi=1&gf=1017&gg=16&ix=1017&ic=1017&ez=1&ck=1017&kw=830&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1017&bx=16&ci=1017&jz=830&dj=1&aa=0&ad=914&cn=0&gk=914&gl=0&ik=914&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=830&cd=32&ah=830&am=32&rf=0&re=1&ft=914&fv=0&fw=914&wb=1&cl=0&at=0&d=4797955119%3A2608978925%3A5192378298%3A138290557510&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=728x90&zMoatPS=top&zMoatSZPS=728x90%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=728&zMoatH=90&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatSlotId=leader-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-top-5da66ac669b2d&hv=CBS%20Attribute&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1860771304&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=830&tet=1017&fi=1&apd=1033&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=4797955119&L2id=2608978925&L3id=5192378298&L4id=138290557510&S1id=23605329&S2id=23619609&ord=1571187402144&r=954172403795&t=iv&os=1&fi2=0&div1=1&ait=914&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatPS=top&zMoatPT=article&bedc=1&q=5&nu=1&ib=0&dc=1&ob=1&oh=1&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&f=0&j=&t=1571187402144&de=954172403795&cu=1571187402144&m=1044&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4412&le=1&lf=164&lg=1&lh=110&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1017&an=1017&gi=1&gf=1017&gg=1017&ix=1017&ic=1017&ez=1&ck=1017&kw=830&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1017&bx=1017&ci=1017&jz=830&dj=1&aa=0&ad=914&cn=914&gk=914&gl=914&ik=914&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=830&cd=830&ah=830&am=830&rf=0&re=1&ft=914&fv=914&fw=914&wb=1&cl=0&at=0&d=4797955119%3A2608978925%3A5192378298%3A138290557510&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=728x90&zMoatPS=top&zMoatSZPS=728x90%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=728&zMoatH=90&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatSlotId=leader-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-top-5da66ac669b2d&hv=CBS%20Attribute&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1040709303&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&f=0&j=&t=1571187402144&de=954172403795&cu=1571187402144&m=1045&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4412&le=1&lf=164&lg=1&lh=110&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1017&an=1017&gi=1&gf=1017&gg=1017&ix=1017&ic=1017&ez=1&ck=1017&kw=830&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1017&bx=1017&ci=1017&jz=830&dj=1&aa=0&ad=914&cn=914&gk=914&gl=914&ik=914&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=830&cd=830&ah=830&am=830&rf=0&re=1&ft=914&fv=914&fw=914&wb=1&cl=0&at=0&d=4797955119%3A2608978925%3A5192378298%3A138290557510&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=728x90&zMoatPS=top&zMoatSZPS=728x90%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=728&zMoatH=90&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatSlotId=leader-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-top-5da66ac669b2d&hv=CBS%20Attribute&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1869248649&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&f=0&j=&t=1571187402232&de=518729050864&cu=1571187402232&m=1078&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4412&le=1&lf=102&lg=1&lh=67&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1072&an=2&gi=1&gf=1072&gg=2&ix=1072&ic=1072&ez=1&ck=1072&kw=871&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1072&bx=2&ci=1072&jz=871&dj=1&aa=0&ad=940&cn=0&gk=940&gl=0&ik=940&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=871&cd=4&ah=871&am=4&rf=0&re=1&ft=940&fv=0&fw=940&wb=1&cl=0&at=0&d=4797955119%3A2608978925%3A5192378298%3A138290277353&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x250&zMoatPS=top&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatSlotId=mpu-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-plus-top-5da66ac669b2d&hv=CBS%20Attribute&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1380698874&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=871&tet=1072&fi=1&apd=1074&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=4797955119&L2id=2608978925&L3id=5192378298&L4id=138290277353&S1id=23605329&S2id=23619609&ord=1571187402232&r=518729050864&t=iv&os=1&fi2=0&div1=1&ait=940&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatPS=top&zMoatPT=article&bedc=1&q=5&nu=1&ib=0&dc=1&ob=1&oh=1&lt=1&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&f=0&j=&t=1571187402232&de=518729050864&cu=1571187402232&m=1080&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4412&le=1&lf=102&lg=1&lh=67&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1072&an=1072&gi=1&gf=1072&gg=1072&ix=1072&ic=1072&ez=1&ck=1072&kw=871&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1072&bx=1072&ci=1072&jz=871&dj=1&aa=0&ad=940&cn=940&gk=940&gl=940&ik=940&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=871&cd=871&ah=871&am=871&rf=0&re=1&ft=940&fv=940&fw=940&wb=1&cl=0&at=0&d=4797955119%3A2608978925%3A5192378298%3A138290277353&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x250&zMoatPS=top&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatSlotId=mpu-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-plus-top-5da66ac669b2d&hv=CBS%20Attribute&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1289227754&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&f=0&j=&t=1571187402232&de=518729050864&cu=1571187402232&m=1082&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4412&le=1&lf=102&lg=1&lh=67&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1072&an=1072&gi=1&gf=1072&gg=1072&ix=1072&ic=1072&ez=1&ck=1072&kw=871&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1072&bx=1072&ci=1072&jz=871&dj=1&aa=0&ad=940&cn=940&gk=940&gl=940&ik=940&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=871&cd=871&ah=871&am=871&rf=0&re=1&ft=940&fv=940&fw=940&wb=1&cl=0&at=0&d=4797955119%3A2608978925%3A5192378298%3A138290277353&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x250&zMoatPS=top&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatSlotId=mpu-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-plus-top-5da66ac669b2d&hv=CBS%20Attribute&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1934235923&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 5417
42 B
122 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssrcw_LFWOsdgBdCLMMbedyglgzMsiGjaUj9gpkzVeAPxW-myHEIclxjZFKgKqjCbKXN-GmpyHl6wBO-DpeqXqnJ3EdnAy-ykdbOi4NR7o&sig=Cg0ArKJSzFssYrqtl7pYEAE&adk=2607015740&tt=1315&bs=1585%2C1200&mtos=1106,1106,1106,1106,1106&tos=1106,0,0,0,0&p=420,429,510,1157&mcvt=1106&rs=3&ht=0&tfs=221&tls=1327&mc=1&lte=1&bas=0&bac=0&met=no&avms=nio&niot_obs=10&niot_cbk=204&md=2&lm=2&rst=1571187401919&rpt=216&isd=0&msd=0&ext=mvo%3D-1%26brt%3D102&oseid=3&xdi=0&xosd=1&ps=1585%2C4412&ss=1600%2C1200&pt=13&bin=1&deb=1-6-6-17-12-14-120-11-0-0-0&tvt=1322&r=v&id=osdim&vs=4&uc=13&upc=1&tgt=DIV&cl=1&cec=1&clc=1&cac=1&cd=0x0&itpl=19&v=20191014
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 00:56:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame BFC5
42 B
122 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssF05q_9WxKdPXSZx-7IZD6dJWdsrNu6mkQJEaQRLGgt9qZQhvy2E3fenzOzyikQzYFgoCbQF8HZxxBmu9DGgxUMFZiBb-88SafTI1LKR4&sig=Cg0ArKJSzDrF8FEr2CtoEAE&adk=3564425803&tt=1315&bs=1585%2C1200&mtos=1106,1106,1106,1106,1106&tos=1106,0,0,0,0&p=540,1043,790,1343&mcvt=1106&rs=3&ht=0&tfs=221&tls=1327&mc=1&lte=1&bas=0&bac=0&met=no&avms=nio&niot_obs=10&niot_cbk=204&md=2&lm=2&rst=1571187401928&rpt=281&isd=0&msd=0&ext=mvo%3D-1%26brt%3D175&oseid=3&xdi=0&xosd=1&ps=1585%2C4412&ss=1600%2C1200&pt=13&bin=1&deb=1-6-6-17-12-14-120-11-0-0-0&tvt=1322&r=v&id=osdim&vs=4&uc=12&upc=1&tgt=DIV&cl=1&cec=1&clc=1&cac=1&cd=0x0&itpl=19&v=20191014
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 00:56:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=5&q=1&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&f=0&j=&t=1571187402144&de=954172403795&cu=1571187402144&m=1247&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4412&le=1&lf=164&lg=1&lh=110&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1222&an=1017&gi=1&gf=1222&gg=1017&ix=1222&ic=1222&ez=1&ck=1017&kw=830&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1222&bx=1017&ci=1017&jz=830&dj=1&aa=1&ad=1119&cn=914&gn=1&gk=1119&gl=914&ik=1119&co=1119&cp=1033&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1033&cd=830&ah=1033&am=830&rf=0&re=1&ft=1119&fv=914&fw=914&wb=1&cl=0&at=0&d=4797955119%3A2608978925%3A5192378298%3A138290557510&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=728x90&zMoatPS=top&zMoatSZPS=728x90%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=728&zMoatH=90&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatSlotId=leader-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-top-5da66ac669b2d&hv=CBS%20Attribute&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=809155209&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme.m3u8
www.zdnet.com/video/manifest/
3 KB
1 KB
XHR
General
Full URL
https://www.zdnet.com/video/manifest/university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme.m3u8?device=ott&change-to-host=techrepublicmedia.akamaized.net&secure=true
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1f7c7ddb87b51f4efb6fd81e3b5a994124a9a01f2a626b430f366422783a541f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
403
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 16 Oct 2019 00:56:44 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 16 Oct 2019 00:56:44 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
11a5685c-c6fd-4686-a39f-72c8e67d3dcf
content-type
application/x-mpegURL
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Wed, 16 Oct 2019 02:26:44 GMT
10d31225525ff5790a490d4d-adobeorg.xml
cbsinteractive.hb.omtrdc.net/settings/
228 B
624 B
XHR
General
Full URL
https://cbsinteractive.hb.omtrdc.net/settings/10d31225525ff5790a490d4d-adobeorg.xml?r=1571187403493
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.213.196.95 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-18-213-196-95.compute-1.amazonaws.com
Software
nginx /
Resource Hash
0e4e46fa1aa04c24e793912d7aabaa2f2b0f7dc03d73cf74fbe12cb84f062554

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:58:03 GMT
Last-Modified
Fri, 06 Sep 2019 08:23:13 GMT
Server
nginx
ETag
"5d721771-e4"
Access-Control-Allow-Methods
OPTIONS,GET
Content-Type
application/xml
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Location
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Content-Type
Content-Length
228
ads
securepubads.g.doubleclick.net/gampad/
29 KB
7 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1521057445033877&correlator=4308186782980222&output=ldjh&impl=fifs&adsid=NT&eid=21062415%2C21062818&vrg=2019100301&guci=1.2.0.0.2.2.0.0&plat=1%3A536903688%2C2%3A536903688%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20191016&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=320x50%7C11x11%2C641x321&fluid=height%2C0&prev_scp=pos%3Dtop%26strnativekey%3D8ec3a4f3%7Cpos%3Dtop&eri=1&cust_params=buyingcycle%3Ddiscover%26topic%3Dsecurity%252Copen-source%252Cdeveloper%26tag%3Dbitcoin%252Ctarget%26mfr%3Dbitcoin%26prodtype%3Dprojection%252Cpackaging%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%26env%3Dprod%26firstpg%3D1%26vguid%3D2713c768-4b09-44e9-b2cd-eda8443c4c92%26session%3Dg%26subses%3D5&cookie=ID%3D4c9557f773ab92b8%3AT%3D1571187401%3AS%3DALNI_MbPjUx26l_qjQ8CDA4g7FcsRkQGfA&cookie_enabled=1&bc=31&abxe=1&lmt=1571187403&dt=1571187403506&dlt=1571187399651&idt=408&frm=20&biw=1585&bih=1200&oid=3&adxs=208%2C-12245933&adys=1880%2C-12245933&adks=815030799%2C3451049764&ucis=h%7Ci&ifi=10&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&dssz=98&icsg=0&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=770x11%7C770x3022&msz=770x11%7C641x361&psts=Ci4IvL321hFCA9GcH3gB6AHaytv9ggSCAgyZ0q4H0eCgC5nQoQvRAk8MP6IVP5Hm%2CCicIus_1qxPoAcbkiZaDBIICDJnSrgfR4KALmdChC9EC1DdhwiIcYS8%2CCicIus_1qxPoAenX-JWDBIICDJnSrgfR4KALmdChC9ECkb5CqQ33wVA%2CCiYI6fjgeOgBzvuMjYMEggIMmdKuB9HgoAuZ0KEL0QL5nnzQsRuCVw%2CCiYIqcqxc-gBsrD8jIMEggIMmdKuB9HgoAuZ0KEL0QKd_fwnmPUHug%2CCicIhNOZ_RHoAbnfqIGDBIICDJnSrgfR4KALmdChC9ECMcvTeFl0rEs&ga_vid=1407702978.1571187401&ga_sid=1571187401&ga_hid=2052576964&fws=4%2C132&ohw=1585%2C1585
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
eba13304ca87bcbd2f8be5eec27fa4e40481360a80ab1d162369aaa446d6e8b2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:43 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
7289
x-xss-protection
0
google-lineitem-id
4745189935,4745327422
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138239344157,138239368367
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.zdnet.com/m3d0s1/xhr/right-rail/
11 KB
2 KB
XHR
General
Full URL
https://www.zdnet.com/m3d0s1/xhr/right-rail/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1822-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
286e650919e3c74874ddee5dcb391a9c15010b110521848dc3cd68373a5053c5
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
1612
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 16 Oct 2019 00:56:44 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
bbc3c4b4-4190-4e51-a35b-0aece088d33b
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Wed, 16 Oct 2019 00:56:44 GMT
s05956233592438
saa.cbsi.com/b/ss/cnetzdnetglobalsite/1/JS-2.3.0/
43 B
227 B
Image
General
Full URL
https://saa.cbsi.com/b/ss/cnetzdnetglobalsite/1/JS-2.3.0/s05956233592438?AQB=1&ndh=1&pf=1&t=16%2F9%2F2019%202%3A56%3A43%203%20-120&mid=67792456393505865770038177176228707028&aid=2ED3356405158000-400F2721603365D6&aamlh=6&ce=UTF-8&g=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&c.&siteEdition=eu&siteSection=editorial&siteType=responsive%20web&articleId=157b9f8e-dd1a-4d3b-ae1a-c84c6ef29cb9&articleType=content_article&articleTitle=hacker%20backdoors%20popular%20javascript%20library%20to%20steal%20bitcoin%20funds&pageType=article&pageViewGuid=2713c768-4b09-44e9-b2cd-eda8443c4c92&userState=not%20authenticated&userType=anon&deviceType=desktop&siteRsids=cnetzdnetglobalsite&siteCode=zdnet&pageUrl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&sitePrimaryRsid=cnetzdnetglobalsite&userStatus=not%20authenticated&siteHier=zdnet%3Asecurity%7Copen%20source%7Cdeveloper&topicPrimaryId=113c25b6-ec91-11e3-95d2-02911863765e&videoAuthor=zdnet%20editors&Network=zdnet&tl=University%20forced%20to%20shut%20down%20network%20to%20stop%20Bitcoin%20mining%20scheme&mediaAutoPlay=true&mediaMuted=true&mediaIsPaidContent=false&a.&contentType=vod&media.&name=f9aeba02-37c5-49c2-b289-c56da46af960&friendlyName=University%20forced%20to%20shut%20down%20network%20to%20stop%20Bitcoin%20mining%20scheme&length=46&playerName=UVPJS_0.42.297&view=true&vsid=1571187403494186039256&.media&.a&.c&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&pe=ms_s&pev3=video&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&AQE=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.188.31.119 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-15-188-31-119.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:43 GMT
x-content-type-options
nosniff
x-c
master-1047.I1d1c81.M0-302
p3p
CP="This is not a P3P policy"
status
200
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Thu, 17 Oct 2019 00:56:43 GMT
server
jag
xserver
anedge-95484cfc6-zqmdd
etag
3374099258033537024-4616013651637401692
vary
*
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Tue, 15 Oct 2019 00:56:43 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=5&q=1&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&f=0&j=&t=1571187402232&de=518729050864&cu=1571187402232&m=1314&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4412&le=1&lf=102&lg=1&lh=67&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1308&an=1072&gi=1&gf=1308&gg=1072&ix=1308&ic=1308&ez=1&ck=1072&kw=871&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1308&bx=1072&ci=1072&jz=871&dj=1&aa=1&ad=1176&cn=940&gn=1&gk=1176&gl=940&ik=1176&co=1176&cp=1074&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1074&cd=871&ah=1074&am=871&rf=0&re=1&ft=1176&fv=940&fw=940&wb=1&cl=0&at=0&d=4797955119%3A2608978925%3A5192378298%3A138290277353&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x250&zMoatPS=top&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatSlotId=mpu-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-plus-top-5da66ac669b2d&hv=CBS%20Attribute&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=1567957547&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
loader.js
cdn.taboola.com/libtrc/cbsinteractive-zdnet/
84 KB
19 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
feb1a21858c27eaa2b2f94e9c7999ba2318bb17f52d6060aa82a541b1513d500

