urlscan.io logo urlscan.io
SecurityTrails logo

www.zdnet.com Open in urlscan Pro
2a04:4e42:1b::444  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://secure-web.cisco.com/1ohY0l5OOTGTksqBTF7UYlcBJ-o0igyk63ons9gp5ZiDPW-BWiKr17fjbmqfVXz5S_yhTnJBgF7E5e9MP2VJqtL-C88aynEf...
Effective URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Submission: On March 26 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 23 IPs in 5 countries across 20 domains to perform 143 HTTP transactions. The main IP is 2a04:4e42:1b::444, located in Ascension Island and belongs to FASTLY, US. The main domain is www.zdnet.com.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on January 24th 2020. Valid for: a year.
This is the only time www.zdnet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2620:101:2002... 16417 (IRONPORT-...)
45 2a04:4e42:1b:... 54113 (FASTLY)
6 152.195.132.202 15133 (EDGECAST)
3 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 151.101.193.188 54113 (FASTLY)
19 172.217.22.98 15169 (GOOGLE)
1 35.190.38.167 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
6 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
18 2a00:1450:400... 15169 (GOOGLE)
1 2a04:4e42:1b:... 54113 (FASTLY)
1 3 23.55.161.33 ()
1 2 2a02:26f0:170... 20940 (AKAMAI-ASN1)
1 2a02:26f0:170... 20940 (AKAMAI-ASN1)
16 2a00:1450:400... 15169 (GOOGLE)
10 95.101.185.246 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
1 104.108.48.175 16625 (AKAMAI-AS)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 52.215.254.97 16509 (AMAZON-02)
143 23
1    2620:101:2002:11f0::1001 (United States)

ASN16417 (IRONPORT-SYSTEMS-INC, US)
secure-web.cisco.com
45    2a04:4e42:1b::444 (Ascension Island)

ASN54113 (FASTLY, US)
www.zdnet.com
zdnet4.cbsistatic.com
production-cmp.isgprivacy.cbsi.com
zdnet3.cbsistatic.com
zdnet2.cbsistatic.com
zdnet1.cbsistatic.com
6    152.195.132.202 (United States)

ASN15133 (EDGECAST, US)
cdn.cookielaw.org
3    2a02:26f0:6c00:192::11a6 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
c.go-mpulse.net
1    151.101.193.188 (United States)

ASN54113 (FASTLY, US)
at.cbsi.com
19    172.217.22.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s18-in-f98.1e100.net
securepubads.g.doubleclick.net
1    35.190.38.167 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 167.38.190.35.bc.googleusercontent.com
urs.zdnet.com
1    2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.be
3    2a00:1450:4001:819::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.com
adservice.google.de
1    2606:4700:10::6814:b944 (United States)

ASN13335 (CLOUDFLARENET, US)
geolocation.onetrust.com
6    2a02:26f0:6c00:184::11a6 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
6852bd0a.akstat.io
18    2a00:1450:4001:81b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
cdn.ampproject.org
1    2a04:4e42:1b::645 (Ascension Island)

ASN54113 (FASTLY, US)
vidtech.cbsinteractive.com
3    23.55.161.33 (United States)

ASN- ()
PTR: a23-55-161-33.deploy.static.akamaitechnologies.com
trial-eum-clientnsv4-s.akamaihd.net
ev4i6baxg6qscxt4slra-pq60dh-ac41883d1-clientnsv4-s.akamaihd.net
2    2a02:26f0:1700:d::1737:6e9a (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
trial-eum-clienttons-s.akamaihd.net
1    2a02:26f0:1700:d::1737:6e8c (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
fiaqj6absjkbikqce3yboaaabvphzexc-pq60dh-03bb5d178-clienttons-s.akamaihd.net
16    2a00:1450:4001:820::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagservices.com
pagead2.googlesyndication.com
10    95.101.185.246 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a95-101-185-246.deploy.static.akamaitechnologies.com
z.moatads.com
1    2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    104.108.48.175 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-108-48-175.deploy.static.akamaitechnologies.com
rev.cbsi.com
2    2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
2    2a00:1450:4001:81c::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
2    52.215.254.97 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-215-254-97.eu-west-1.compute.amazonaws.com
geo.moatads.com
Domain Requested by
19 securepubads.g.doubleclick.net zdnet4.cbsistatic.com
securepubads.g.doubleclick.net
www.zdnet.com
www.googletagservices.com
14 zdnet1.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
13 www.googletagservices.com www.zdnet.com
securepubads.g.doubleclick.net
rev.cbsi.com
11 tpc.googlesyndication.com securepubads.g.doubleclick.net
www.zdnet.com
tpc.googlesyndication.com
cdn.ampproject.org
10 z.moatads.com securepubads.g.doubleclick.net
10 zdnet3.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
10 zdnet4.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
7 cdn.ampproject.org securepubads.g.doubleclick.net
6 6852bd0a.akstat.io zdnet1.cbsistatic.com
c.go-mpulse.net
6 cdn.cookielaw.org www.zdnet.com
cdn.cookielaw.org
6 www.zdnet.com zdnet3.cbsistatic.com
5 pagead2.googlesyndication.com securepubads.g.doubleclick.net
4 zdnet2.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
3 c.go-mpulse.net www.zdnet.com
c.go-mpulse.net
zdnet1.cbsistatic.com
2 geo.moatads.com z.moatads.com
2 fonts.gstatic.com www.zdnet.com
2 trial-eum-clienttons-s.akamaihd.net 1 redirects
2 trial-eum-clientnsv4-s.akamaihd.net 1 redirects
2 adservice.google.com securepubads.g.doubleclick.net
www.googletagservices.com
1 adservice.google.de www.googletagservices.com
1 rev.cbsi.com www.zdnet.com
1 fonts.googleapis.com securepubads.g.doubleclick.net
1 ev4i6baxg6qscxt4slra-pq60dh-ac41883d1-clientnsv4-s.akamaihd.net
1 fiaqj6absjkbikqce3yboaaabvphzexc-pq60dh-03bb5d178-clienttons-s.akamaihd.net
1 vidtech.cbsinteractive.com zdnet2.cbsistatic.com
1 geolocation.onetrust.com cdn.cookielaw.org
1 adservice.google.be securepubads.g.doubleclick.net
1 urs.zdnet.com zdnet2.cbsistatic.com
1 at.cbsi.com zdnet4.cbsistatic.com
1 production-cmp.isgprivacy.cbsi.com www.zdnet.com
1 secure-web.cisco.com 1 redirects
143 31
Subject Issuer Validity Valid
*.zdnet.com
DigiCert SHA2 High Assurance Server CA		 2020-01-24 -
2021-06-18		 a year crt.sh
*.cbsistatic.com
DigiCert SHA2 High Assurance Server CA		 2019-02-22 -
2021-02-26		 2 years crt.sh
sa437gl.wpc.edgecastcdn.net
DigiCert SHA2 Secure Server CA		 2018-05-17 -
2020-08-19		 2 years crt.sh
*.isgprivacy.cbsi.com
DigiCert SHA2 High Assurance Server CA		 2019-10-07 -
2021-10-14		 2 years crt.sh
akstat.io
DigiCert SHA2 Secure Server CA		 2019-04-16 -
2020-06-14		 a year crt.sh
*.at.cbsi.com
DigiCert SHA2 High Assurance Server CA		 2019-12-17 -
2021-12-21		 2 years crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2020-03-03 -
2020-05-26		 3 months crt.sh
*.google.be
GTS CA 1O1		 2020-03-03 -
2020-05-26		 3 months crt.sh
*.google.com
GTS CA 1O1		 2020-03-03 -
2020-05-26		 3 months crt.sh
*.onetrust.com
DigiCert SHA2 Secure Server CA		 2018-03-12 -
2020-06-14		 2 years crt.sh
tpc.googlesyndication.com
GTS CA 1O1		 2020-03-03 -
2020-05-26		 3 months crt.sh
vidtech.cbsinteractive.com
DigiCert SHA2 High Assurance Server CA		 2018-12-13 -
2020-12-17		 2 years crt.sh
a248.e.akamai.net
DigiCert Secure Site ECC CA-1		 2019-08-13 -
2020-08-12		 a year crt.sh
moatads.com
DigiCert SHA2 Secure Server CA		 2020-01-17 -
2021-03-17		 a year crt.sh
misc-sni.google.com
GTS CA 1O1		 2020-03-03 -
2020-05-26		 3 months crt.sh
*.storage.googleapis.com
GTS CA 1O1		 2020-03-03 -
2020-05-26		 3 months crt.sh
www.cbs.com
GeoTrust RSA CA 2018		 2019-04-23 -
2020-07-22		 a year crt.sh
*.moatads.com
DigiCert SHA2 Secure Server CA		 2019-03-12 -
2021-06-10		 2 years crt.sh