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
w7eyj9Pzzn6SeTHCSJBv.XwW67DdB2Pr
content-encoding
gzip
etag
"0f1fe88b52b2b758ee0a846541052024"
age
23811
x-cache
HIT
status
200
content-length
18763
x-amz-id-2
ebPH0wwgh51kevUThg+3dwtR5rnfDGGvoDMGyKrAcrw7PeDLEb4ooU+y8aL4vK50WDcxjY7VbQA=
x-served-by
cache-fra19166-FRA
last-modified
Tue, 15 Oct 2019 10:13:28 GMT
server
AmazonS3
x-timer
S1571187405.596265,VS0,VE0
date
Wed, 16 Oct 2019 00:56:44 GMT
vary
Accept-Encoding
x-amz-request-id
9BC2686790DEA878
via
1.1 varnish
cache-control
private,max-age=14401
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
32
x-cache-hits
1
view
securepubads.g.doubleclick.net/pcs/ Frame AB1A
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuCoMZwAVTWy_y4Qm8_0uhAYZoulPpaI1w2U_aj0mTG0dmeqRi7SveUE7rjm0K4UgvOT2sFXGuuji3D0_aCd-hMFmQZ7f3sAuoY5cfdsZwXhg1RpoDigDbluO552Sh2CwYT3uc3yA0pDMD8uZajplpqc_1DJZQ-Ub_lBsd_mxZ2-q7PLlA3d5IKnhKPtoAdnphIZtBbdH3ohPqKv-oyWvCWuzwS9nEoOpAeXC7oAouAAlDGX5d4w9G6lUkeS-ZA_ywpnabJJIrn&sig=Cg0ArKJSzO_EkGQUxBiZEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 00:56:43 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame AB1A
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29551
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:43 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame AB1A
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:43 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=44635
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
view
securepubads.g.doubleclick.net/pcs/ Frame F6C4
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvsoInLwKk_zqPva0h_SFXD2NkncT80MtAZxEh_YqtiM6DefLYYV901fN-aricNK_icrQsMfC9E0Otusy-DvWeCWTQU0I6Z3ipv57EpbX7Q1tZE2xRPs-K4YH7vcUUWZatfabZMuQ-nR7X8HjqGITPrew1HHFAWPnkK7bISDB6eQWELNOqaaQIL3ILZKDoFiGcqOZIEPFvxAC6NpmEfUek2d9mEcX0RV24d0A5ijgEHrUieinDwpHSNSu_hxt7BnFgUTNqLF3hd&sig=Cg0ArKJSzFbzm4HXv7kOEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 00:56:43 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame F6C4
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571051767941600"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29551
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:43 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame F6C4
305 KB
101 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:43 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 19:12:57 GMT
Server
AmazonS3
x-amz-request-id
9073494F6B56554C
ETag
"90057ee6dd9ded5b49509cb6336f58d4"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=44635
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103402
x-amz-id-2
JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571187403668&de=143465156017&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=38&cb=0&ym=0&cu=1571187403668&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745189935%3A138239344157&zMoatPS=top&zMoatPT=article&zMoatW=11&zMoatH=11&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=11x11&zMoatSZPS=11x11%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1356996903&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1571187403682&de=37203230934&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=42&cb=0&ym=0&cu=1571187403682&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745327422%3A138239368367&zMoatPS=top&zMoatPT=article&zMoatW=641&zMoatH=321&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=641x321&zMoatSZPS=641x321%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=928659134&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:43 GMT
/
cbsinteractive.hb.omtrdc.net/
0
163 B
XHR
General
Full URL
https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=saa.cbsi.com&h:sc:ssl=1&s:user:aid=2ED3356405158000-400F2721603365D6&s:user:mid=67792456393505865770038177176228707028&s:aam:blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&l:aam:loc_hint=6&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_0.42.297&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1571187403494186039256&s:event:type=start&l:event:duration=1&l:event:playhead=0&l:event:ts=1571187403499&l:event:prev_ts=-1&s:asset:type=main&s:asset:name=University%20forced%20to%20shut%20down%20network%20to%20stop%20Bitcoin%20mining%20scheme&s:asset:video_id=f9aeba02-37c5-49c2-b289-c56da46af960&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=46&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0&s:meta:siteEdition=eu&s:meta:siteSection=editorial&s:meta:siteType=responsive%20web&s:meta:articleId=157b9f8e-dd1a-4d3b-ae1a-c84c6ef29cb9&s:meta:articleType=content_article&s:meta:articleTitle=hacker%20backdoors%20popular%20javascript%20library%20to%20steal%20bitcoin%20funds&s:meta:pageType=article&s:meta:pageViewGuid=2713c768-4b09-44e9-b2cd-eda8443c4c92&s:meta:userState=not%20authenticated&s:meta:userType=anon&s:meta:deviceType=desktop&s:meta:siteRsids=cnetzdnetglobalsite&s:meta:siteCode=zdnet&s:meta:pageUrl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&s:meta:sitePrimaryRsid=cnetzdnetglobalsite&s:meta:userStatus=not%20authenticated&s:meta:siteHier=zdnet%3Asecurity%7Copen%20source%7Cdeveloper&s:meta:topicPrimaryId=113c25b6-ec91-11e3-95d2-02911863765e&s:meta:videoAuthor=zdnet%20editors&s:meta:Network=zdnet&s:meta:tl=University%20forced%20to%20shut%20down%20network%20to%20stop%20Bitcoin%20mining%20scheme&s:meta:mediaAutoPlay=true&s:meta:mediaMuted=true&s:meta:mediaIsPaidContent=false
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.213.196.95 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-18-213-196-95.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Wed, 16 Oct 2019 00:58:03 GMT
X-VaRouter-Backend
prod15
Server
nginx
Connection
keep-alive
/
cbsinteractive.hb.omtrdc.net/
0
163 B
XHR
General
Full URL
https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=saa.cbsi.com&h:sc:ssl=1&s:user:aid=2ED3356405158000-400F2721603365D6&s:user:mid=67792456393505865770038177176228707028&s:aam:blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&l:aam:loc_hint=6&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_0.42.297&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1571187403494186039256&s:event:type=play&l:event:duration=0&l:event:playhead=0&l:event:ts=1571187403499&l:event:prev_ts=-1&s:asset:type=main&s:asset:name=University%20forced%20to%20shut%20down%20network%20to%20stop%20Bitcoin%20mining%20scheme&s:asset:video_id=f9aeba02-37c5-49c2-b289-c56da46af960&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=46&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.213.196.95 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-18-213-196-95.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Wed, 16 Oct 2019 00:58:03 GMT
X-VaRouter-Backend
prod15
Server
nginx
Connection
keep-alive
/
cbsinteractive.hb.omtrdc.net/
0
163 B
XHR
General
Full URL
https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=saa.cbsi.com&h:sc:ssl=1&s:user:aid=2ED3356405158000-400F2721603365D6&s:user:mid=67792456393505865770038177176228707028&s:aam:blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&l:aam:loc_hint=6&s:cuser:userId.as=0&s:cuser:puuid.as=0&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_0.42.297&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1571187403494186039256&s:event:type=aa_start&l:event:duration=0&l:event:playhead=0&l:event:ts=1571187403544&l:event:prev_ts=-1&s:asset:type=main&s:asset:name=University%20forced%20to%20shut%20down%20network%20to%20stop%20Bitcoin%20mining%20scheme&s:asset:video_id=f9aeba02-37c5-49c2-b289-c56da46af960&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=46&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.213.196.95 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-18-213-196-95.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Wed, 16 Oct 2019 01:03:06 GMT
X-VaRouter-Backend
prod15
Server
nginx
Connection
keep-alive
2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_800.m3u8
techrepublicmedia.akamaized.net/media/2018/11/12/1368225347686/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_800/
1 KB
468 B
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2018/11/12/1368225347686/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_800/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_800.m3u8
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-72.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
8818bd3f6b3071309a7c8bb38a3310c9c41f09856ea544c26f71040418cc5cac

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:44 GMT
content-encoding
gzip
last-modified
Mon, 12 Nov 2018 15:28:46 GMT
server
AkamaiNetStorage
status
200
etag
"016fa6c945d7783f2806422aa3714edf:1542036529"
vary
Accept-Encoding
content-type
application/x-mpegURL
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
243
2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_800_0.ts
techrepublicmedia.akamaized.net/media/2018/11/12/1368225347686/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_800/
619 KB
621 KB
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2018/11/12/1368225347686/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_800/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_800_0.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-72.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
461401c6b1f379f03df0462359999f823ad78b3bd2cc36a5b8b295e3ddccd831

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:44 GMT
last-modified
Mon, 12 Nov 2018 15:28:47 GMT
server
AkamaiNetStorage
etag
"9ab833c871cb3cba7148c1e3d99a8068:1542036530"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
634312
107d88c2-4af1-49cf-a716-b3664a5eafc7
https://www.zdnet.com/
65 KB
0
Other
General
Full URL
blob:https://www.zdnet.com/107d88c2-4af1-49cf-a716-b3664a5eafc7
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1722a27cadd97e2f3f990df7a2dc01965a8eb41fdad860be096ad984dfecec7e

Request headers

Sec-Fetch-Mode
same-origin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length
66527
Content-Type
text/javascript
2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800.m3u8
techrepublicmedia.akamaized.net/media/2018/11/12/1368225347686/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800/
1 KB
468 B
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2018/11/12/1368225347686/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800.m3u8
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-72.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
2ed8cbb1d58a125f5ce5e7dd98a37757ea629c0891eff406c46df69a217e6140

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:45 GMT
content-encoding
gzip
last-modified
Mon, 12 Nov 2018 15:28:46 GMT
server
AkamaiNetStorage
status
200
etag
"e3d3577140807b7ca086d82c3a2dc71a:1542036529"
vary
Accept-Encoding
content-type
application/x-mpegURL
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
243
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=video%40zdnet.com&g=65713&p=%2Fvideo%2Fmanifest%2Funiversity-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme.m3u8&i=University%20forced%20to%20shut%20down%20network%20to%20stop%20Bitcoin%20mining%20scheme&g0=security&g1=catalin%20cimpanu&u=B40IB0BGUCd0Dx0PTI&t=DZ-AVqC2QR6JDOKktDD1XDxKBDWApr&x=0&y=0&V=116&VS=VS&n=1&b=3503&_vd=46000&_vi=Hacker%20backdoors%20popular%20JavaScript%20library%20to%20steal%20Bitcoin%20funds%20%7C%20ZDNet&_vp=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&_vh=zdnet.com&_pu=DvWRf3UzokkBiMKZL&_pt=CwhrkWC4-rpXl9-DyDTeLs_Die8I&_pr=&_vdd=zdnet.com&_vt=ct&_vs=s2&_vcs=1&_vvs=0.000905&_vpt=0&_vaup=man&_vplt=0.42.297&_vce=0&c=0.05&W=0&R=1&I=0&E=0&j=20&tz=-120&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.86.231.246 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-231-246.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Wed, 16 Oct 2019 00:56:44 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
vglnk.js
cdn.viglink.com/api/
78 KB
27 KB
Script
General
Full URL
https://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a00d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:44 GMT
content-encoding
gzip
cf-cache-status
HIT
age
106872
cf-ray
5266131e6fc5cbb8-VIE
status
200
content-length
27719
x-amz-id-2
HNEV4caKoOdziBrXGZIDp4CzG6boiBMb4TLu65nU6otYm4+p2OQwr1vWix1CX0FBodMy916W6w4=
last-modified
Mon, 16 Sep 2019 19:15:01 GMT
server
cloudflare
etag
"1545d811432c0074356408ee8f6c1e23"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
FB54A2C70C0BB866
cache-control
public, max-age=1800
accept-ranges
bytes
content-type
text/javascript
expires
Wed, 16 Oct 2019 01:26:44 GMT
0.44435725013444916
saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/
43 B
209 B
Image
General
Full URL
https://saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/0.44435725013444916?AQB=1&ce=UTF%2D8&events=event66&v0=ftag_cd:LGN22ef1e6&v2=en&v3=desktop&v4=right-rail&v5=zdnet&v10=article&v20=hacker+backdoors+popular+javascript+library+to+steal+bitcoin+funds&v22=content_article&v23=&v24=2713c768-4b09-44e9-b2cd-eda8443c4c92&v30=157b9f8e-dd1a-4d3b-ae1a-c84c6ef29cb9&v60=33161585,33164044,177650&v64=2150&v69=&c0=D%3Dv0&c2=D%3Dv2&c3=D%3Dv3&c4=D%3Dv4&c5=D%3Dv5&c10=D%3Dv10&c20=D%3Dv20&c22=D%3Dv22&c23=D%3Dv23&c24=D%3Dv24&c30=D%3Dv30&c60=D%3Dv60&c64=D%3Dv64&c69=D%3Dv69&pe=lnk_o&pev2=medusa_impression&vid=201910160-leadgen-zdnet&mid=90240133173074011141898988208131324462&aid=2D535D450507F28B-40000106A0001145&AQE=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.188.31.119 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-15-188-31-119.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:44 GMT
x-content-type-options
nosniff
x-c
master-1047.I1d1c81.M0-302
p3p
CP="This is not a P3P policy"
status
200
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Thu, 17 Oct 2019 00:56:44 GMT
server
jag
xserver
anedge-95484cfc6-x6pl4
etag
3374099258118864896-4616407352498947880
vary
*
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Tue, 15 Oct 2019 00:56:44 GMT
e.gif
dw.cbsi.com/levt/ria/
43 B
369 B
Image
General
Full URL
https://dw.cbsi.com/levt/ria/e.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=157b9f8e-dd1a-4d3b-ae1a-c84c6ef29cb9&assettitle=hacker%20backdoors%20popular%20javascript%20library%20to%20steal%20bitcoin%20funds&assettype=content_article&pubdate=2018-11-26%2020%3A31%3A00&viewguid=2713c768-4b09-44e9-b2cd-eda8443c4c92&devicetype=desktop&sitetype=responsive%20web&author=catalin%20cimpanu&authorid=85fd8691-f525-4ea2-a601-af296f629f7f&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&s8=cnetzdnetglobalsite&v23=cnetzdnetglobalsite&v19=article&v17=113c25b6-ec91-11e3-95d2-02911863765e&v20=157b9f8e-dd1a-4d3b-ae1a-c84c6ef29cb9&v16=2713c768-4b09-44e9-b2cd-eda8443c4c92&riaevent=impression&comptyp=spot&mapp=medusa_app&objtyp=medusa&eventt=log&v18=security&comp=ucwc&ts=1571187404548&tcset=utf8&im=dsjs&title=Hacker%20backdoors%20popular%20JavaScript%20library%20to%20steal%20Bitcoin%20funds%20%7C%20ZDNet&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:44 GMT
Server
Apache/2.4.25
Vary
*
Content-Type
image/gif
Cache-Control
no-cache, must-revalidate, no-transform
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=80, max=863
Content-Length
43
Expires
Fri, 23 Jan 1970 12:12:12 GMT
p
sb.scorecardresearch.com/
43 B
309 B
Image
General
Full URL
https://sb.scorecardresearch.com/p?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1571187401625&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=46000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=f9aeba02-37c5-49c2-b289-c56da46af960&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1571187404571&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=2946&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=ZDNet%20Video&ns_st_sn=*null&ns_st_en=*null&ns_st_ct=vc12&ns_st_ge=*null&ns_st_st=3000074&ns_st_ce=0&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=zdnet&c3=UVPJS%7C0_42_297&c4=3000074&c6=University%20forced%20to%20shut%20down%20network%20to%20stop%20Bitcoin%20mining%20scheme&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&c8=Hacker%20backdoors%20popular%20JavaScript%20library%20to%20steal%20Bitcoin%20funds%20%7C%20ZDNet&c9=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:44 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Mon, 01 Jan 1990 00:00:00 GMT
beacon.js
sb.scorecardresearch.com/
1 KB
1 KB
Script
General
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:44 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
902
Expires
Thu, 17 Oct 2019 00:56:44 GMT
load.js
widget.perfectmarket.com/cbsinteractive-zdnet/
13 KB
5 KB
Script
General
Full URL
https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
rwr9L97XovW8QPypI62jHvd7E2HiNZm2
content-encoding
gzip
etag
"fc0de48a0976cde02ddee0bd49a81832"
age
120
x-cache
HIT, HIT
status
200
content-length
4742
x-amz-id-2
Bz2c9kwNodx0L6M8xAJpExrz7GFvRlfRtLOPWcHSIojvVdRDzBqnQn8nRTx6YzRGVaK4v96+5vg=
x-served-by
cache-lax8649-LAX, cache-hhn4055-HHN
last-modified
Thu, 20 Oct 2016 17:48:07 GMT
server
AmazonS3
x-timer
S1571187405.657053,VS0,VE0
date
Wed, 16 Oct 2019 00:56:44 GMT
vary
Accept-Encoding,,
x-amz-request-id
1BFE0E96C42427AE
via
1.1 varnish, 1.1 varnish
cache-control
max-age=300
accept-ranges
bytes
content-type
binary/octet-stream
x-cache-hits
1, 1
impl.20191015-2-RELEASE.js
cdn.taboola.com/libtrc/
393 KB
112 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/impl.20191015-2-RELEASE.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9d4bac552bb7eff5b83c1b672de91574833ffbf9d2b3dfbffb899c073ef36d53

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
nb47doJ7dRPqXU0xQfiD4ursxz86ioDP
content-encoding
gzip
etag
"92586fd9f75bc2379f8726be70edf7bd"
age
109
x-cache
HIT
status
200
x-amz-replication-status
COMPLETED
content-length
113927
x-amz-id-2
v5dyp0OI2uzgS/gXsCD8HqloqmzEYxWyxeBnYkXvJm/6NtNSrU+7cC2DnXn/1h6rUbZ+isTqPE0=
x-served-by
cache-fra19166-FRA
last-modified
Tue, 15 Oct 2019 09:24:15 GMT
server
AmazonS3
x-timer
S1571187405.637799,VS0,VE0
date
Wed, 16 Oct 2019 00:56:44 GMT
vary
Accept-Encoding
x-amz-request-id
7A14AFA362CF586B
via
1.1 varnish
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
66
x-cache-hits
77
b
sb.scorecardresearch.com/
0
248 B
Image
General
Full URL
https://sb.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1571187404648&ns_c=UTF-8&cv=3.1e&c8=Hacker%20backdoors%20popular%20JavaScript%20library%20to%20steal%20Bitcoin%20funds%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&c9=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:44 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
pmk-201618008.1.js
widget.perfectmarket.com/cbsinteractive-zdnet/
323 KB
89 KB
Script
General
Full URL
https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
bVoOWfmxkMrYwv2s6Uu9D96fE._5IBqu
content-encoding
gzip
etag
"da73fb2066df9f51d08b6688cfb35441"
age
30891820
x-cache
HIT, HIT
status
200
content-length
91236
x-amz-id-2
T2A7wWXMDNgx2Z35EWhae8i8jDSVEo/Aqmbmta3HbEBKVMhwoZJKjGQuEf/CaAEiaINfKwR6uJs=
x-served-by
cache-lax8632-LAX, cache-hhn4055-HHN
last-modified
Thu, 20 Oct 2016 17:47:53 GMT
server
AmazonS3
x-timer
S1571187405.695404,VS0,VE0
date
Wed, 16 Oct 2019 00:56:44 GMT
vary
Accept-Encoding,,
x-amz-request-id
58FF20717A687DE4
via
1.1 varnish, 1.1 varnish
cache-control
max-age=31536000
accept-ranges
bytes
content-type
text/javascript
x-cache-hits
1694, 10
analytics.js
www.google-analytics.com/
43 KB
17 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
1525
date
Wed, 16 Oct 2019 00:31:19 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17803
expires
Wed, 16 Oct 2019 02:31:19 GMT
beacon.js
sb.scorecardresearch.com/
1 KB
1 KB
Script
General
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:44 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
902
Expires
Thu, 17 Oct 2019 00:56:44 GMT
tboptevent.html
widget.perfectmarket.com/opt/ Frame 364B
0
0
Document
General
Full URL
https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Varnish /
Resource Hash

Request headers

:method
GET
:authority
widget.perfectmarket.com
:scheme
https
:path
/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/

Response headers

status
404
server
Varnish
retry-after
0
accept-ranges
bytes
date
Wed, 16 Oct 2019 00:56:44 GMT
via
1.1 varnish
x-served-by
cache-hhn4055-HHN
x-cache
MISS
x-cache-hits
0
x-timer
S1571187405.747697,VS0,VE0
content-length
0
collect
www.google-analytics.com/r/
35 B
108 B
Image
General
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j79&aip=1&a=2052576964&t=pageview&_s=1&dl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&ul=en-us&de=UTF-8&dt=Hacker%20backdoors%20popular%20JavaScript%20library%20to%20steal%20Bitcoin%20funds%20%7C%20ZDNet&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YAhAAEAB~&jid=532219364&gjid=454301415&cid=1407702978.1571187401&tid=UA-33613588-22&_gid=2042093873.1571187405&_r=1&cd2=other&z=1377314317
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 00:56:44 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
domains
api.viglink.com/api/
42 B
487 B
XHR
General
Full URL
https://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.246.252.247 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-246-252-247.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
013184a251db896b35b3cecb6825774a077db78f7695a81d3edad63fa86dc85d

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:43 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT
settings.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/variation/var-8bfb225b-f103-49ab-955c-32d3183cf24c/
7 KB
5 KB
Script
General
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/variation/var-8bfb225b-f103-49ab-955c-32d3183cf24c/settings.js?cb=637048605067352348
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637057951420142886
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4ea5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fe074214a9c301f8c3ba319d4bab7cba8d65164dcc2077272a9cacedf8941ae2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 16 Oct 2019 00:56:44 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
2VqL9ACwktkYsY/Ec2Z++Q==
age
108647
cf-polished
origSize=7074
status
200
last-modified
Mon, 23 Sep 2019 18:34:57 GMT
x-ms-lease-status
unlocked
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
x-ms-request-id
7084f032-801e-009d-7b3d-722f81000000
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
526613206d1ecbc0-VIE
expires
Thu, 15 Oct 2020 00:56:44 GMT
lightbox_builder.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame F4B9
200 KB
27 KB
Script
General
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=637048605067352348
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637057951420142886
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4ea5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
35f3de772fc88b09b9f866de6d38f50d8716aecc446bb10456585f61834ae2c8

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 16 Oct 2019 00:56:44 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
DPY02gsPpNVzBSyytYwMZw==
age
109146
cf-polished
origSize=326600
status
200
last-modified
Mon, 23 Sep 2019 18:35:06 GMT
x-ms-lease-status
unlocked
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
x-ms-request-id
3afa8c39-501e-0131-7d3d-724843000000
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
526613207d37cbc0-VIE
expires
Thu, 15 Oct 2020 00:56:44 GMT
css
fonts.googleapis.com/ Frame F4B9
783 B
451 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Raleway
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=637048605067352348
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
3147026ff99804131affcb3cadbdfd49c0a07583682aefcc1198f57e2614d5b0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 16 Oct 2019 00:56:44 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Wed, 16 Oct 2019 00:56:44 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
expires
Wed, 16 Oct 2019 00:56:44 GMT
fancybox_sprite.png
cdn.jsdelivr.net/fancybox/2.1.5/
1 KB
1 KB
Image
General
Full URL
https://cdn.jsdelivr.net/fancybox/2.1.5/fancybox_sprite.png
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637057951420142886
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b9d6fddb0988440902fcfc72f371ecfa80ee2eb36073f9eebc17449ee41c886f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:45 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
10320031
x-cache
HIT, HIT
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
1362
x-served-by
cache-ams21050-AMS, cache-hhn1542-HHN
timing-allow-origin
*
server
cloudflare
etag
W/"552-F98Z+XYo53vgnDUr8nQl+uokglE"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
cf-ray
526613216b09cbcc-VIE
1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2
fonts.gstatic.com/s/raleway/v14/ Frame F4B9
13 KB
13 KB
Font
General
Full URL
https://fonts.gstatic.com/s/raleway/v14/1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637057951420142886
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Raleway
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 09:54:54 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 03:48:04 GMT
server
sffe
age
399711
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
13428
x-xss-protection
0
expires
Sat, 10 Oct 2020 09:54:54 GMT
tboptevent.html
widget.perfectmarket.com/opt/ Frame A40C
0
0
Document
General
Full URL
https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Varnish /
Resource Hash

Request headers

:method
GET
:authority
widget.perfectmarket.com
:scheme
https
:path
/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/

Response headers

status
404
server
Varnish
retry-after
0
accept-ranges
bytes
date
Wed, 16 Oct 2019 00:56:45 GMT
via
1.1 varnish
x-served-by
cache-hhn4055-HHN
x-cache
MISS
x-cache-hits
0
x-timer
S1571187405.042462,VS0,VE0
content-length
0
2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800_1.ts
techrepublicmedia.akamaized.net/media/2018/11/12/1368225347686/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800/
1 MB
1 MB
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2018/11/12/1368225347686/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800_1.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-72.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
0902c175c7ad8339563e9c14ad8dd10f6fb84ff98987c91089de1271c7459f83

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:45 GMT
last-modified
Mon, 12 Nov 2018 15:28:49 GMT
server
AkamaiNetStorage
etag
"781e3cd057f233bc270fef03f3f572c2:1542036530"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
1481252
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&u=DvWRf3UzokkBiMKZL&d=zdnet.com&g=65713&g0=security&g1=catalin%20cimpanu&n=1&f=00001&c=0.08&x=0&m=0&y=4401&o=1585&w=1200&j=30&R=1&W=0&I=0&E=5&e=3&r=&b=2841&t=CwhrkWC4-rpXl9-DyDTeLs_Die8I&V=116&tz=-120&_acct=anon&_vi=University%20forced%20to%20shut%20down%20network%20to%20stop%20Bitcoin%20mining%20scheme&_vp=/video/manifest/university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme.m3u8&_vdd=video%40zdnet.com&_vs=s2&_vt=ct&_vtn=null&_vd=46000&sn=3&sv=DdzkKK388AQCYnA6HmM5k9B8P4bO&sd=1&im=067b2ff3&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.86.231.246 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-231-246.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Wed, 16 Oct 2019 00:56:45 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800_2.ts
techrepublicmedia.akamaized.net/media/2018/11/12/1368225347686/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800/
1 MB
1 MB
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2018/11/12/1368225347686/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800_2.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-72.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
f25f1dbdf096fc627872010f4c1c3b4116e8acfc50c9c639a5d0dce13a77875c

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:46 GMT
last-modified
Mon, 12 Nov 2018 15:28:50 GMT
server
AkamaiNetStorage
etag
"a603457760bfbf4ad323754b63dcd292:1542036530"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
1318632
t.gif
www.lightboxcdn.com/z9g/
35 B
296 B
Image
General
Full URL
https://www.lightboxcdn.com/z9g/t.gif?c=1571187405540&h=www.zdnet.com&e=i&u=40913&b=193988&v=2544&s=empty
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4ea5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 16 Oct 2019 00:56:45 GMT
cf-cache-status
HIT
content-md5
KNaBTzCeoon4R8ac+RGUxg==
age
1014930
cf-polished
status=not_needed
x-ms-meta-cbmodifiedtime
Tue, 26 Feb 2019 00:59:40 GMT
status
200
content-length
35
x-ms-lease-status
unlocked
last-modified
Tue, 26 Feb 2019 01:15:02 GMT
server
cloudflare
etag
0x8D69B87D5A1B25F
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
x-ms-request-id
48b7eafb-401e-010c-457d-f6fd65000000
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
52661324ba2ccbc0-VIE
cf-bgj
imgq:85
json
trc.taboola.com/cbsinteractive-zdnet/trc/3/
13 KB
5 KB
Script
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/trc/3/json?tim=02%3A56%3A45.555&lti=deflated&data=%7B%22id%22%3A473%2C%22ii%22%3A%22%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22vi%22%3A1571187405552%2C%22cv%22%3A%2220191015-2-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22cmps%22%3A3%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1585%2C%22dh%22%3A4431%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A8%2C%22uim%22%3A%22alternating-thumbnails-a%3Aabp%3D0%22%2C%22uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22orig_uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22cd%22%3A3871.125%2C%22mw%22%3A770%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22deflated%22%7D
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191015-2-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
4d9987dea8fdb4f518b3147db88f0af970a57707b25cc7f26abb01c68f51c72a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:45 GMT
content-encoding
gzip
server
nginx
x-timer
S1571187406.564252,VS0,VE92
status
200
x-served-by
cache-fra19166-FRA
vary
Accept-Encoding
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
access-control-allow-credentials
true
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
via
1.1 varnish
x-cache-hits
0
gn
secure-us.imrworldwide.com/cgi-bin/
44 B
332 B
Image
General
Full URL
https://secure-us.imrworldwide.com/cgi-bin/gn?prd=dcr&ci=us-700144&ch=us-700144_c01_P&asn=defChnAsset&sessionId=argDcV85F1fQKII3fQNIwx9HMCG2e1571187401&tl=University%20forced%20to%20shut%20down%20network%20to%20stop%20Bitcoin%20mining%20scheme&prv=1&c6=vc,c01&ca=us-700144_c01_f9aeba02-37c5-49c2-b289-c56da46af960&cg=ZDNet%20Video&c13=asid,PF7B87067-BF4D-F80F-E040-070AAD316CE6&c32=segA,NA&c33=segB,NA&c34=segC,NA&c15=apn,UVPJS|0_42_297&plugv=&playerv=&sup=0&segment2=&segment1=&forward=1&ad=0&cr=4_00_99_V1_00000&c9=devid,&enc=true&c1=nuid,999&at=view&rt=video&c16=sdkv,bj.6.0.0&c27=cln,0&crs=&lat=&lon=&c29=plid,1571187401696558&c30=bldv,6.0.0.440&st=dcr&c7=osgrp,&c8=devgrp,&c10=plt,&c40=adbid,&c14=osver,NA&c26=dmap,1&dd=&hrd=&wkd=&c35=adrsid,&c36=cref1,f9aeba02-37c5-49c2-b289-c56da46af960&c37=cref2,&c11=agg,1&c12=apv,&c51=adl,0&c52=noad,0&sd=46&devtypid=&pc=NA&c53=fef,n&c54=oad,&c55=cref3,&c57=adldf,2&ai=f9aeba02-37c5-49c2-b289-c56da46af960&c3=st,c&c64=starttm,1571187404&adid=f9aeba02-37c5-49c2-b289-c56da46af960&c58=isLive,false&c59=sesid,QeVaCDeid7XqLYISaV7iHnBKaU3G21571187405&c61=createtm,1571187404&c63=pipMode,&c68=bndlid,&nodeTM=&logTM=&c73=phtype,&c74=dvcnm,&c76=adbsnid,&c77=adsuprt,1&uoo=&evdata=&c71=ottflg,0&c72=otttyp,none&c44=progen,&davty=0&si=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&c66=mediaurl,&c62=sendTime,1571187404&rnd=410979
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.17.222.87 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-17-222-87.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 00:56:45 GMT
server
nginx
status
200
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin
*
cache-control
no-cache
content-type
image/gif
content-length
44
expires
Thu, 01 Dec 1994 16:00:00 GMT
m
secure-us.imrworldwide.com/cgi-bin/
44 B
332 B
Image
General
Full URL
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-700144&c29=plid,1571187401696558&c30=bldv,6.0.0.440&c6=vc,c01&c3=&cg=ZDNet%20Video&tl=dav0-University%20forced%20to%20shut%20down%20network%20to%20stop%20Bitcoin%20mining%20scheme&c9=devid,&pr=iag.sid,1000011&pr=iag.tfid,902&pr=iag.bcr,us-700144&pr=iag.pgm,University%20forced%20to%20shut%20down%20network%20to%20stop%20Bitcoin%20mining%20scheme&pr=iag.epi,University%20forced%20to%20shut%20down%20network%20to%20stop%20Bitcoin%20mining%20scheme%7C%7C%7Csf&pr=iag.seg,1&pr=iag.pd,www.zdnet.com&pr=iag.oad,na&pr=iag.fp,sf&pr=iag.cp,soc&c10=plt,&c26=dmap,3&tp=gg&c24=zip,99&uoo=&c68=bndlid,&c61=createtm,1571187404&nodeTM=&logTM=&c73=phtype,&c74=dvcnm,&c62=sendTime,1571187404&rnd=395635
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.17.222.87 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-17-222-87.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 00:56:45 GMT
server
nginx
status
200
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin
*
cache-control
no-cache
content-type
image/gif
content-length
44
expires
Thu, 01 Dec 1994 16:00:00 GMT
userx.20191015-2-RELEASE.es6.js
cdn.taboola.com/libtrc/
22 KB
8 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/userx.20191015-2-RELEASE.es6.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d49694398338f69cc0f851793b72bd98bc5a87c6d73153696f6b82c9a8194003