This page contains 15 frames:

Primary Page: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Frame ID: 0705D35E1DB4376D28A91ED92D4D5E6C
Requests: 84 HTTP requests in this frame

Frame: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Frame ID: 45D9B51D1AC3CF3E763FC434743EEC21
Requests: 6 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsudgeudzWAiGR5-3WqitV2j9BXVmw9Q8TAIufyXVpwLewWulpP8zHirh_LSCFhi9P1o8JYpoKCcKr69Ov7vYm4lbI7llyZYrl9y4vUr5PYED7p2uQubICeGjtwU4ea2jujpo-7lrIwQ4cEwsYlJcT9w_Yf2RKHIeElA5X9d_BR28Q1ORh89OYkw66DFa_2WGr260qlHJkaDi0Nq8Q9y1fDpZiBrKx0x_LXM0qlh2AMBMUukPvWpGA_ZorPBDbncY9jSzB6cF8e7&sai=AMfl-YTm1EBVqxw84FgGy3uNdInV8tvTCnGb4HfKQq1JbGo6MaXqIUNPz5Xv3P4RnxK8o09q5QYAxpCdZi007mU8CSzywSEa0OJyz9XGPMaFwg&sig=Cg0ArKJSzE6w_VGZ4YKUEAE&urlfix=1&adurl=
Frame ID: 82587A9FC2B58B806BD8F735E08AB4A5
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvHszglsQLuAYYxpG4tUBuPfwkVvVMO7Fqcpeaaq68z4dCzAesIVqGUREOcrrlWZ8y7gX4R8D21sPrd8dYZNDq4d9g2VTVfzyEV1K5cfN_rH5w2XUvVB3g9zsuFnJQYUIfyc0vY25q8JQJUqtrrVC0VxwgTi0culUqj9oYcJBC7T36bHpSmeeoqW2HcCcHDBn0OvJbcrEvZ6vY8xosg1EvAViG1gA5Q6Ye5uE5coe4ib8obOa3cfdJ4ryIex1UZs1dIZ0ustRgN&sai=AMfl-YTaIY2_DXzBQzJC6rCZLWPB8F96ZqHhv6oxr0ZOtQX6c_ZJwpbal79upDf-Y7Wi5clRcgLdmmLCLUtT_Iz36ahxpB24Qb8tWaWwEdBvwA&sig=Cg0ArKJSzDP2N5h1TwC6EAE&urlfix=1&adurl=
Frame ID: F246CCB3DA79A3B39A3534904DF44147
Requests: 3 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Frame ID: AFC5AE06B67ABB2481356F83A1BC53D7
Requests: 19 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstqgGtTf7L4Zbz-Q0FBgrCxbLbFfuJbdIa3mTn9bBTqLBzB7vvCY7c5QI9iIhOdPjLepb8u4hDeTui0A8-xwfAy7DNlvsl7eV3ik-iv25V7NpB8qshdpv2d5OgtzqP8tQ29WNchmZYAmqu-d4UoS9rL4736tOx2-mchcVgKbJv-wJ_B9XQsFVKlqYuk1iqFMpq-kcxBS8GI3j35R8kDwF1LVhHysVUNhWhyvCiVGk9WEmtp-S1uvKgxKYV6OZPBNc-CD2mfxywl&sai=AMfl-YSRJGrsAemdILJs7TVyhB4DC6AEYI7KYoMroX8FjSALQFGVSwBHWd_cqDyuvHCdQtPHPNwmN7HjYbEBgY_48yS_duEI8VOyjTqcPvCLLg&sig=Cg0ArKJSzD-F7Kg9f1ZOEAE&urlfix=1&adurl=
Frame ID: 1450BD7139881D36414D0F3432FC52C2
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsshQPUMgeNfOPLRYDw2K0Q4PoTn7aw-SFz5gTkKa0qYftl-rLNw2GzhEFKXI12G6lqT--LlSFylkCti5RueJehsAbvxhJZCSFUVfdpC-3wXYCRasX09iwwDn8_P8IFqeMCku16oQ5HlX5yvRw4FUAiTNzpWKW7oWI0JMaHDQdvMnnM_36fGNkBE5_u6M9djDPnVsEarRtzBba1uNHtcjkzTP-clAX7ovEZhIbkgZlQcsmfdJSPMpPhbW5b_HGEdZk4lpKTJC18y&sai=AMfl-YQI25QFD58h1U6AENFZHQuDFOkJ64VBz8EMk5WSPNq58Vy4wgu6zUNujtEeJOeEfVyOt3Mrt8oma71ePwBIH_mb9FbsZvxNnr9_6Mk5AQ&sig=Cg0ArKJSzOTJiKmPOlWdEAE&urlfix=1&adurl=
Frame ID: C1E164A716FB9E59F81846A75E01AA43
Requests: 15 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvLa6LmZdPWMk2uCj_VrdKsLA_KhE0DVx4C5wU0UlsmTr2hdYSsSdcGUCyzdoixsqU0E-WLw8w8LqrX1uNMskq_bCX20ONjF5XHNd9_VqTkzWqgvSVqkYGwO0utGO0vSY05P4b6KFpTgtopxRsJdk3pTIBsss_i3XcOjNet6m5rl1pb-wylwQFtSeGUEbtVw187IKbLth3GpdOj3hyyCl6nrX786vi3D0BscVSayKIKA380PN00-7uxYU_f67_RC2xk0K7WQO6W&sai=AMfl-YSxdQB91iJJC7LHQWSvj1XqkxNBb534rkbziMVouN62Hcilh4dC6VYbjTu6U5yxuxPYR27yO4vgEBiKsVCF9f1teGNzI4o0sPzb3LtS_w&sig=Cg0ArKJSzJp3wZ8kqGQiEAE&urlfix=1&adurl=