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
aM19SK2yVRfP7k3Y1lb8EantqIDYRzDy
content-encoding
gzip
etag
"c0e77aaea9efbf1f626158294f5d6177"
age
80
x-cache
HIT
status
200
x-amz-replication-status
COMPLETED
content-length
7736
x-amz-id-2
0PxXIEhof8YrsA5LNjjrP9wyaWqC20Vs2m8spi+wYivbI7T4nIXt+tWn715G9Ht7ciffEDh9iG4=
x-served-by
cache-fra19166-FRA
last-modified
Tue, 15 Oct 2019 09:24:41 GMT
server
AmazonS3
x-timer
S1571187406.692524,VS0,VE0
date
Wed, 16 Oct 2019 00:56:45 GMT
vary
Accept-Encoding
x-amz-request-id
FCC8E2F0229EC3C6
via
1.1 varnish
cache-control
private,max-age=14400
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
66
x-cache-hits
20
social
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
54 B
Image
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=deflated&ri=01d0560628e190145bbd0cc35ba2e7f7&sd=v2_840001e54af5960234347076c598e942_d4e32f18-e6df-4f82-a372-15fbc6da3ba9-tuct49ff04d_1571187405_1571187405_CNawjgYQzro_GPDlxJDdLSABKAEwODib4wlAhIoQSKO4GlCj7BBYAWAA&pi=/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&wi=9184692179266196698&pt=text&vi=1571187405552&st=social-available&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22ctx%22%2C%22ism%22%3Afalse%2C%22srx%22%3A1600%2C%22sry%22%3A1200%2C%22pd%22%3Anull%2C%22tpl%22%3A%22%22%2C%22url%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%22%2C%22rref%22%3A%22%22%2C%22sref%22%3A%22_sessionPending_%22%2C%22hdl%22%3A%22%22%2C%22sec%22%3A%22%22%2C%22aut%22%3A%22%22%2C%22img%22%3A%22%22%2C%22v%22%3A13%7D%5D%7D&tim=02%3A56%3A45.702&id=9427&llvl=1&cv=20191015-2-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 00:56:45 GMT
via
1.1 varnish
server
nginx
x-timer
S1571187406.709308,VS0,VE9
x-served-by
cache-fra19166-FRA
status
204
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
content-type
image/gif
x-cache-hits
0
social
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
83 B
Image
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=deflated&ri=01d0560628e190145bbd0cc35ba2e7f7&sd=v2_840001e54af5960234347076c598e942_d4e32f18-e6df-4f82-a372-15fbc6da3ba9-tuct49ff04d_1571187405_1571187405_CNawjgYQzro_GPDlxJDdLSABKAEwODib4wlAhIoQSKO4GlCj7BBYAWAA&pi=/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&wi=9184692179266196698&pt=text&vi=1571187405552&st=social-visible&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A1%2C%22ln%22%3A%22above-fold%22%2C%22lx%22%3A362%2C%22ly%22%3A545%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%2C%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A1%2C%22ln%22%3A%22above-fold%22%2C%22lx%22%3A670%2C%22ly%22%3A545%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%5D%7D&tim=02%3A56%3A45.703&id=7902&llvl=1&cv=20191015-2-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 00:56:45 GMT
via
1.1 varnish
server
nginx
x-timer
S1571187406.709351,VS0,VE9
x-served-by
cache-fra19166-FRA
status
204
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
content-type
image/gif
x-cache-hits
0
available
trc.taboola.com/cbsinteractive-zdnet/log/3/
0
262 B
XHR
General
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/available?route=AM%3AAM%3AV&lti=deflated
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191015-2-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 00:56:45 GMT
via
1.1 varnish
server
nginx
x-timer
S1571187406.715837,VS0,VE9
x-served-by
cache-fra19166-FRA
status
204
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
content-type
image/gif
x-cache-hits
0
ee93cc92018bc78735b73762ff9fec2c.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
18 KB
18 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ee93cc92018bc78735b73762ff9fec2c.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
a726258020b93a3a0fafedd2f9ed981df4ed2712dc077dde64b543595deeb96b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:45 GMT
via
1.1 varnish, 1.1 varnish
age
30953
edge-cache-tag
445616684633719905846181723623225717405,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200, 200 OK
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ee93cc92018bc78735b73762ff9fec2c.png
content-length
18199
x-request-id
117d76e798ecc9b9af3f13479ce2246f
x-served-by
cache-fra19166-FRA, cache-fra19166-FRA
last-modified
Tue, 15 Oct 2019 08:44:19 GMT
server
cloudinary
x-timer
S1571187406.723459,VS0,VE0
etag
"5109697870669aaecf55d772fe443d97"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 18
1a1ac15271660f3d945b4904ef437371.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
5 KB
6 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1a1ac15271660f3d945b4904ef437371.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
2f179c0918ddb8af28b17040e1822625ffa2635a08e4fa98521d0a95dc9a554b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:45 GMT
via
1.1 varnish, 1.1 varnish
age
868456
edge-cache-tag
616089906201828448420340560109273106143,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Wed, 16 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1a1ac15271660f3d945b4904ef437371.jpg
content-length
5431
x-served-by
cache-fra19142-FRA, cache-fra19166-FRA
last-modified
Sun, 15 Sep 2019 13:12:03 GMT
server
cloudinary
x-timer
S1571187406.723396,VS0,VE0
etag
"033e210ecc99607a94af83829efcf625"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 4
b32a09a7248de168f46f184b016c54f1.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
15 KB
15 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/b32a09a7248de168f46f184b016c54f1.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
0cabe6274db4c9eff14e8bc52577008b669e0c3273e8278d8d17b2e79f45330b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:45 GMT
via
1.1 varnish, 1.1 varnish
age
518388
edge-cache-tag
477653300893459891901563255571045079575,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sat, 12 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/b32a09a7248de168f46f184b016c54f1.jpg
content-length
14982
x-served-by
cache-fra19124-FRA, cache-fra19166-FRA
last-modified
Wed, 11 Sep 2019 05:10:56 GMT
server
cloudinary
x-timer
S1571187406.723446,VS0,VE0
etag
"07cc858c163a7a8d5ea40ff9484dad9e"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 9
cb4e875bb1d2e915c95202b364799edb.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
9 KB
10 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/cb4e875bb1d2e915c95202b364799edb.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
8b03b46424d2e66f1d79c0e0a6e7a284c103c937fa4efba31fadb89eaedeef36

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:45 GMT
via
1.1 varnish, 1.1 varnish
age
593695
edge-cache-tag
483494632291498733667052070264370579903,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sun, 27 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/cb4e875bb1d2e915c95202b364799edb.jpg
content-length
9441
x-served-by
cache-fra19169-FRA, cache-fra19166-FRA
last-modified
Thu, 26 Sep 2019 00:54:23 GMT
server
cloudinary
x-timer
S1571187406.723531,VS0,VE0
etag
"4c2718e20b5dd7d2a0fd8fdf4946cf31"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
ngztszbrynyhoniygu3k.gif
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//res.cloudinary.com/taboola/image/upload/v1570425658/
14 KB
14 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//res.cloudinary.com/taboola/image/upload/v1570425658/ngztszbrynyhoniygu3k.gif
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
7344d883e409f54b40e02ed667fd674fe4622d51ce212b5d0a76ceb5264dbb96

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:45 GMT
via
1.1 varnish, 1.1 varnish
age
496471
edge-cache-tag
433779636350764314893357476251875504714,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200, 200 OK
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//res.cloudinary.com/taboola/image/upload/v1570425658/ngztszbrynyhoniygu3k.gif
content-length
14312
x-request-id
07aad79bfe3cf0d315209855c3fc3690
x-served-by
cache-fra19170-FRA, cache-fra19166-FRA
last-modified
Mon, 07 Oct 2019 13:22:09 GMT
server
cloudinary
x-timer
S1571187406.723521,VS0,VE0
etag
"21b0352afe9a903f4884c0a0e51b8f97"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
f539211219b796ffbb49949997c764f0.png
cdn.taboola.com/libtrc/static/thumbnails/
254 B
727 B
Image
General
Full URL
https://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191015-2-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC
via
1.1 varnish
etag
"dfa7b52c86e56bd67fa4002f6ed19854"
age
18282
x-cache
HIT
status
200
x-amz-replication-status
COMPLETED
content-length
254
x-amz-id-2
Vjnfq2okxpLEG/cBVxSfv3DOOCGN7KTpixt29L7DwUhoZL6eRlgDSODZqhfatrYL58q01gaLKf4=
x-served-by
cache-fra19166-FRA
last-modified
Wed, 24 Jun 2015 07:14:11 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567
x-timer
S1571187406.729733,VS0,VE0
date
Wed, 16 Oct 2019 00:56:45 GMT
x-amz-request-id
F6D91014AAA6CDC4
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
image/png
abp
66
x-cache-hits
10177
18bba55e3319272e8e1d9de8de081ed9.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
16 KB
16 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/18bba55e3319272e8e1d9de8de081ed9.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
dc891bedd3aee1665fa1fba798397ef18d684b609ef1d5e3ca12d07425cd0d59

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:45 GMT
via
1.1 varnish, 1.1 varnish
age
1272194
edge-cache-tag
347866380659636486029754653488070557317,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200, 200 OK
x-cache
HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/18bba55e3319272e8e1d9de8de081ed9.jpg
content-length
16150
x-request-id
78767b8831f77ee9
x-served-by
cache-fra19161-FRA, cache-fra19166-FRA
last-modified
Mon, 30 Sep 2019 08:15:20 GMT
server
cloudinary
x-timer
S1571187406.733654,VS0,VE0
etag
"4076a34e99a4e6e709f2b84b0a9f70fa"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 1
cd7c7f6611269f715b53225a36c5ac0c.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
10 KB
11 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/cd7c7f6611269f715b53225a36c5ac0c.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
171184c3c0268092ecc4eb87bac9ca17699e5e21bc64bb7dd65262a8a2cd8c71

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:45 GMT
via
1.1 varnish, 1.1 varnish
age
563435
edge-cache-tag
545354792372282410140987439030951001210,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sat, 12 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/cd7c7f6611269f715b53225a36c5ac0c.jpg
content-length
10711
x-served-by
cache-fra19133-FRA, cache-fra19166-FRA
last-modified
Wed, 11 Sep 2019 10:09:21 GMT
server
cloudinary
x-timer
S1571187406.733744,VS0,VE1
etag
"4d86b2cf194156fb6b4cc449d90d4af1"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
43c9f126584c39cf6b30123bd50433f4.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
11 KB
12 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/43c9f126584c39cf6b30123bd50433f4.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
9685abb0c75b0d3f7e5f636700f37eb431db9829f8e8d8e75ec3bcc90351cb02

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:45 GMT
via
1.1 varnish, 1.1 varnish
age
1592882
edge-cache-tag
456155458219469488587744820456437945899,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sat, 05 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/43c9f126584c39cf6b30123bd50433f4.jpg
content-length
11329
x-served-by
cache-fra19130-FRA, cache-fra19166-FRA
last-modified
Wed, 04 Sep 2019 07:31:17 GMT
server
cloudinary
x-timer
S1571187406.733785,VS0,VE0
etag
"301573d00e8d7587ceecd2d3506418a4"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
ee93cc92018bc78735b73762ff9fec2c.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
18 KB
18 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ee93cc92018bc78735b73762ff9fec2c.png
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
a726258020b93a3a0fafedd2f9ed981df4ed2712dc077dde64b543595deeb96b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:45 GMT
via
1.1 varnish, 1.1 varnish
age
30953
edge-cache-tag
445616684633719905846181723623225717405,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200, 200 OK
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ee93cc92018bc78735b73762ff9fec2c.png
content-length
18199
x-request-id
117d76e798ecc9b9af3f13479ce2246f
x-served-by
cache-fra19166-FRA, cache-fra19166-FRA
last-modified
Tue, 15 Oct 2019 08:44:19 GMT
server
cloudinary
x-timer
S1571187406.750829,VS0,VE0
etag
"5109697870669aaecf55d772fe443d97"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 19
1a1ac15271660f3d945b4904ef437371.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
5 KB
6 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1a1ac15271660f3d945b4904ef437371.jpg
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
2f179c0918ddb8af28b17040e1822625ffa2635a08e4fa98521d0a95dc9a554b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:45 GMT
via
1.1 varnish, 1.1 varnish
age
868456
edge-cache-tag
616089906201828448420340560109273106143,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Wed, 16 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1a1ac15271660f3d945b4904ef437371.jpg
content-length
5431
x-served-by
cache-fra19142-FRA, cache-fra19166-FRA
last-modified
Sun, 15 Sep 2019 13:12:03 GMT
server
cloudinary
x-timer
S1571187406.750821,VS0,VE0
etag
"033e210ecc99607a94af83829efcf625"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 5
ngztszbrynyhoniygu3k.gif
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//res.cloudinary.com/taboola/image/upload/v1570425658/
14 KB
14 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//res.cloudinary.com/taboola/image/upload/v1570425658/ngztszbrynyhoniygu3k.gif
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
7344d883e409f54b40e02ed667fd674fe4622d51ce212b5d0a76ceb5264dbb96