Frame ID: 3971E79378B4C41967BDF19EC7DE23A8
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuqqbVpG8njjNPpOkioPlaGqdLgPe_JOOYSgZve1VPAOvhWxh39EZZhjvdO_MmVCnqL60TYH6DobPbZrQBGSi3tumknx-H5BnBaGI6Ze1BAiP76R1jef4Kc3xZQXIPfsEDEYJh_1ygTVwNK3DXO3rzH_3b0xVewv-3bczpFBThEtbevv8EJCmm-coBEroykOgFgV-DkLca_lCxjSXyNktxDAFqPxrr9HXJlKteKItXlTapSayz-wFOlwLtL4OnyesP4CZ_-D2Qv&sai=AMfl-YRXJPtSdqDBtM3qY-jiV3p5PMx0i6pBc8BwMm03dlsDqA3dgvQDbYMDsA3K0WkwIbLZ7bJMWSfJXQ7G2FPyM4gXRInc-24190kdzbD97g&sig=Cg0ArKJSzBBUhZuEI8hOEAE&urlfix=1&adurl=
Frame ID: F38BDC593C4172EFB12A3C50411C8CFC
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst1lG1oZfSi2ZDbYIWf1AG6eeHv5GFbqauqKM2efCRk317UaQAHa6eqp9sf_PfVngtHEZtf3-mfD_W8ctvdAdlimVqH7e9HmNtkTOSgytpnzoYF1tJgxn76RJUo03h9MVus5O2fAMHpwaA-KRKfh3Q7i27DgyjjaGQCXt-68jK-FIh2AxiKibeb3TIhsYAyMdLT94VJJb6iIkfQR5cLhGbm_LyACht8-3Cq__1b5WcyuMfDAYflc2yUQF4UYTNBa8eclpIwPM_E&sai=AMfl-YTs9QVKwphkQ8gWFzjFElSFYNrFtZejTzhrknZX7vQsB-l-qIki199kEMyw84DPz2EO7cawhln17XSx66iPCNtA_QDBcIitBCYyFvHqDQ&sig=Cg0ArKJSzJsnAd6dcg8AEAE&urlfix=1&adurl=
Frame ID: A375EFDA3FAF668EA4296D7ED8C8BF2D
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvraNa5Us6BJM0_z5soCC_LLLLegGGtKF5c8k-LdmWEKGaQ2Hmr0Nlz2lfpyap-O25DiDLfu-ZXGKGbwRG8d8K8kBXMssc9-fwSS7Rviynq5VDYzbtkvO0nt-M8MFX3fsBoSHXpXMpgOexik-jICmhht0VjBD85ZYkESDFOi8IMouU-zaCsUNPzygZ3886FeZbfIuuOwCUpQnlmE8tUQHKXx8TTuTTSJwv_0u_g1QlcriYgpjct3ZXBdaX9AeLIoGwiV_CqywQ2&sai=AMfl-YS1fczoBjLz7w_btOUEHRoOPUDV-fzgw6JhJuymyXyNqZIbGbZ_RRKOh3QhmXVyyzzzahg5vr5lTIT2ljTM-lFT0tpOXze_FztWDcKY4A&sig=Cg0ArKJSzLj0C0e6ePopEAE&urlfix=1&adurl=
Frame ID: FB2AF29DBBB77AB77246AC30AE56BA30
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: B306E3057BECD1C46A5AF64952DD42C1
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssrP7Sm4UvEfZGWXTKfkbc1R7YUN0hElEle4Zog9BZVWtww1uARpaVIBeYnpiHA3P-n6v-RfXlsudvo4BQxP9CWVJ_2NTsjVZUdwkBYeJbcckHT0fR_CnKN_4UZ2BXDA8jpEQQSie2LycQp08zjtatK5Mg3onEydXef9e5A-KZ5XqOfju1e1j1LIL6f3cRvnGf1lQQCLrU8fzyX2HAbjgzdCIKYtE9Q1jUFI0UiWYN6zs-6HdQq2zVAUcJX1pJa5naa_hzog8ZC&sig=Cg0ArKJSzL_CCrUzTJLoEAE&urlfix=1&adurl=
Frame ID: A486A4A925A0875DDF14288EA8ADF5F8
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssRm0r3B7oD627NDmOMzitiIfEWpAJ6qIONwtVkNc-KkgWaIKD4WZZEJ88R8h2DX0S98ZU-KZ3xUeuitwGg8Aa-D9wBW16vXkuipS2Ov44H2_gvUXVD2bcXBDiNXgRBwazKhYucBHsNULw0vFUd_TQWNXSHp5WUTrPba0rGu2MMax8PwgGuFvQbNArtfXZfjJhiOOmXVfBWUP8lUgE9HmxA1H6OcXKjbzXBd3RKXb5c_gNJHDrK_kuctIfe6F3AOV2mwUbfLxTL&sig=Cg0ArKJSzE4M34GtMXsQEAE&urlfix=1&adurl=
Frame ID: B99BF95DCED3E70AE77F4B9FCA61DB73
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 10F58C50968CB048604978153A55877E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://secure-web.cisco.com/1ohY0l5OOTGTksqBTF7UYlcBJ-o0igyk63ons9gp5ZiDPW-BWiKr17fjbmqfVXz5S_yhTnJBgF7E... HTTP 302
    https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/ Page URL