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:45 GMT
via
1.1 varnish, 1.1 varnish
age
496471
edge-cache-tag
433779636350764314893357476251875504714,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200, 200 OK
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//res.cloudinary.com/taboola/image/upload/v1570425658/ngztszbrynyhoniygu3k.gif
content-length
14312
x-request-id
07aad79bfe3cf0d315209855c3fc3690
x-served-by
cache-fra19170-FRA, cache-fra19166-FRA
last-modified
Mon, 07 Oct 2019 13:22:09 GMT
server
cloudinary
x-timer
S1571187406.750871,VS0,VE0
etag
"21b0352afe9a903f4884c0a0e51b8f97"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
b32a09a7248de168f46f184b016c54f1.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
15 KB
15 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/b32a09a7248de168f46f184b016c54f1.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
0cabe6274db4c9eff14e8bc52577008b669e0c3273e8278d8d17b2e79f45330b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:45 GMT
via
1.1 varnish, 1.1 varnish
age
518388
edge-cache-tag
477653300893459891901563255571045079575,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sat, 12 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/b32a09a7248de168f46f184b016c54f1.jpg
content-length
14982
x-served-by
cache-fra19124-FRA, cache-fra19166-FRA
last-modified
Wed, 11 Sep 2019 05:10:56 GMT
server
cloudinary
x-timer
S1571187406.756931,VS0,VE0
etag
"07cc858c163a7a8d5ea40ff9484dad9e"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 10
cb4e875bb1d2e915c95202b364799edb.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
9 KB
10 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/cb4e875bb1d2e915c95202b364799edb.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
8b03b46424d2e66f1d79c0e0a6e7a284c103c937fa4efba31fadb89eaedeef36

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:45 GMT
via
1.1 varnish, 1.1 varnish
age
593695
edge-cache-tag
483494632291498733667052070264370579903,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sun, 27 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/cb4e875bb1d2e915c95202b364799edb.jpg
content-length
9441
x-served-by
cache-fra19169-FRA, cache-fra19166-FRA
last-modified
Thu, 26 Sep 2019 00:54:23 GMT
server
cloudinary
x-timer
S1571187406.756971,VS0,VE0
etag
"4c2718e20b5dd7d2a0fd8fdf4946cf31"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
18bba55e3319272e8e1d9de8de081ed9.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
16 KB
16 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/18bba55e3319272e8e1d9de8de081ed9.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
dc891bedd3aee1665fa1fba798397ef18d684b609ef1d5e3ca12d07425cd0d59

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:45 GMT
via
1.1 varnish, 1.1 varnish
age
1272194
edge-cache-tag
347866380659636486029754653488070557317,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200, 200 OK
x-cache
HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/18bba55e3319272e8e1d9de8de081ed9.jpg
content-length
16150
x-request-id
78767b8831f77ee9
x-served-by
cache-fra19161-FRA, cache-fra19166-FRA
last-modified
Mon, 30 Sep 2019 08:15:20 GMT
server
cloudinary
x-timer
S1571187406.756966,VS0,VE0
etag
"4076a34e99a4e6e709f2b84b0a9f70fa"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 2
cd7c7f6611269f715b53225a36c5ac0c.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
10 KB
11 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/cd7c7f6611269f715b53225a36c5ac0c.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
171184c3c0268092ecc4eb87bac9ca17699e5e21bc64bb7dd65262a8a2cd8c71

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:45 GMT
via
1.1 varnish, 1.1 varnish
age
563435
edge-cache-tag
545354792372282410140987439030951001210,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sat, 12 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/cd7c7f6611269f715b53225a36c5ac0c.jpg
content-length
10711
x-served-by
cache-fra19133-FRA, cache-fra19166-FRA
last-modified
Wed, 11 Sep 2019 10:09:21 GMT
server
cloudinary
x-timer
S1571187406.759392,VS0,VE0
etag
"4d86b2cf194156fb6b4cc449d90d4af1"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
43c9f126584c39cf6b30123bd50433f4.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/
11 KB
12 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/43c9f126584c39cf6b30123bd50433f4.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
9685abb0c75b0d3f7e5f636700f37eb431db9829f8e8d8e75ec3bcc90351cb02

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:45 GMT
via
1.1 varnish, 1.1 varnish
age
1592882
edge-cache-tag
456155458219469488587744820456437945899,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sat, 05 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/43c9f126584c39cf6b30123bd50433f4.jpg
content-length
11329
x-served-by
cache-fra19130-FRA, cache-fra19166-FRA
last-modified
Wed, 04 Sep 2019 07:31:17 GMT
server
cloudinary
x-timer
S1571187406.759383,VS0,VE0
etag
"301573d00e8d7587ceecd2d3506418a4"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
domains
api.viglink.com/api/
65 B
510 B
XHR
General
Full URL
https://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.246.252.247 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-246-252-247.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
c830b81b5d92dbad88c6fc11bed81ae3083d060b036661199df4080f069f6dd0

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:45 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
65
Expires
Thu, 01 Jan 1970 00:00:00 GMT
2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800_3.ts
techrepublicmedia.akamaized.net/media/2018/11/12/1368225347686/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800/
1 MB
1 MB
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2018/11/12/1368225347686/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800_3.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-72.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
25b48e980abab107dd3289f4098ebd22f2e3185cb025ee7d38ec92e5f626a01a

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:47 GMT
last-modified
Mon, 12 Nov 2018 15:28:51 GMT
server
AkamaiNetStorage
etag
"374bb5270620af23ba908cc05ad393ff:1542036531"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
1419964
count-data.js
zdnet-1.disqus.com/
243 B
766 B
Script
General
Full URL
https://zdnet-1.disqus.com/count-data.js?1=157b9f8e-dd1a-4d3b-ae1a-c84c6ef29cb9
Requested by
Host: zdnet-1.disqus.com
URL: https://zdnet-1.disqus.com/count.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
a4c03b1afa6ec6f2be9484bf25ed0ce0b2119abd01e7ebd40ecdc51c6b438902
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 00:56:47 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
nginx
Age
0
X-Frame-Options
SAMEORIGIN
Connection
keep-alive
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Vary
Accept-Encoding
Cache-Control
public, max-age=600
Strict-Transport-Security
max-age=300; includeSubdomains
Content-Type
application/javascript; charset=UTF-8
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length
205
X-XSS-Protection
1; mode=block
/
inqlnfvog763mmf771rou737u.litix.io/
43 B
349 B
XHR
General
Full URL
https://inqlnfvog763mmf771rou737u.litix.io/
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/mux.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.199.164.63 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-199-164-63.compute-1.amazonaws.com
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:47 GMT
Access-Control-Allow-Methods
POST, GET
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache,no-store,must-revalidate
Connection
keep-alive
Content-Length
43
Expires
Mon, 01 Jan 1990 00:00:00 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&f=0&j=&t=1571187402144&de=954172403795&cu=1571187402144&m=5212&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4959&le=1&lf=164&lg=1&lh=110&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=5180&an=1222&gi=1&gf=5180&gg=1222&ix=5180&ic=5180&ez=1&ck=1017&kw=830&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5180&bx=1222&ci=1017&jz=830&dj=1&aa=1&ad=5077&cn=1119&gn=1&gk=5077&gl=1119&ik=5077&co=1119&cp=1033&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4995&cd=1033&ah=4995&am=1033&rf=0&re=1&ft=5077&fv=1119&fw=914&wb=2&cl=0&at=0&d=4797955119%3A2608978925%3A5192378298%3A138290557510&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=728x90&zMoatPS=top&zMoatSZPS=728x90%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=728&zMoatH=90&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatSlotId=leader-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-top-5da66ac669b2d&hv=CBS%20Attribute&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=976072589&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:47 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:47 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&f=0&j=&t=1571187402232&de=518729050864&cu=1571187402232&m=5131&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4959&le=1&lf=102&lg=1&lh=67&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=5123&an=1308&gi=1&gf=5123&gg=1308&ix=5123&ic=5123&ez=1&ck=1072&kw=871&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5123&bx=1308&ci=1072&jz=871&dj=1&aa=1&ad=4991&cn=1176&gn=1&gk=4991&gl=1176&ik=4991&co=1176&cp=1074&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4914&cd=1074&ah=4914&am=1074&rf=0&re=1&ft=4991&fv=1176&fw=940&wb=2&cl=0&at=0&d=4797955119%3A2608978925%3A5192378298%3A138290277353&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x250&zMoatPS=top&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatSlotId=mpu-plus-top&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-plus-top-5da66ac669b2d&hv=CBS%20Attribute&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=811196930&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:47 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:47 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&f=0&j=&t=1571187402414&de=438583099005&cu=1571187402414&m=5400&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4959&le=1&lf=0&lg=1&lh=77&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A0%3A-&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&aj=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&dj=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&cq=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5185&cd=3&ah=5185&am=3&rf=0&re=1&wb=1&cl=0&at=0&d=25299489%3A251370729%3A253246569%3A138271735246&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x250&zMoatPS=bottom&zMoatSZPS=300x250%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=300&zMoatH=250&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatSlotId=mpu-bottom&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-bottom-5da66ac669b2d&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tz=mpu-bottom&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=707101348&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:47 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:47 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&vb=10&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&id=1&f=0&j=&t=1571187402428&de=795714297490&cu=1571187402428&m=5390&ar=45a16fc5efb-clean&iw=c5a7985&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4959&le=1&lf=0&lg=1&lh=68&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A0%3A-&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&aj=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&dj=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&cq=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5154&cd=3&ah=5154&am=3&rf=0&re=1&wb=1&cl=0&at=0&d=25299489%3A251370729%3A241984809%3A138271463474&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=728x90&zMoatPS=bottom&zMoatSZPS=728x90%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&zMoatW=728&zMoatH=90&zMoatVGUID=2713c768-4b09-44e9-b2cd-eda8443c4c92&zMoatSN=g&zMoatCURL=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds&zMoatDev=Desktop&zMoatSlotId=leader-plus-bottom&zMoatMMV_MAX=na&zMoatDfpSlotId=leader-plus-bottom-5da66ac669b2d&hv=Domsearch%20Early&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tz=leader-plus-bottom&iq=na&tt=na&tu=&tp=&tc=0&fs=171894&na=311959736&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 00:56:47 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 16 Oct 2019 00:56:47 GMT
2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800_4.ts
techrepublicmedia.akamaized.net/media/2018/11/12/1368225347686/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800/
1 MB
1 MB
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2018/11/12/1368225347686/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800_4.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-72.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
c2b2bed9b68a08b23a2a96ece3468ddd9d72584eb0e47392795440f92c4be982

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:48 GMT
last-modified
Mon, 12 Nov 2018 15:28:52 GMT
server
AkamaiNetStorage
etag
"1e126f6bb862fc8ea71266a0b8088544:1542036532"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
1403232
2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800_5.ts
techrepublicmedia.akamaized.net/media/2018/11/12/1368225347686/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800/
1 MB
1 MB
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2018/11/12/1368225347686/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800_5.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-72.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
d312947a314cd1c1efabb5fa3496cb47f4a96ca9b66b836c27ee7f833280f821

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:50 GMT
last-modified
Mon, 12 Nov 2018 15:28:54 GMT
server
AkamaiNetStorage
etag
"58f0451e4e6cc3bb54da97dfb6b66043:1542036534"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
1455496
ping
ping.chartbeat.net/
43 B
168 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=video%40zdnet.com&g=65713&p=%2Fvideo%2Fmanifest%2Funiversity-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme.m3u8&i=University%20forced%20to%20shut%20down%20network%20to%20stop%20Bitcoin%20mining%20scheme&g0=security&g1=catalin%20cimpanu&u=B40IB0BGUCd0Dx0PTI&t=DZ-AVqC2QR6JDOKktDD1XDxKBDWApr&x=0&y=0&V=116&VS=VS&n=1&b=3503&_vd=46000&_vi=Hacker%20backdoors%20popular%20JavaScript%20library%20to%20steal%20Bitcoin%20funds%20%7C%20ZDNet&_vp=zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F&_vh=zdnet.com&_pu=DvWRf3UzokkBiMKZL&_pt=CwhrkWC4-rpXl9-DyDTeLs_Die8I&_pr=&_vdd=zdnet.com&_vt=ct&_vs=s2&_vcs=1&_vvs=0.0059050000000000005&_vpt=4.918218&_vaup=man&_vplt=0.42.297&_vce=5&c=0.13&W=0&R=1&I=0&E=5&j=20&tz=-120&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.86.231.246 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-231-246.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Wed, 16 Oct 2019 00:56:49 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800_6.ts
techrepublicmedia.akamaized.net/media/2018/11/12/1368225347686/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800/
1 MB
0
XHR
General
Full URL
https://techrepublicmedia.akamaized.net/media/2018/11/12/1368225347686/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800/2018-11-12-wochit-university-shuts-down-network-to-thwart-bitcoin-cryptojacking-scheme_1709871_1800_6.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.72 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-72.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:51 GMT
last-modified
Mon, 12 Nov 2018 15:28:55 GMT
server
AkamaiNetStorage
etag
"de7c1093bb8e80e485046eb371f380a0:1542036535"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
1440644
/
www.zdnet.com/homepage/xhr/
249 KB
27 KB
XHR
General
Full URL
https://www.zdnet.com/homepage/xhr/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1822-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
457900d50650ec79c0e669c851e8fa06d92d6de941b2c3bbb33a58bb456ef0e9
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
26650
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 16 Oct 2019 00:40:46 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 16 Oct 2019 00:56:51 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
01e26ae2-075c-456f-b822-95b53122e6a8
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Wed, 16 Oct 2019 02:10:46 GMT
ring.gif
zdnet3.cbsistatic.com/fly/1571077774-fly/bundles/zdnetcss/images/logos/
16 KB
9 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/fly/1571077774-fly/bundles/zdnetcss/images/logos/ring.gif
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet2.cbsistatic.com/fly/1822-fly/css/core/main-3c565ba1f5-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
109175
status
200
vary
Accept-Encoding
content-length
9039
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:29:34 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da4be8e-3f75"
strict-transport-security
max-age=31536000
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 21 Oct 2019 18:37:15 GMT
ZDLogoMicroRed-x2.png
zdnet2.cbsistatic.com/fly/1571077774-fly/bundles/zdnetcss/images/logos/
2 KB
2 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/fly/1571077774-fly/bundles/zdnetcss/images/logos/ZDLogoMicroRed-x2.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet2.cbsistatic.com/fly/1822-fly/css/core/main-3c565ba1f5-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
109176
status
200
vary
Accept-Encoding
content-length
1513
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:29:34 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da4be8e-6fa"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 21 Oct 2019 18:37:15 GMT
ZDLogoMicroWhite-x2.png
zdnet1.cbsistatic.com/fly/1571077774-fly/bundles/zdnetcss/images/logos/
2 KB
1 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/fly/1571077774-fly/bundles/zdnetcss/images/logos/ZDLogoMicroWhite-x2.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1822-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://zdnet2.cbsistatic.com/fly/1822-fly/css/core/main-3c565ba1f5-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
109176
status
200
vary
Accept-Encoding
content-length
1398
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:29:34 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da4be8e-691"
strict-transport-security
max-age=31536000
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 21 Oct 2019 18:37:15 GMT
river-time-ago-f2210a157b-rev.js
zdnet4.cbsistatic.com/fly/js/components/
753 B
596 B
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/js/components/river-time-ago-f2210a157b-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
2d3e9015bb665cc4e62a0aada26a74311bf87ba40e12b896724f447a98e68a89
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
241446
status
200
vary
Accept-Encoding
content-length
426
x-xss-protection
1; mode=block
last-modified
Wed, 09 Oct 2019 19:31:13 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d9e3581-2f1"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 20 Oct 2019 05:52:42 GMT
tr-premium-promo-49ebdaab89-rev.js
zdnet2.cbsistatic.com/fly/js/components/
461 B
423 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/tr-premium-promo-49ebdaab89-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f0c8ad030a90f1ee3cdcd5910587eab25da7bb0ec6f942d979bba4d506b38380
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
579912
status
200
vary
Accept-Encoding
content-length
287
x-xss-protection
1; mode=block
last-modified
Mon, 07 Oct 2019 21:09:25 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5d9ba985-1cd"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 16 Oct 2019 07:51:39 GMT
load-more-34f6119ea4-rev.js
zdnet3.cbsistatic.com/fly/js/components/
5 KB
2 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/load-more-34f6119ea4-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f1f493f2418d851d9c9d5a6522417b0faa8e54fc93255abe5939b309a6e1465e
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
72824
status
200
vary
Accept-Encoding
content-length
1803
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:32:11 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da4bf2b-12a2"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 22 Oct 2019 04:43:06 GMT
/
www.zdnet.com/newsletter/xhr/widget-login/
2 KB
2 KB
XHR
General
Full URL
https://www.zdnet.com/newsletter/xhr/widget-login/?topic=
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1822-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f61b55dc079153ec2e9d810e57ad0a1c51ac05e592aef29be276841983e46535
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
735
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 16 Oct 2019 00:56:51 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
48880308-0621-4953-b807-34f2a9f1bc9b
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Wed, 16 Oct 2019 00:56:51 GMT
/
www.zdnet.com/m3d0s1/xhr/horizontal/
14 KB
3 KB
XHR
General
Full URL
https://www.zdnet.com/m3d0s1/xhr/horizontal/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1822-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
6563817dfb39340de0f58aedfd969cb762dac09ed4f3742c2d38a72e26a0eb75
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
1677
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 16 Oct 2019 00:56:51 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
e3a2ec33-99b7-4d53-826e-e8636d9942c4
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Wed, 16 Oct 2019 00:56:51 GMT
/
www.zdnet.com/components/tr-promo-asset/xhr/
2 KB
2 KB
XHR
General
Full URL
https://www.zdnet.com/components/tr-promo-asset/xhr/?topic=0
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1822-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e3fc7b1888e27c5c730f715e45bccf35a7b2365cef3e203e1ff840d2fe668cfb
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
623
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 16 Oct 2019 00:42:29 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 16 Oct 2019 00:56:51 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
150fd5fc-255a-4f9c-a034-b6296210554e
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Wed, 16 Oct 2019 02:12:29 GMT
load-more-1.0.js
zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/
8 KB
3 KB
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/load-more-1.0.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1822-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
24568
status
200
vary
Accept-Encoding
content-length
2472
x-xss-protection
1; mode=block
last-modified
Mon, 14 Oct 2019 18:31:01 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5da4bee5-1f51"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 22 Oct 2019 18:07:22 GMT
trp-promo-thumb.jpg
zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/core/
4 KB
4 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/core/trp-promo-thumb.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
ContentServer /
Resource Hash
41e1b82b530a565f139da63948d96402471dadea6e3e912578cc2de4426bbe41
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1707035
status
200
vary
Accept-Encoding
content-length
3552
x-xss-protection
1; mode=block
last-modified
Wed, 25 Sep 2019 14:07:41 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5d8b74ad-f53"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 03 Oct 2019 06:46:06 GMT
vglnk.js
cdn.viglink.com/api/
78 KB
27 KB
Script
General
Full URL
https://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a00d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:51 GMT
content-encoding
gzip
cf-cache-status
HIT
age
106879
cf-ray
5266134c6c94cbb8-VIE
status
200
content-length
27719
x-amz-id-2
HNEV4caKoOdziBrXGZIDp4CzG6boiBMb4TLu65nU6otYm4+p2OQwr1vWix1CX0FBodMy916W6w4=
last-modified
Mon, 16 Sep 2019 19:15:01 GMT
server
cloudflare
etag
"1545d811432c0074356408ee8f6c1e23"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
FB54A2C70C0BB866
cache-control
public, max-age=1800
accept-ranges
bytes
content-type
text/javascript
expires
Wed, 16 Oct 2019 01:26:51 GMT
0.4785962759918513
saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/
43 B
208 B
Image
General
Full URL
https://saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/0.4785962759918513?AQB=1&ce=UTF%2D8&events=event66&v0=ftag_cd:LGN22ef1e6&v2=en&v3=desktop&v4=horizontal&v5=zdnet&v10=article&v20=hacker+backdoors+popular+javascript+library+to+steal+bitcoin+funds&v22=content_article&v23=&v24=2713c768-4b09-44e9-b2cd-eda8443c4c92&v30=157b9f8e-dd1a-4d3b-ae1a-c84c6ef29cb9&v60=32945083,395551,173711,2212421&v64=2150&v69=&c0=D%3Dv0&c2=D%3Dv2&c3=D%3Dv3&c4=D%3Dv4&c5=D%3Dv5&c10=D%3Dv10&c20=D%3Dv20&c22=D%3Dv22&c23=D%3Dv23&c24=D%3Dv24&c30=D%3Dv30&c60=D%3Dv60&c64=D%3Dv64&c69=D%3Dv69&pe=lnk_o&pev2=medusa_impression&vid=201910160-leadgen-zdnet&mid=90240133173074011141898988208131324462&aid=2D535D450507F28B-40000106A0001145&AQE=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.188.31.119 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-15-188-31-119.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 00:56:51 GMT
x-content-type-options
nosniff
x-c
master-1047.I1d1c81.M0-302
p3p
CP="This is not a P3P policy"
status
200
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Thu, 17 Oct 2019 00:56:51 GMT
server
jag
xserver
anedge-95484cfc6-nsc7l
etag
3374099275213406208-4617174740748169678
vary
*
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Tue, 15 Oct 2019 00:56:51 GMT
e.gif
dw.cbsi.com/levt/ria/
0
0

json
trc.taboola.com/cbsinteractive-zdnet/trc/3/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
dw.cbsi.com
URL
https://dw.cbsi.com/levt/ria/e.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=157b9f8e-dd1a-4d3b-ae1a-c84c6ef29cb9&assettitle=hacker%20backdoors%20popular%20javascript%20library%20to%20steal%20bitcoin%20funds&assettype=content_article&pubdate=2018-11-26%2020%3A31%3A00&viewguid=2713c768-4b09-44e9-b2cd-eda8443c4c92&devicetype=desktop&sitetype=responsive%20web&author=catalin%20cimpanu&authorid=85fd8691-f525-4ea2-a601-af296f629f7f&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&s8=cnetzdnetglobalsite&v23=cnetzdnetglobalsite&v19=article&v17=113c25b6-ec91-11e3-95d2-02911863765e&v20=157b9f8e-dd1a-4d3b-ae1a-c84c6ef29cb9&v16=2713c768-4b09-44e9-b2cd-eda8443c4c92&riaevent=impression&comptyp=spot&mapp=medusa_app&objtyp=medusa&eventt=log&v18=security&comp=ucwc&ts=1571187411898&tcset=utf8&im=dsjs&title=Hacker%20backdoors%20popular%20JavaScript%20library%20to%20steal%20Bitcoin%20funds%20%7C%20ZDNet&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F
Domain
trc.taboola.com
URL
https://trc.taboola.com/cbsinteractive-zdnet/trc/3/json?tim=02%3A56%3A52.018&lti=deflated&data=%7B%22id%22%3A412%2C%22ii%22%3A%22%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22vi%22%3A1571187405552%2C%22cv%22%3A%2220191015-2-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds%2F%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22cmps%22%3A3%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1585%2C%22dh%22%3A9394%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A4%2C%22uim%22%3A%22thumbnails-a%3Aabp%3D0%22%2C%22uip%22%3A%22ZDNETfront_doorDesktop%2FTablet-Bottom%20Page%20Thumbnails%22%2C%22orig_uip%22%3A%22ZDNETfront_doorDesktop%2FTablet-Bottom%20Page%20Thumbnails%22%2C%22cd%22%3A8544.53125%2C%22mw%22%3A770%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_2%22%2C%22lt%22%3A%22deflated%22%7D

Verdicts & Comments Add Verdict or Comment

340 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| soastaTracking object| ZdnetPageVars object| ZdnetFunctions boolean| gdprConsent object| evidon object| _sf_async_config number| _sf_startpt object| _cbq object| knownServiceWorkers object| cbsiGptDivIds function| UUIDv4 string| __tealium_data_guid object| utag_data function| requirejs function| require function| define function| $ function| jQuery function| renderAdCallback function| blankAdCallback number| BOOMR_lstart object| _sp_ object| jQuery18304030592218751743 object| headertag object| googletag function| headertag_render object| pbjs object| BOOMR object| BOOMR_mq object| ggeac object| closure_memoize_cache_ object| googleToken object| googleIMState object| google_js_reporting_queue function| processGoogleToken object| utag_err boolean| utag_condload function| getCookieValue object| isInternal object| js object| s object| adData string| adCookieName undefined| adCookieData undefined| adRegion function| parseJson object| match object| utag function| runInternalUserFuncs function| cbsiInternal function| _tealium_old_error boolean| isEuUser object| vglnk object| omnitureMgr object| dwMgr object| om boolean| __v5k function| vl_cB function| vl_disable function| vglnk_15711874000336 function| lightboxjs function| lightboxlib object| _ml number| BOOMR_configt object| EF function| dw_callback function| AppMeasurement_Module_AudienceManagement function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq function| doSiteCatalystTag object| headID object| newScript object| s_c_il number| s_c_in object| _bmrEvents function| Visitor object| visitor function| DIL number| s_objectID number| s_giq number| google_srt undefined| google_measure_js_timing object| __ql string| path string| host object| scriptTags undefined| easyXDM object| AudEng object| URS object| Modernizr function| Waypoint number| _sf_endpt function| VideoStrategy object| _cbv_strategies object| debug string| firstpgvar object| DIGIOH_API object| LIGHTBOX_API object| __core-js_shared__ function| setImmediate function| clearImmediate function| UUIDv1 function| clamp object| STR undefined| UUID object| Audit undefined| _ function| Hls undefined| uuid function| addResizeListener function| removeResizeListener object| cvui object| uvpjs function| Class object| mpulseUserTiming object| _cb_shared object| pSUPERFLY_mab object| pSUPERFLY object| pSUPERFLY_video object| _cbv object| CryptoJS object| mPulseApp object| TRUE_ANTHEM undefined| vglnk_15711874005357 function| dw_anonc object| DW_anonc object| optimizely string| f0 object| omMgr undefined| vglnk_15711874006959 object| DW object| s_i_cnetzdnetglobalsite string| adBlockCookieValue object| $tealium boolean| google_noFetch number| __google_ad_urls_id number| BOOMR_onload object| ret boolean| searchOpen object| $lastFocusedInput string| pageType string| waypointContextKey function| udm_ function| ns_order object| ns_ object| ns_p string| ZN_3xeBFJDuSs0SRW5_ed string| ZN_3xeBFJDuSs0SRW5_sampleRate string| ZN_3xeBFJDuSs0SRW5_url function| fbq function| _fbq object| UA undefined| jQuery17104678823948288011_1571187400302 object| trx number| _rnd string| __prot object| __i string| disqus_shortname object| QSI object| _google_rum_ns_ object| google_persistent_state_async number| google_global_correlator function| mb function| Goog_AdSense_Lidar_sendVastEvent function| Goog_AdSense_Lidar_getViewability function| Goog_AdSense_Lidar_getUrlSignalsArray function| Goog_AdSense_Lidar_getUrlSignalsList object| ima object| google object| ADB number| google_unique_id object| google_reactive_ads_global_state object| gaGlobal object| NOLCMB object| platform function| mux function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter object| closure_lm_279764 object| NOLBUNDLE object| closure_lm_343004 object| ns object| paramsPassed object| stateObject string| BUILDVERSION object| stateEvents object| jQuery17104678823948288011 object| __google_ad_urls object| ampInaboxIframes object| ampInaboxPendingMessages boolean| google_osd_loaded boolean| google_onload_fired function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| __AMP_LOG object| __AMP_ERRORS boolean| ampInaboxInitialized object| __AMP_MODE function| __AMP_REPORT_ERROR object| ampInaboxPositionObserver object| ampInaboxFrameOverlayManager object| AMP object| Moat#G26 boolean| Moat#EVA object| MoatSuperV26 object| MoatDataJsonpRequest object| google_jobrunner object| google_ad_modifications object| google_prev_clients object| TRC object| _tblConsole object| _taboola object| _comscore undefined| msg string| pm_pgtp object| COMSCORE function| __trcCopyProps function| __trcFromError function| __trcClientTimestamp function| __trcLog function| __trcError function| __trcDebug function| __trcInfo function| __trcWarn function| __trcDOMWalker function| __trcPurgeEventHandlers function| __trcJSONify function| __trcUnJSONify function| __trcGetMargins function| __trcAttachResize function| __trcDetachResize function| __trcTrim function| __trcGetElementsByClass function| __trcToArray function| __trcObjectCreate function| PageManager function| addHashParam object| params number| trc_debug_level string| trc_article_id string| trc_item_url object| TRCImpl string| pm_ppy string| pm_geo string| _pmep string| _pmep_geo string| _pmpmk boolean| _pmasync boolean| _pmoptimization boolean| _pmoptimizationmanipulation boolean| _pmhp boolean| _pmsb function| _pmloadfile object| bbVer object| pmk object| pmglb object| pmfa object| pmad object| pmdebug_c object| _pmenv undefined| _tb_d undefined| _tb_rand function| getBBVersion function| _tb_getUrlParameter object| _pm_mcm function| pmws_request_done object| _tb_ext_xp object| _pmk function| TBWidgetStorage function| TBWidgetPersonalization function| TBWidgetWhatsApp function| TBWidgetGawkerComments function| TBWidgetGawkerPersonalization function| TBWidgetWeatherStories function| TBWidgetFBCommentPersonalization function| TBWidgetDisqusPersonalization function| TBWidgetFacebookComments function| TBWidgetCommentButton function| TBWidgetMsnTsb function| TBClickToPlayVideo function| TBClickToPlayVideoElem function| TBWidgetVideoPlayer function| TBGenericVideoModule function| TBOtherPlayer function| TBVideoMetaData function| TBKalturaPlayer function| TBBrightcovePlayer function| TBOoYalaPlayer function| TBMSNPlayer function| TBWidgetMsnTsbPersonalization function| TBVideoCarousel function| TBVideoRightRail function| TBWidgetVideoPersonalization function| TBWidgetFPORunner function| PMTargeting function| PMTracking function| PMUniversalGA function| PMMdotLabs function| PMComScore function| PMPublisher function| TBOptimization function| TBWidgetFacebook function| TBWidgetTwitter function| TBWidgetAddThis function| TBWidgetShareThis function| TBWidgetDisqus function| TBWidgetGigya function| TBWidgetReddit function| TBWidgetPinterest function| TBWidgetSC function| TBWidgetSTPPersonalization function| TBWidgetSCPersonalization function| _comcast_fn function| PMRetry function| PMGlobal function| PMIdentifier function| pmws_getlocation_done object| pmdebug object| pmws object| xq string| GoogleAnalyticsObject function| ga object| _pm_mcg object| tbopt function| PMAd function| openx_ad_request_done function| pm_image_onload_done object| google_tag_data object| gaplugins object| gaData undefined| vglnk_157118740481610 number| taboola_view_id undefined| vglnk_157118740591211 object| DISQUSWIDGETS undefined| disqus_domain