Page Statistics

143
Requests

100 %
HTTPS

65 %
IPv6

20
Domains

31
Subdomains

23
IPs

5
Countries

3131 kB
Transfer

9681 kB
Size

12
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://secure-web.cisco.com/1ohY0l5OOTGTksqBTF7UYlcBJ-o0igyk63ons9gp5ZiDPW-BWiKr17fjbmqfVXz5S_yhTnJBgF7E5e9MP2VJqtL-C88aynEf_8GyakUCy1XN6WC4K3fIy_ntrWmt-QBJshY_k1rqmfha8pBCoOJgieS33yhpR7evMkKNe_pd4DQbdA--JawylBXYeCHPdsy8Lqvvvz_tvQ9zkIOXw1Q4pE14IgeWmoh0uyhJHJ9teIIByMnTmVkfoUzMgtS93cTPEQyxCs2MvDcpY_lk8p6ucBUtzfcO2xVYe94NDxxF-ZaxEc6dsOxyAZHXDWlviPrd9ArmhaFAHsvTy2444LE0PtQ/https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%2F HTTP 302
    https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 65
  • https://trial-eum-clientnsv4-s.akamaihd.net/eum/getdns.txt?c=pq60dhq68 HTTP 302
  • https://ev4i6baxg6qscxt4slra-pq60dh-ac41883d1-clientnsv4-s.akamaihd.net/eum/results.txt
Request Chain 66
  • https://trial-eum-clienttons-s.akamaihd.net/eum/getdns.txt?c=pq60dhq68 HTTP 302
  • https://fiaqj6absjkbikqce3yboaaabvphzexc-pq60dh-03bb5d178-clienttons-s.akamaihd.net/eum/results.txt

143 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Redirect Chain
  • https://secure-web.cisco.com/1ohY0l5OOTGTksqBTF7UYlcBJ-o0igyk63ons9gp5ZiDPW-BWiKr17fjbmqfVXz5S_yhTnJBgF7E5e9MP2VJqtL-C88aynEf_8GyakUCy1XN6WC4K3fIy_ntrWmt-QBJshY_k1rqmfha8pBCoOJgieS33yhpR7evMkKNe_pd...
  • https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
510 KB
145 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
378a26f0ba71ef16eb3e0d7ed8505b3eab2f0396ae557ad8f0db2b947f2aab03
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.zdnet.com
:scheme
https
:path
/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
document
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document

Response headers

status
200
content-type
text/html; charset=UTF-8
x-tx-id
10d49a11-5faf-4cb7-9b06-5d0296fca0e2
x-xss-protection
1; mode=block
x-content-type-options
nosniff
referrer-policy
no-referrer-when-downgrade
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
last-modified
Thu, 26 Mar 2020 11:32:49 GMT
content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
x-frame-options
SAMEORIGIN
access-control-allow-origin
https://www.zdnet.com
content-encoding
gzip
date
Thu, 26 Mar 2020 11:32:49 GMT
cache-control
max-age=5400, private
expires
Thu, 26 Mar 2020 13:02:49 GMT
set-cookie
fly_geo={"countryCode": "de"}; max-age=604800; path=/; domain=.zdnet.com; Secure; fly_device=desktop; max-age=604800; path=/; domain=.zdnet.com; Secure; fly_preferred_edition=eu; path=/; domain=.zdnet.com; Secure; fly_default_edition=eu; path=/; domain=.zdnet.com; Secure;
vary
Accept-Encoding, User-Agent
strict-transport-security
max-age=63072000; includeSubDomains; preload
accept-ranges
bytes
content-length
148335

Redirect headers

Server
nginx/1.17.8
Date
Thu, 26 Mar 2020 11:32:47 GMT
Content-Type
text/html; charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
X-Harpe-Token
Location
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
X-Harpe-Verdict
harpe_allow
main-2e8dcfd593-rev.css
zdnet4.cbsistatic.com/fly/2028-fly/css/core/ 		350 KB
63 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://zdnet4.cbsistatic.com/fly/2028-fly/css/core/main-2e8dcfd593-rev.css
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
afd30810a1ce203bfbe57dfa6d18f1c9305e9dc90e72a0b5edeeace6fe0b7e4f
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Thu, 26 Mar 2020 11:32:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
57765
status
200
strict-transport-security
max-age=31536000
content-length
64406
x-xss-protection
1; mode=block
last-modified
Wed, 25 Mar 2020 19:19:24 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5e7baebc-5777f"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=604800
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 01 Apr 2020 19:30:04 GMT
controls-2254d0420a-rev.css
zdnet4.cbsistatic.com/fly/css/video/htmlPlayerControls/ 		17 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://zdnet4.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-2254d0420a-rev.css
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f7836b2f47db501a0ca469b5ffe30663261fa3f7c5c55eb06adb4b497e31a002
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Thu, 26 Mar 2020 11:32:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
57765
status
200
strict-transport-security
max-age=31536000
content-length
3691
x-xss-protection
1; mode=block
last-modified
Wed, 25 Mar 2020 19:19:35 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5e7baec7-4411"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=604800
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 01 Apr 2020 19:30:04 GMT
otSDKStub.js
cdn.cookielaw.org/scripttemplates/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (ama/8AAA) /
Resource Hash
8e00ebebe053ff93e139bab1a80ced2517b33572ab374ae641e0e1cfed58d8e0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 26 Mar 2020 11:32:49 GMT
content-encoding
gzip
content-md5
N1nkxqP8FRR4U7sOR6dsSg==
age
9640
x-cache
HIT
status
200
content-length
3742
x-ms-lease-status
unlocked
last-modified
Wed, 25 Mar 2020 18:55:08 GMT
server
ECAcc (ama/8AAA)
etag
0x8D7D0EE09F55024
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
3286b8f3-a01e-0079-244b-03b1ac000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
expires
Thu, 26 Mar 2020 15:32:49 GMT
optanon.js
production-cmp.isgprivacy.cbsi.com/dist/ 		35 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://production-cmp.isgprivacy.cbsi.com/dist/optanon.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
462affeccc8485529f34f0328e9ce8a661b824def972da6dcaaa42d4a2892dde
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1362
via
1.1 varnish
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; includeSubDomains
content-length
10070
x-xss-protection
1; mode=block
x-served-by
cache-hhn4065-HHN
x-amz-id-2
MSrzbM91tZ8Y+73Z6k5B0Qx1v20lZMWDoE+gifx1/fuVeZOIf06L6sKjfkIrpN55asEZwce1+M4=
last-modified
Tue, 17 Mar 2020 14:48:12 GMT
x-timer
S1585222370.842466,VS0,VE0
x-frame-options
SAMEORIGIN
etag
"5de283c95be843c6ca4d9f2b1b6d5983"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
access-control-expose-headers
X-CDN
accept-ranges
bytes
x-cache-hits
183
bidbarrel-2.12.js
zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/ads/ 		339 KB
107 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/ads/bidbarrel-2.12.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
6c5a182a02e8af890dce969225c98f7f36aaf46c0ed141c78152cba8f69dd890
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
510034
status
200
strict-transport-security
max-age=31536000
content-length
109763
x-xss-protection
1; mode=block
last-modified
Thu, 19 Mar 2020 20:18:30 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5e73d396-54cb0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 27 Mar 2020 13:52:15 GMT
catalin-cimpanu.jpg
zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/ 		907 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/catalin-cimpanu.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
70d1b63641ae86512ee80c400ae1c15c7b5d723d2c9517a75f7637b22707e13f
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 11:32:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2917492
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
865
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"621461af90cadfdaf0e8d4cc25129f91"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
citrix-bug.png
zdnet2.cbsistatic.com/hub/i/2020/01/11/adaeb9ea-e3b8-4799-8295-2f4d23aa7647/ 		12 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet2.cbsistatic.com/hub/i/2020/01/11/adaeb9ea-e3b8-4799-8295-2f4d23aa7647/citrix-bug.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f82e8053fbcd78685d9e26caebeebc38ee73eb9afa4bb36765c50ce6614eebf3
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
0
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
10847
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"ff3f6b76fcf005c7632abe3eb4df6263"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
require-2.1.2.js
zdnet2.cbsistatic.com/fly/js/libs/ 		16 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
a70d5b9ad136255942779acf94da5cc72316fde5c10c5e7707d6f1888f43dcb8
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
260278
status
200
strict-transport-security
max-age=31536000
content-length
6288
x-xss-protection
1; mode=block
last-modified
Thu, 19 Mar 2020 20:21:40 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5e73d454-3f88"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 30 Mar 2020 11:14:52 GMT
YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
c.go-mpulse.net/boomerang/ Frame 45D9 		202 KB
51 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:192::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Akamai Resource Optimizer /
Resource Hash
95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Thu, 26 Mar 2020 11:32:49 GMT
Content-Encoding
br
Last-Modified
Wed, 11 Mar 2020 17:14:33 GMT
Server
Akamai Resource Optimizer
Vary
Accept-Encoding
Content-Type
application/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800, s-maxage=604800
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
51580
truncated
/ 		31 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f3e2e0f12c5badfe408d69bf6c0fa9ce6247f9a45c849851a53b8647637cfcd0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		5 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dfd272053c730cd470302af475eb401d9be41c81f0081c20d7910f6c12732c9d

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
95783bf43b78701a92daf5ec7268db97c7144599c774821126b8cc5396724bfa