32 Cookies

Domain/Path Name / Value
.demdex.net/ Name: demdex
Value: 67923397887247179930058594082167488428
.lightboxcdn.com/ Name: __cfduid
Value: dbad183137bfb0e73cea566933111d80a1571187400
.zdnet.com/ Name: RT
Value: "sl=1&ss=1571187397594&tt=3547&obo=0&bcn=%2F%2F0211c83c.akstat.io%2F&sh=1571187401145%3D1%3A0%3A3547&dm=zdnet.com&si=ee9865fb-95ca-4265-897e-ffee9cd16d18&ld=1571187401145"
.zdnet.com/ Name: utag_main
Value: v_id:016dd2111d3f0016797eb7c589ff00079006107100b08$_sn:1$_ss:0$_st:1571189201127$ses_id:1571187400000%3Bexp-session$_pn:1%3Bexp-session$linktag:undefined%3Bexp-session
.zdnet.com/ Name: b2b-aam-segments
Value: t%3DOpen%20Source%2CDeveloper
.zdnet.com/ Name: s_cc
Value: true
.zdnet.com/ Name: fly_default_edition
Value: eu
www.zdnet.com/ Name: _cb
Value: DvWRf3UzokkBiMKZL
.zdnet.com/ Name: AMCV_10D31225525FF5790A490D4D%40AdobeOrg
Value: -894706358%7CMCMID%7C67792456393505865770038177176228707028%7CMCAAMLH-1571792200%7C6%7CMCAAMB-1571792200%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1571194600s%7CNONE%7CMCAID%7C2ED3356405158000-400F2721603365D6%7CvVersion%7C2.3.0
.zdnet.com/ Name: s_invisit
Value: true
.zdnet.com/ Name: aam_uuid
Value: 67923397887247179930058594082167488428
.zdnet.com/ Name: s_lv_zdnet_s
Value: First%20Visit
www.zdnet.com/ Name: _cb_svref
Value: null
www.zdnet.com/ Name: LDCLGFbrowser
Value: 55925cef-1a8f-492a-afd0-fcac44faa528
.zdnet.com/ Name: s_vnum
Value: 1573779400560%26vn%3D1
.zdnet.com/ Name: first_page_today
Value: false
www.zdnet.com/ Name: _chartbeat2
Value: .1571187400427.1571187400427.1.DdzkKK388AQCYnA6HmM5k9B8P4bO.1
www.zdnet.com/ Name: _cb_ls
Value: 1
.zdnet.com/ Name: zdnet_ad
Value: %7B%22type%22%3A%22gpt%22%2C%22region%22%3A%22uk%22%2C%22session%22%3A%22g%22%2C%22subSession%22%3A%225%22%7D
www.zdnet.com/ Name: XCLGFbrowser
Value: ZncAeF2masjAjdrk6Ns
.zdnet.com/ Name: nemo_highlander-sharebar
Value: sharebar%3a1%3aexclude
.zdnet.com/ Name: fly_geo
Value: {"countryCode": "de"}
www.zdnet.com/ Name: _ccmaid
Value: 3605362246684770317
.zdnet.com/ Name: s_getNewRepeat
Value: 1571187400564-New
.zdnet.com/ Name: fly_device
Value: desktop
.zdnet.com/ Name: s_lv_zdnet
Value: 1571187400565
www.zdnet.com/ Name: _ccmsi
Value: 1571187400071_5j1iorf3y|1571187400071
.zdnet.com/ Name: fly_preferred_edition
Value: eu
.demdex.net/ Name: dextp
Value: 269-1-1571187400745|477-1-1571187400845|771-1-1571187400947|22052-1-1571187401048|30646-1-1571187401149
www.zdnet.com/ Name: viewGuid
Value: 2713c768-4b09-44e9-b2cd-eda8443c4c92
.zdnet.com/ Name: AMCVS_10D31225525FF5790A490D4D%40AdobeOrg
Value: 1
.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds Name: CBS_INTERNAL
Value: 0

68 Console Messages

Source Level URL
Text
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service pending (GDPR consent not granted): script_indexexchange
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service pending (GDPR consent not granted): script_mpulse
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service pending (GDPR consent not granted): script_sourcepoint
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service pending (GDPR consent not granted): script_gpt
console-api info URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 330)
Message:
Registration of service worker /service-worker.js successful with scope:https://www.zdnet.com/
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 345)
Message:
Found registered service worker: [object ServiceWorkerRegistration]
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 792)
Message:
ADS: queuing nav-ad-5da66ac669b2d for display
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 1262)
Message:
ADS: queuing intromercial-5da66ac669b2d for display
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 1331)
Message:
ADS: queuing leader-plus-top-5da66ac669b2d for display
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 1489)
Message:
ADS: queuing inpage-video-top-5da66ac669b2d for display
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 1499)
Message:
ADS: queuing sharethrough-top-5da66ac669b2d for display
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 1770)
Message:
ADS: queuing mpu-plus-top-5da66ac669b2d for display
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 1874)
Message:
ADS: queuing dynamic-showcase-top-5da66ac669b2d for display
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 1881)
Message:
ADS: queuing mpu-middle-5da66ac669b2d for display
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 2160)
Message:
ADS: queuing mpu-bottom-5da66ac669b2d for display
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 2177)
Message:
ADS: queuing leader-plus-bottom-5da66ac669b2d for display
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service pending (GDPR consent not granted): script_sharethrough
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
GDPR consent granted
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent finally granted): script_indexexchange
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent finally granted): script_mpulse
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent finally granted): script_sourcepoint
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent finally granted): script_gpt
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent finally granted): script_sharethrough
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 9)
Message:
Missing adCookieData!
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_mpulse
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): _injectQueryStringGCP
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_chartbeat_video
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_ad
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804(Line 177)
Message:
Service: sitecatalyst
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_sharebar
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_video
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_sharebar
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_urban_airship
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_disqus_count
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_disqus_count
console-api warning URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js(Line 9)
Message:
VideoManager.initialize() did not receive a valid error callback function.
console-api log URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js(Line 9)
Message:
UVPJS 0.42.297 02/01/19 10:20:35 AM (PST)
console-api log URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js(Line 9)
Message:
[MUX] _initializePlugin
console-api warning URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js(Line 8)
Message:
mPulse: Custom Timer 'video_ploaded' is not defined
console-api log (Line 61)
Message:
blank creative loaded: 138239468890 (5 x 5, pos=nav)
console-api log (Line 17)
Message:
GIF/JPG: 138290557510 (728 x 90)
console-api log (Line 17)
Message:
GIF/JPG: 138290277353 (300 x 250)
console-api info URL: https://cdn.ampproject.org/rtv/011909241711100/amp4ads-v0.js(Line 527)
Message:
Powered by AMP ⚡ HTML – Version 1909241711100 https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 164)
Message:
Dynamic Showcase Center container ::: creative id = 138247024569
console-api log (Line 61)
Message:
blank creative loaded: 138239375540 (372 x 142, pos=)
console-api log (Line 61)
Message:
blank creative loaded: 138239468731 (372 x 142, pos=)
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_taboola
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_async_load
console-api log (Line 61)
Message:
blank creative loaded: 138239344157 (11 x 11, pos=top)
console-api log (Line 61)
Message:
blank creative loaded: 138239368367 (641 x 321, pos=top)
console-api log URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js(Line 28)
Message:
[02:56:44 GMT+0200 (Central European Summer Time).388] [ERROR] [MediaHeartbeat] API call trackPlay is unsupported in the current state.
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_taboola
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_async_load
console-api log URL: https://www.zdnet.com/article/hacker-backdoors-popular-javascript-library-to-steal-bitcoin-funds/(Line 117)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0211c83c.akstat.io
686eb71a.akstat.io
ad.doubleclick.net
ad.yieldmanager.com
ads.rubiconproject.com
adservice.google.com
adservice.google.de
api.viglink.com
api1.lightboxcdn.com
as-sec.casalemedia.com
beacon-eu2.rubiconproject.com
beacon.tru.am
c.evidon.com
c.go-mpulse.net
cbsadsales-a.akamaihd.net
cbsdfp5832910442.s.moatpixel.com
cbsi.demdex.net
cbsinteractive.hb.omtrdc.net
cdn-gl.imrworldwide.com
cdn-magiclinks.trackonomics.net
cdn.ampproject.org
cdn.jsdelivr.net
cdn.taboola.com
cdn.viglink.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
csi.gstatic.com
dpm.demdex.net
dw.cbsi.com
eus.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
geo.moatads.com
googleads.g.doubleclick.net
idsync.rlcdn.com
iicbsi-a.akamaihd.net
images.taboola.com
imasdk.googleapis.com
in.ml314.com
inqlnfvog763mmf771rou737u.litix.io
js-sec.indexww.com
l.betrad.com
lightboxapi2.azurewebsites.net
match.adsrvr.org
ml314.com
native.sharethrough.com
optimized-by.rubiconproject.com
pagead2.googlesyndication.com
ping.chartbeat.net
pixel.everesttech.net
pixel.mathtag.com
ps.eyeota.net
px.moatads.com
rev.cbsi.com
s0.2mdn.net
saa.cbsi.com
sb.scorecardresearch.com
secure-us.imrworldwide.com
secure.adnxs.com
securepubads.g.doubleclick.net
static.chartbeat.com
sync.crwdcntrl.net
tags.bluekai.com
tags.tiqcdn.com
techrepublicmedia.akamaized.net
tpc.googlesyndication.com
trc.taboola.com
tru.am
urs.zdnet.com
vidtech.cbsinteractive.com
web-sdk.urbanairship.com
widget.perfectmarket.com
www.everestjs.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagservices.com
www.lightboxcdn.com
www.summerhamster.com
www.zdnet.com
z.moatads.com
zdnet-1.disqus.com
zdnet1.cbsistatic.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
zdnet4.cbsistatic.com
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
dw.cbsi.com
trc.taboola.com
104.109.78.125
104.17.209.240
15.188.31.119
151.101.112.134
151.101.113.181
151.101.114.133
151.101.14.2
152.199.23.241
172.217.16.162
172.217.16.198
172.217.22.2
172.217.22.98
18.195.251.148
18.213.196.95
184.31.90.90
2.16.186.72
2.18.233.143
2.18.233.201
2.18.234.21
2.18.235.40
2.19.38.84
2.19.43.224
23.32.243.235
23.45.108.200
23.67.136.71
23.99.128.52
2404:6800:4006:803::2003
2600:9000:20eb:7e00:2:42d9:3100:93a1
2600:9000:2156:fc00:18:1fcd:349:ca21
2600:9000:21f3:4200:1d:8c8c:47c0:93a1
2606:4700:20::6819:a222
2606:4700:20::6819:a322
2606:4700::6810:4da5
2606:4700::6810:4ea5
2606:4700::6810:5514
2606:4700::6810:a00d
2a00:1288:110:c305::9000
2a00:1450:4001:800::2004
2a00:1450:4001:806::2006
2a00:1450:4001:80b::2003
2a00:1450:4001:814::200a
2a00:1450:4001:817::2002
2a00:1450:4001:817::200a
2a00:1450:4001:819::2003
2a00:1450:4001:81a::2002
2a00:1450:4001:81c::2002
2a00:1450:4001:824::2001
2a00:1450:4001:825::2001
2a00:1450:4001:825::200e
2a01:4a0:1338:28::c38a:ff18
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a04:4e42:1b::444
2a04:4e42:3::444
3.10.83.173
34.199.164.63
34.241.149.220
34.246.252.247
34.248.158.173
35.168.89.158
35.190.38.167
35.190.72.21
35.227.208.151
37.252.173.62
52.17.222.87
52.28.51.75
52.30.105.51
52.31.106.135
52.44.237.33
52.48.102.50
52.85.183.205
54.76.84.205
54.86.231.246
64.30.230.22
66.117.28.68
66.117.28.86
69.173.144.142
69.173.144.154
0025565f0cddfceb7ebdbc4b21d2552c894998e443153f97a6e8b353dfd9bebd
013184a251db896b35b3cecb6825774a077db78f7695a81d3edad63fa86dc85d
02675fe5ef9e0a381f3eb2bf8024ebb3dc04f88c376b07d859cf8995e9e89f42
02f3b82bf48c364a56b75c12695031ce9fa6dbc0e39af44b677d65bab6fe90fd
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
05c23cf9af6842f0505891056a5c8f2d100729227ef486f0662576a7fe33c197
06225010455f67432ed8ce3267b9f677d5f780146aff2b49064ad239317ab32a
0629946fe142c676784daa479fe86526051bfa44bdeb5e3f4608fa22b8e153ae
06d17db7c7c608e4f8f02c58f7b2dd955cac95d7ded45967ce9f29fd6bb1d2d3
06f0a9dab713f74a8425ce5ac3e9970c90911c7cfb9fbb65d0d793bcd6efb12d
07178558c596bc2fe33d99750a349d5413fa4571fc778cefbe4f4f367404f6d6
07b69027231d985f5bdcd4d5a539f120d26003feef6e9dc0a6b77a4b43a9b21f
081873caa83744b6d819ab294b08927e20b60841dd8f23a87c2a57e15f65591c
0843433e0e5a504fdb70309fb4a88836faf0afb18da5197bf5597bd8f3f9b7fe
0902c175c7ad8339563e9c14ad8dd10f6fb84ff98987c91089de1271c7459f83
0b025e60eaeed450c28bd2d98b4d71e1cf54414361e42bba58a0005fc1ac165f
0b9028c7ecccf4f31fafcfca176cd6ed38197d7b3d6ea4c107b98af8eecc525b
0bfe19716cf9c9ba0b1343bf813585bf7970dd9b3ad96d82c88874b28130edbf
0cabe6274db4c9eff14e8bc52577008b669e0c3273e8278d8d17b2e79f45330b
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017
0e4e46fa1aa04c24e793912d7aabaa2f2b0f7dc03d73cf74fbe12cb84f062554
0e581297b1902f5a598a760e1e4b864b0178db76b0ac86f4712d001a58d397ec
0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d
0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae
10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11c0a5242dcc31758eb337d7ebbd8022a4463fe918761d8d7b664172ea7793d7
171184c3c0268092ecc4eb87bac9ca17699e5e21bc64bb7dd65262a8a2cd8c71
1722a27cadd97e2f3f990df7a2dc01965a8eb41fdad860be096ad984dfecec7e
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c
196a6fadc902aef6f16f732c62380de7012bd936d3172b523975ac2a8497fed2
197c294e1520b32d787d2678660c02fd195c1c93fee3441de596ef22c34ed425
1b385970b0125346c084e96e75044167f0513fd068ee3a98e546f2698bb63e1d
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9
1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1
1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53
1dd409bef92dcc031d66743fc06ef0d12077e8ee89933e0f97a673cc565e9d7f
1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b
1e327c1a5ca1e053c252b1d5a26538b369b96c0d7f12a6c4c9a57b372f2f92ac
1e3b732162edb42ae45db702e9833d67a58ae5132f2541e78028a1425c3c83df
1ebc699ac3a4ade2e58d4c6fcd30cc56ae3927545275a36a5b03ab083e85ca6d
1f2d966fcdd7b1152e8138d86b6a4d29d875245fc802475352295b4bbbc85360
1f7c7ddb87b51f4efb6fd81e3b5a994124a9a01f2a626b430f366422783a541f
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
25b48e980abab107dd3289f4098ebd22f2e3185cb025ee7d38ec92e5f626a01a
26c03dfc87a6c421e0f9b9dae9ff719806c47cc01ea6c5e102ae262b70348075
286e650919e3c74874ddee5dcb391a9c15010b110521848dc3cd68373a5053c5
2b0b1309cfcad7590d9989bf5471456955197b15217ec8fcb811eded3996bc8b
2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff
2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab
2c459af038b187354a6342ef343b41451f024d3791bb4456c68d998ed9027ec9
2d3e9015bb665cc4e62a0aada26a74311bf87ba40e12b896724f447a98e68a89
2e7b0ab8cd79e6f2e704e000185d40a8f0601c8f0464a02ad6f6a700d8c8a079
2ed8cbb1d58a125f5ce5e7dd98a37757ea629c0891eff406c46df69a217e6140
2f179c0918ddb8af28b17040e1822625ffa2635a08e4fa98521d0a95dc9a554b
309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6
3147026ff99804131affcb3cadbdfd49c0a07583682aefcc1198f57e2614d5b0
33b6ea04e0217c65b24a23d1b34b3ddf405f47183949731200b4309b1620c25d
33e7cfb629c6fc28bec6f0039c2b843ac7d63cb54a883599ca33ce2384e251fa
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
351a3d51b623903e7766210a1167f8ae41057424c42bcb4f443b334c83d4d7d7
35f3de772fc88b09b9f866de6d38f50d8716aecc446bb10456585f61834ae2c8
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
3624e97a6a4f6fb481369929e579039d00be03b0a2e5d1f5f961c44dfd98940c
37a8b06eab08134f2037c797f4596c7688dd564a8395cb7e072577f371d8f993
39a6fb5b2f6f6d979513b1e22f40eeab7a66104ad0c0282777997f3a7aadc431
39f0e13a96fd029965b5b5fd3504853b6fe6ded07b4dd8862a0e033be626e655
3c9bb3631896aee1e930e140eb8fcbb4ad9cd9b96ec259b88b4b2fce0a55e805
3eb8b6be66b47fda8df8d590af76e23e138b32b52b9cd583974f738e2534bab0
3fafc77ea10f00519e4507fef8fb5620dfd2af85518930a9af2ca3c6ae907b56
3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22
41e1b82b530a565f139da63948d96402471dadea6e3e912578cc2de4426bbe41
420203ca7b0395ca062903c765b681e27062360484f8274a389461e4a4a071d6
43b90922c0299971e08e778c343b6175bfca9dac50ea639bc6eb231a8c86b7b0
44ac654a5d74e0f55d383818e9fb4782ea064fdc7cac8e5a4bcb71a011cad952
457900d50650ec79c0e669c851e8fa06d92d6de941b2c3bbb33a58bb456ef0e9
461401c6b1f379f03df0462359999f823ad78b3bd2cc36a5b8b295e3ddccd831
47fde6978580115677071d003782c9dd6c3d5b66ce77b13d29d1d0f4e0b2db45
4974c54f5183f50fd1f3c3d49c496fd79602f8159b6d393d3fab09e4433555dd
4a9174ab8670879484f0dc42afea0ccaa3803217a9700ef9e1fb8262aa68c651
4bb0f33f40b38593e1cba1c8b2f15703d33753bbd80f30511dd9c464a959afe7
4d565f67641c732365c3180ec1e37c7a987825faad3e8632de8a07a9101feedd
4d9987dea8fdb4f518b3147db88f0af970a57707b25cc7f26abb01c68f51c72a
4dd9331c0388eccbb0cc9be153a68fe514d97028532c20ea7c88deb6a47146fa
4f0d370e63829a91c62eb3146b33244d039125fe2636014c5d1ea63e5da077f6
4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13
506e446fb023828ecde7a5f7ce2ecf30b2e7b0bcd42443034a42453fb1d50462
56a92db0bfa0dea282298cd490a1cb25aa339907911737e089acbd55916494ee
57e1e8e64fe95a0acc0822d690633b9450b26919fcedc32958ebcf7d39393181
584c36808fe1afaa466888c8eeea28c541088a71d237bd5804b0e2399007a286
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5b73d2f81a662e7fded807866dd1457e5f74eb7b750237d81ff4baba483329f7
5c45b27a696b9cac6fa21c1f1f4bb8adb0b2dcf3b8e3cc38df7d939413d8adc3
5c700fe27a919dc843ce90ea9175a0e2eea9d24397b66a2b72a92ebdbaff0252
5e68830dc559aaaff190a56ff90d4b57ced977c79c9e177109bbb913b4443e0f
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3
5ecc6a93ec2939faa8dbf80084346c7d940f5a2181ee69343810da52902eb92d
613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155
617dcd02ee694a177e9e039ee5c2b3eaaa7cb1f02aa9d5155fd5db80863dda63
61927323a0e9653fc2a967e3ae4d1869deb6ae82802f40b59393a8464afe6a45
6227f18e898e5b7c708fc1eb1763bd1b2186bdecd6f8b81f4bc1bf84f4d7d4e6
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
64cde7db6b394925c3a99e1aac6758f54dac1b13f79f7126ef1893f1453641aa
64cfd2a647408273e2609b638b29d1f10370824f0169ee4db637edac660dfb66
6563817dfb39340de0f58aedfd969cb762dac09ed4f3742c2d38a72e26a0eb75
66c8429202a873c7d9a8af8754d2d3f01bc0812f865b7150d82d851fd9176d48
66ef1b7581d8ef7b82bfe2ca363a612a479d89b808e2241f68d3e8c75f4f06d4
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
6b58782f772eaeb73d36b47159ed802f146182cf5d8fe4cfd838e6e629e6bd1a
6b6fe84622b5fa3ed762d66c7e9e131c8ceb55da281d03292e6c43c71e111604
6b9b8448b9eabd3d7bc3578fa05235633f7105b19b16789262b910bb99c1adba
6d157866400e2e50e077448f9cf06a9f29f70e031612ad6679d3626909a4c4e5
6de73873dd441f953668e77030299f082e0f3e6335bf944d88d44978162e6609
6ebd4d2d9030877c6f99e2f82d56a711ef4558abf1b2f16987d1d95e73422431
7344d883e409f54b40e02ed667fd674fe4622d51ce212b5d0a76ceb5264dbb96
73750c75f42413cef3530520a3124063951f93d0a8411b1db8f4f78a61f53fa0
7519515446f120487635529eb54a8ae944c4accb9a1c4e24bcdc593720d3f3c5
763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd
767f0e1eba152bf65a0550c12e348717a5317b584d76aeb5ff2dea87fa8f9308
768b3795bc9fe26a19482781f11dc096d52875e31e6a07e505554dce037ca11a
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313
77682498c3ae319a10c59528b8e39180f6e08e6d5be63ef79b54cf21b8a6ec47
787b34ffd7cd823938ab8b1f40b6651327291f1b00540438e3b291d6882ee360
78ab3d8877d2158f0a40aef1d87c0863e1d63112a55f88f3d66e0d517926cce2
78f602a77cadacf7f6825a039e9e0e8901e42ea5c674837351ce82d5f58b7dea
791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac
7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082
7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8056cc5c66433142afbb70bcb1dd84cabf405a83fe65e249dd96c2d37bd4b1db
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8818bd3f6b3071309a7c8bb38a3310c9c41f09856ea544c26f71040418cc5cac
885fb8b9c3d2738bd627def3899f26d4d42641bbb868cc99d1fbc16f0ed9f4c6
88762480fb084c0725cf9c3abde10e540ebf64884fd50a86789b5eb661c38cdd
8998e68f9bb1686ca1e03fcf3f0d6ea669c32d1f3554aeea809f1b1824ff6625
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8b03b46424d2e66f1d79c0e0a6e7a284c103c937fa4efba31fadb89eaedeef36
8df4e978497b47faa09ff1ce8ca1fb28e040062d10b5487233b44d97766405b2
92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc
9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b
95ec4dea002be118a633dc5070c23358d10e179ad3de44f23ac97578c6971df7
9685abb0c75b0d3f7e5f636700f37eb431db9829f8e8d8e75ec3bcc90351cb02
96c0b52abad0655030169f3a2fb617f89a84162822448fc7a2fc143cf76ebff9
992e73adb3e1f6f91021aec811784c5c06708c938bc3843583f56ea3fac5c1a2
99754ea7d5ab93c9e5dee12af52b2375ea34d32a4d0c9efd346deb64db0169c9
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
9d33210cfff83efe9300385679fe9129399a9e6cd0cc3924784d19236d83522a
9d4bac552bb7eff5b83c1b672de91574833ffbf9d2b3dfbffb899c073ef36d53
9db8bd3e641dc88d54edf476a148e75e29b4e8ccd040cb340404d557578dcfbd
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a125ca8593289acb781a8e37646fd9ae9e6cb99ab2497f57ce3820b35d1a0f57
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a4c03b1afa6ec6f2be9484bf25ed0ce0b2119abd01e7ebd40ecdc51c6b438902
a693479b4bd3304a7570679adaab4e643ef2045d3dadd8eaa9b634dd63053b07
a6d7c4beeaf8bda515ef93af343a3b2e950cd6deb797fc9989c222e775ae8dcf
a726258020b93a3a0fafedd2f9ed981df4ed2712dc077dde64b543595deeb96b
a80ab85ac04322aefb57441850c8bac767f406605b57c95ea616a29961178aa3
acf3b5b3ade1391096f23120b725a032dce430448ba8aff2a6f0c3f9c598b2a3
ad7ed17bf4c8d9dd2511e7254670822d0f90c8fb89187f860cfbcb91821abc84
af8c2376edddd95dc21bdcc85a22c52e4ade7196ef311c0053bc16bc10ab38f8
b0a6dc928fb823a631d75370ab5fe817c74c28601c8a3c36d16e6a0f89df79fa
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1e3d2c14e73d02c96b42ade56dfbb0535e4cf0537161c2b5bce2e149a09384b
b2ab8784d5ca4bc5e4e1990ba55c6d9f041b8fe8cf41ad9afa37bc1c3dd12756
b71c90e27cb9c3e86faeafd29b0d4569787d4082bc12d380e16e253e9960cb10
b79fafb9e9f80ecaaf7c1722d1e6e290625add1be52cf8b5fa3e51fb51deb098
b801741390d0087dafca6ddd145ead69628e42ed4e3a4e0a662c96bac969e6fe
b8c15c61feffdfe68b168cf2ac8cf58867f38547da3b15d7971a75c44f16bc26
b9d6fddb0988440902fcfc72f371ecfa80ee2eb36073f9eebc17449ee41c886f
ba2fa15976662b87f31dccdd53d415b927f2118760fdafc4ac21dd2c1b234ff3
bb3b204aa2a86992cd0d767e0a2ba2ffa2db9c2691a190f3f35613c54621537d
bd59a9a9a753359b29a450a279438e6fe56d852c2e67b1aec214d1016ae76d85
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
c016c8161912be075cfe0484bd6f79648c36c47f68687ab0fee2606ca39905fc
c293a28e23c66b27bd04bc1742f3aab0ebf6c382961c1e83140f035a08ea5e5d
c2b2bed9b68a08b23a2a96ece3468ddd9d72584eb0e47392795440f92c4be982
c49acffa07f9cac138c900d59bcaea97386cbb7e38cfe412384a2572548d2c80
c5e61d79eb0a41b0681009bdc9c7babaddeb5c513f082f942078fcec9b7e1958
c649aaa88ce29f86caa50dc08e1745c9783e049656ff2d5a93ef813b7f0c662a
c830b81b5d92dbad88c6fc11bed81ae3083d060b036661199df4080f069f6dd0
c872580af551ba7c07a453c4a0b45a1ca614e3246afe7fc08f7bf2c7de4bd0b6
caab9bbec165591d5214448b624dae44a3cbc575721ba71da2f7130bbbcbc6dc
ccef1976013530f24afb6071e29f518d5679927531631712734f0c06c8742aa9
cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d256df058aa5ec69a69d76cb3794b4bce945123dcd788c6b3f8d5a103bc9ea14
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41
d312947a314cd1c1efabb5fa3496cb47f4a96ca9b66b836c27ee7f833280f821
d49694398338f69cc0f851793b72bd98bc5a87c6d73153696f6b82c9a8194003
d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c
d696da403b0169c2191d0ec0b0fcdaa85487b21b19fd58f4b1fb5b9edf40b153
d6a75907d2f5e09455d3cdd4197c508ef0d05ab6a77c6eac4fdebdbaf900bfd4
d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e
d7bdcd5e1eceaa6e29eb451dbf0c748d2d4863f71af573ce993e8290bdbd9239
d93075b1032a4aafe288899e4dcbe046028f20ec78595728c4650f928a6b9b72
d98e77e558ef5c298f4c28cdd1604914a16a3fcc9249904ba70c57d989fb6aab
d998db90f2c6420bf38e129e55b4499c575fe00b0a42af249b1e6b62987e3be8
da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016
dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dc891bedd3aee1665fa1fba798397ef18d684b609ef1d5e3ca12d07425cd0d59
dd67767c31dc810b77952c560b17434acdcf7037101f63d20994ae7960ea5076
dd787044f07fb551657e198707ea27bfddcf6cf53bd6e8bf5efd6322a5273cba
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb
df566fecc893979ef7929b2152c69d75f604ad0df88d8b405ee2530e5f1d28d7
e08209b44a15fd9f6b9977d2580034e8d3da36542235802c2722ff8db4c0a461
e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3fc7b1888e27c5c730f715e45bccf35a7b2365cef3e203e1ff840d2fe668cfb
e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a
e4b558a63bcfe3c7a628d50c22d0f9feba81649fa34e284d5de80cc3a93f53bc
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e59c8c655db8c097ed0067789aeb44ed58f25f8c68a5772bbb3f1fdc18e5e336
e812da2f13362e348f887e6eb8361bc247f6d043588aa436df4c64e4bd04e7f7
e93a0940e4230e519049eb4c56979c4c42d6a522dac7443f8b624f91380455e3
e9861478977dbf62d4a69be6936c96a1534a62caf67dcd476299ab89fe0c9f19
eb07b53d262575cef96004e2be725ac235db39262e9bb8466a2a9b85cf532aa8
eba13304ca87bcbd2f8be5eec27fa4e40481360a80ab1d162369aaa446d6e8b2
ed943dbf0f0e8f22e867bcdaabe5a1e5d7275f117907fc29626e9e1430184700
eedd64fdbf051dd4c7d461ad402eb774c36b3b7383cb01559d10c9f90d2020ac
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efd6198c3b51231f63382a066849dc8dd8d409af5bb9056265c14a1b564c3a1d
f0c8ad030a90f1ee3cdcd5910587eab25da7bb0ec6f942d979bba4d506b38380
f0fadc8f08429a9142ced1da00a5c8e0cae836e3f0112e64e27ea502ebbbb01c
f1f493f2418d851d9c9d5a6522417b0faa8e54fc93255abe5939b309a6e1465e
f25f1dbdf096fc627872010f4c1c3b4116e8acfc50c9c639a5d0dce13a77875c
f425f66d90f1150499b36ab47b56fa6fb1a68136e4f42befca20a920ff85306b
f4e897262433ce7aa0a7e81d5b43d66d199627bb16045cf573f6d0afaf008286
f5b52ad70c5d645388b52d2fadaf8a5311aee9a01436866ab9b3e2c5f02e1c22
f61b55dc079153ec2e9d810e57ad0a1c51ac05e592aef29be276841983e46535
f6460a62bcb64a288196db0162ebd1ea5e2bbc95b3725ed6ca7c08eed129d767
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9
f68ec7cf550e86cb14e4d992724157c4f625ea3f0cd7d06e9e533c17c735401d
f7b71df270660f7958f60859209972586494aff37327672ef85951f29c151716
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
f92514f4e39c16da9037f964148a09a79419744b77d611860ffc81c86aeace0a
f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee
f9784f57729f84391b084eed9e944e048f771129d65e9b58f34095fdfba86473
fa33d1db535d783b0baf4e74bdc7ce9e54633f87a03669b2803e567088d64ccb
fc2f74ca713090cca3ada9937e3236d3881bda70c638894ce09648116e8019f3
fe074214a9c301f8c3ba319d4bab7cba8d65164dcc2077272a9cacedf8941ae2
fe661e9869d2893d4e62558c00f821ff07320ef0fde7e1c313998f590f8eaed6
feb1a21858c27eaa2b2f94e9c7999ba2318bb17f52d6060aa82a541b1513d500
fecc6a43ba8f509f7dfca9ea079e17ec1f741f9ad7fbd4437071a0af6aca34d3
ff27db1c928674d49dd76d6685ccc1adeea8ac488e701c3a792c006bf7653c0d
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097
ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5