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		917 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		43 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/gif
mag-white01.png
zdnet1.cbsistatic.com/fly/1585163795-asset/bundles/zdnetcss/images/core/ 		1 KB
1021 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet1.cbsistatic.com/fly/1585163795-asset/bundles/zdnetcss/images/core/mag-white01.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://zdnet4.cbsistatic.com/fly/2028-fly/css/core/main-2e8dcfd593-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 11:32:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
57763
status
200
strict-transport-security
max-age=31536000
content-length
936
x-xss-protection
1; mode=block
last-modified
Wed, 25 Mar 2020 19:16:35 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5e7bae13-4f1"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 01 Apr 2020 19:30:05 GMT
logo.png
zdnet3.cbsistatic.com/fly/1585163795-asset/bundles/zdnetcss/images/core/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet3.cbsistatic.com/fly/1585163795-asset/bundles/zdnetcss/images/core/logo.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://zdnet4.cbsistatic.com/fly/2028-fly/css/core/main-2e8dcfd593-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 11:32:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
57763
status
200
strict-transport-security
max-age=31536000
content-length
4128
x-xss-protection
1; mode=block
last-modified
Wed, 25 Mar 2020 19:16:35 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5e7bae13-1009"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 01 Apr 2020 19:30:05 GMT
Semibold.woff2
zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/Semibold.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
21c9c7889404394d4e4c780022b56b5fa39e83b19c34eb0508561a115a1dcc6a
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://zdnet4.cbsistatic.com/fly/2028-fly/css/core/main-2e8dcfd593-rev.css
Origin
https://www.zdnet.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Mar 2020 11:32:49 GMT
x-content-type-options
nosniff
age
2410370
status
200
strict-transport-security
max-age=31536000
content-length
20344
x-xss-protection
1; mode=block
last-modified
Thu, 27 Feb 2020 13:35:38 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5e57c5aa-4f78"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Feb 2021 13:59:59 GMT
Regular.woff2
zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/Regular.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
7fa1c7b1686f9f116183456c39f7b3ed9cce063cfb428e575fe4a29ae05c4fa6
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://zdnet4.cbsistatic.com/fly/2028-fly/css/core/main-2e8dcfd593-rev.css
Origin
https://www.zdnet.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Mar 2020 11:32:49 GMT
x-content-type-options
nosniff
age
2410370
status
200
strict-transport-security
max-age=31536000
content-length
20256
x-xss-protection
1; mode=block
last-modified
Thu, 27 Feb 2020 13:35:38 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5e57c5aa-4f20"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Feb 2021 13:59:59 GMT
client-info
at.cbsi.com/lib/api/ 		99 B
354 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://at.cbsi.com/lib/api/client-info
Requested by
Host: zdnet4.cbsistatic.com
URL: https://zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/ads/bidbarrel-2.12.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.188 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Varnish /
Resource Hash
1af59b833b9f92281f5d4a22b80ae9e2c5d80ea9b82c993e070f864e75ac9dd9
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin
https://www.zdnet.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
via
1.1 varnish
x-cache
HIT
status
200
otest
at.cbsi.com
content-length
99
x-served-by
cache-ams21034-AMS
server
Varnish
x-timer
S1585222370.002895,VS0,VE0
strict-transport-security
max-age=300
access-control-allow-methods
OPTIONS, POST, GET
content-type
application/json
access-control-allow-origin
*
accept-ranges
bytes
access-control-allow-headers
*
retry-after
0
x-cache-hits
0
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		43 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: zdnet4.cbsistatic.com
URL: https://zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/ads/bidbarrel-2.12.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
sffe /
Resource Hash
10746f1ca4f7d882f4d6a0d9313451442abb605e507df9eb998b7f8e47e253c9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"467 / 218 of 1000 / last-modified: 1585081309"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
14459
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:50 GMT
bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c.json
cdn.cookielaw.org/consent/bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c/ 		4 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/consent/bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c/bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (ama/8B5A) /
Resource Hash
56b494710bd864d1b29e10a8ef614440e2d1c5eeb94c232a831b737acd298045

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin
https://www.zdnet.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
content-md5
tnKHGc+Hbu8/XNTAD7qBqA==
age
2142
x-cache
HIT
status
200
content-length
2089
x-ms-lease-status
unlocked
last-modified
Sat, 22 Feb 2020 00:49:50 GMT
server
ECAcc (ama/8B5A)
etag
0x8D7B7311F4659C5
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
9f34a99b-601e-0106-4c5d-0369cb000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
expires
Thu, 26 Mar 2020 15:32:50 GMT
main.default.js
zdnet3.cbsistatic.com/fly/2028-fly/js/ 		223 KB
73 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet3.cbsistatic.com/fly/2028-fly/js/main.default.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
b8fbbb37b4ea73998c224487d1bae84f2b75fa21ae63f0c2975cf9b50e31bea0
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
57764
status
200
strict-transport-security
max-age=31536000
content-length
74662
x-xss-protection
1; mode=block
last-modified
Wed, 25 Mar 2020 19:19:39 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5e7baecb-37b2e"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 01 Apr 2020 19:30:05 GMT
config.json
c.go-mpulse.net/api/ Frame 45D9 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5284075&v=1.632.0&if=&sl=0&si=4wovwokggf5-q7steq&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,LOGN&acao=
Requested by
Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:192::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
f9a4af01b9bd0289b2d524b9e65c320d313e2da69837d2582a82eec4b546a981

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin
https://www.zdnet.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Mar 2020 11:32:50 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
825
urs.js
urs.zdnet.com/sdk/ 		50 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://urs.zdnet.com/sdk/urs.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.38.167 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
167.38.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
via
1.1 google
last-modified
Thu, 07 Feb 2019 14:05:56 GMT
etag
"5c5c3b44-c7f5"
content-type
application/javascript
status
200
accept-ranges
bytes
alt-svc
clear
content-length
51189
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/5.12.0/ 		381 KB
92 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/5.12.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (ama/8AF2) /
Resource Hash
37a6555c40beb95044f38f03904a914fd7bd4464f505bd9d8e45b803b66219e7

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
content-md5
7Kk4zqCmlBKTWyZO1p1w1Q==
age
3048
x-cache
HIT
status
200
content-length
94107
x-ms-lease-status
unlocked
last-modified
Fri, 21 Feb 2020 20:12:32 GMT
server
ECAcc (ama/8AF2)
etag
0x8D7B70A62368476
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
74804c86-301e-00dd-485b-038b48000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
expires
Thu, 26 Mar 2020 15:32:50 GMT
mpulse-1.0.2.js
zdnet1.cbsistatic.com/fly/js/libs/ 		61 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
ea7373d7059ab32d4304249b48a91311f91d2dce5e1ebf10450f33f9a8c5f5ec
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
498404
status
200
strict-transport-security
max-age=31536000
content-length
13447
x-xss-protection
1; mode=block
last-modified
Thu, 19 Mar 2020 20:21:40 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5e73d454-f278"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 27 Mar 2020 17:06:06 GMT
integrator.js
adservice.google.be/adsid/ 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.be/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
104
x-xss-protection
0
pubads_impl_2020030501.js
securepubads.g.doubleclick.net/gpt/ 		165 KB
60 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
sffe /
Resource Hash
8ee04e0441c9e51785d17ac835a93cf4d30d90826f87350b42ba233496a26f55
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 05 Mar 2020 14:08:10 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
61481
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:50 GMT
config.json
c.go-mpulse.net/api/v2/ 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1585222370146&s=28467756243eba66399a440cb03846b55f8a91f65ad508262e246cdf4aee040e
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:192::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
a1e55792b6c1a1a6129177906fa02070a13d4033f1c176b49aba5ac4626940eb

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin
https://www.zdnet.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Mar 2020 11:32:50 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
781
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 		115 B
308 B 		Script
General
Check archive.org
Download Go to
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.12.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:b944 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6109d5731632d64df9eb483fcde4fb912fbe0e95eab63b7db6739f7a3f6ee757
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
57a08da57dbcc26d-FRA
/
6852bd0a.akstat.io/ 		0
354 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://6852bd0a.akstat.io/?h.pg=article&when=1585222370149&cdim.Site_View=desktop&t_other=custom9%7C2508&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=364a7ef2253dea32e24c87374b7a6cdc3c379a8a&h.t=1585222370162&http.initiator=api&rt.start=api&rt.si=ad3e1182-cf29-4f43-9265-646ee0cde36f&rt.ss=1585222372735&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:184::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin
https://www.zdnet.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 11:32:50 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Thu, 26 Mar 2020 11:32:50 GMT
/
6852bd0a.akstat.io/ 		0
354 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://6852bd0a.akstat.io/?h.pg=article&when=1585222370149&cdim.Site_View=desktop&t_other=custom6%7C2510&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=364a7ef2253dea32e24c87374b7a6cdc3c379a8a&h.t=1585222370162&http.initiator=api&rt.start=api&rt.si=ad3e1182-cf29-4f43-9265-646ee0cde36f&rt.ss=1585222372735&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:184::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin
https://www.zdnet.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 11:32:50 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Thu, 26 Mar 2020 11:32:50 GMT
en.json
cdn.cookielaw.org/consent/bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c/bac19328-3673-4434-b575-5b669b4d361d/ 		94 KB
14 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/consent/bc1ecd99-9ce4-4c1a-97f9-51121cc6da4c/bac19328-3673-4434-b575-5b669b4d361d/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.12.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (ama/8AE7) /
Resource Hash
d0827f83512d599378bd8e8c22241fa6ff6166c22df0cefbfab9e592870b498d

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin
https://www.zdnet.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
content-md5
naVpQbWe8gSjPtoc7a+kTw==
age
2034
x-cache
HIT
status
200
content-length
14612
x-ms-lease-status
unlocked
last-modified
Sat, 22 Feb 2020 00:50:01 GMT
server
ECAcc (ama/8AE7)
etag
0x8D7B731263A88EC
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
93fa8273-801e-0080-135d-037b4c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
expires
Thu, 26 Mar 2020 15:32:50 GMT
otFlat.json
cdn.cookielaw.org/scripttemplates/5.12.0/assets/ 		15 KB
3 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/5.12.0/assets/otFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.12.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (ama/8AC3) /
Resource Hash
7249de2725322fdd70620c4466b78479f7b4e2e070700dafc43cd520cca2052b

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin
https://www.zdnet.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
content-md5
4X6tFR1iNZJA0ugA60GXmg==
age
3049
x-cache
HIT
status
200
content-length
2748
x-ms-lease-status
unlocked
last-modified
Fri, 21 Feb 2020 20:12:29 GMT
server
ECAcc (ama/8AC3)
etag
0x8D7B70A60DF65FE
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
83dfd6b1-b01e-0083-555b-03784b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
expires
Thu, 26 Mar 2020 15:32:50 GMT
otPcPanel.json
cdn.cookielaw.org/scripttemplates/5.12.0/assets/ 		72 KB
13 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/5.12.0/assets/otPcPanel.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.12.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (ama/8AF4) /
Resource Hash
59885bfb5e656608f92c016d612e07a2b13455762a9e8c672972cbf10602a04a

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin
https://www.zdnet.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
content-md5
CHY1OTgtshtK4vchnpokaA==
age
3038
x-cache
HIT
status
200
content-length
12882
x-ms-lease-status
unlocked
last-modified
Fri, 21 Feb 2020 20:12:30 GMT
server
ECAcc (ama/8AF4)
etag
0x8D7B70A613D4F2A
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
b4435a0c-101e-0120-175b-03f27f000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
expires
Thu, 26 Mar 2020 15:32:50 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		182 KB
27 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3532951436749807&correlator=592830469042409&output=ldjh&impl=fifs&adsid=NT&vrg=2020030501&npa=1&guci=1.2.0.0.2.1.0.0&sc=1&sfv=1-0-37&ecs=20200326&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=5x5%7C7x7%2C728x90%7C970x250%7C970x66%2C300x250%7C300x600%7C300x1050%2C300x250%2C371x771%2C641x321%2C320x50%7C11x11%2C300x250%2C728x90%7C970x250%7C970x66&fluid=0%2C0%2C0%2C0%2C0%2C0%2Cheight%2C0%2C0&prev_scp=pos%3Dnav%26sl%3Dnav-ad%253FT-1000%7Cpos%3Dtop%26sl%3Dleader-plus-top%253FT-1000%7Cpos%3Dtop%26sl%3Dmpu-plus-top%253FT-1000%7Cpos%3Dmiddle%26sl%3Dmpu-middle%253FT-1000%7Cpos%3Dtop%26sl%3Ddynamic-showcase-top%253FT-1000%7Cpos%3Dtop%26sl%3Dinpage-video-top%253FT-1000%7Cpos%3Dtop%26strnativekey%3D8ec3a4f3%26sl%3Dsharethrough-top%253FT-1000%7Cpos%3Dbottom%26sl%3Dmpu-bottom%253FT-1000%7Cpos%3Dbottom%26sl%3Dleader-plus-bottom%253FT-1000&eri=1&cust_params=buyingcycle%3Ddiscover%26topic%3Dsecurity%252Centerprise-software%252Cservers%26mfr%3Dcitrix-systems%252Cgithub%26pid%3Dcitrix-netscaler-gateway%26tag%3Dcyber-security%252Ctarget%26prodtype%3Dsoftware%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Duk%26subses%3D4%26session%3Dd%26pv%3D1%26vguid%3D03a6b66b-3f00-436b-adec-b3b55d39971c&cookie_enabled=1&bc=31&abxe=1&lmt=1585222369&dt=1585222370273&dlt=1585222369839&idt=395&frm=20&biw=1585&bih=1200&oid=3&adxs=0%2C-20%2C1043%2C1043%2C1008%2C208%2C208%2C1043%2C429&adys=0%2C312%2C432%2C2451%2C1650%2C1601%2C2144%2C3333%2C5203&adks=1512325694%2C3581870410%2C1925781520%2C3289239044%2C3970605601%2C2450494987%2C2484431570%2C3509234736%2C519614694&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%2F&dssz=36&icsg=34360426496&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x5662%7C1585x90%7C370x250%7C370x250%7C370x771%7C770x4317%7C770x11%7C370x250%7C1210x90&msz=1585x5%7C1585x90%7C370x250%7C370x250%7C370x771%7C770x321%7C770x11%7C370x250%7C1210x90&ga_vid=780214200.1585222370&ga_sid=1585222370&ga_hid=560857925&fws=4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4&ohw=1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
cafe /
Resource Hash
f9ed9c8e8c3c5f2feb08338f28fd61f12fbc6e700bb885bc0bc97b31f042d410
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin
https://www.zdnet.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
26592
x-xss-protection
0
google-lineitem-id
4745974454,4745556468,-1,4745571990,4825966980,4745327422,4745189935,4745571990,4745696286
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138239360957,138239447317,-1,138239450920,138247024569,138239368367,138239344181,138248164648,138239338269
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.zdnet.com
access-control-expose-headers
x-google-amp-ad-validated-version
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2020030501.js
securepubads.g.doubleclick.net/gpt/ 		69 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
sffe /
Resource Hash
ffdc18ac8f47bcd50dd9c33532c334e7073717a62b367d95b9cb1561048547dc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 05 Mar 2020 14:08:10 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
25689
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:50 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers
/
6852bd0a.akstat.io/ 		0
354 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://6852bd0a.akstat.io/?h.pg=article&when=1585222370261&cdim.Site_View=desktop&t_other=custom8%7C2704&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=364a7ef2253dea32e24c87374b7a6cdc3c379a8a&h.t=1585222370162&http.initiator=api&rt.start=api&rt.si=ad3e1182-cf29-4f43-9265-646ee0cde36f&rt.ss=1585222372735&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:184::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin
https://www.zdnet.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 11:32:50 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Thu, 26 Mar 2020 11:32:50 GMT
/
6852bd0a.akstat.io/ 		0
354 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://6852bd0a.akstat.io/?h.pg=article&when=1585222370300&cdim.Site_View=desktop&t_other=custom7%7C2743&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=364a7ef2253dea32e24c87374b7a6cdc3c379a8a&h.t=1585222370162&http.initiator=api&rt.start=api&rt.si=ad3e1182-cf29-4f43-9265-646ee0cde36f&rt.ss=1585222372735&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:184::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin
https://www.zdnet.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 11:32:50 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Thu, 26 Mar 2020 11:32:50 GMT
article-4bf1478396-rev.js
zdnet4.cbsistatic.com/fly/js/pages/ 		148 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet4.cbsistatic.com/fly/js/pages/article-4bf1478396-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
5ea818604aa385d1fea726beaf424f869064a5a50621599949033f3d10009f19
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
578070
status
200
strict-transport-security
max-age=31536000
content-length
41795
x-xss-protection
1; mode=block
last-modified
Wed, 18 Mar 2020 18:50:37 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5e726d7d-25039"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 26 Mar 2020 18:58:19 GMT
CBSI-PLAYER.js
vidtech.cbsinteractive.com/uvpjs/0.42.297/ 		1 MB
281 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::645 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
age
1095710
x-cache
HIT, HIT
status
200
content-length
286838
x-amz-id-2
WsZMn1b4DWlY+9ifr3pbbXeD+ey1HoTP0Gb1ZwEp4aFa9pwUhy9bTx9y0SvJM0DhUMGJCX3Bl18=
x-served-by
cache-dca17742-DCA, cache-hhn4042-HHN
last-modified
Fri, 01 Feb 2019 18:20:56 GMT
server
AmazonS3
x-timer
S1585222370.432921,VS0,VE0
etag
"eb5dd4ed3dcb7641ebbcb604d7ddb038"
vary
Accept-Encoding
x-amz-request-id
9D1B37F42EBF691F
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
1, 2
/
www.zdnet.com/components/breaking-news/xhr/ 		1 KB
846 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2028-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
66bfbd7b6c6053d10206c0a02bd2ca6607bc56371132a74a06dad24ce3c6a716
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Sec-Fetch-Dest
empty
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-length
504
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 26 Mar 2020 10:36:02 GMT
x-frame-options
SAMEORIGIN
date
Thu, 26 Mar 2020 11:32:50 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
vary
Accept-Encoding, User-Agent
x-tx-id
b641890b-f836-43c9-896d-88e436086ad5
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Thu, 26 Mar 2020 12:06:02 GMT
image-gallery-modal-426b98fe1d-rev.js
zdnet1.cbsistatic.com/fly/js/components/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet1.cbsistatic.com/fly/js/components/image-gallery-modal-426b98fe1d-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
744ae87db00be85a6a482a3e8036f81aafaa7754be29b05a2330d0fbc8fea803
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
578068
status
200
strict-transport-security
max-age=31536000
content-length
1866
x-xss-protection
1; mode=block
last-modified
Wed, 18 Mar 2020 18:50:37 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5e726d7d-1328"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 26 Mar 2020 18:58:21 GMT
09-rsync.png
zdnet1.cbsistatic.com/hub/i/r/2019/02/07/51643b2f-d46a-4ccd-9a62-480326f9940c/thumbnail/170x128/c2d9c669a713e4a100f3f92ebefceb18/ 		26 KB
26 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/02/07/51643b2f-d46a-4ccd-9a62-480326f9940c/thumbnail/170x128/c2d9c669a713e4a100f3f92ebefceb18/09-rsync.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
fa4db5fefacfb2ff7bc04ff189c9a87da19c40d909274b0dbce20ab3baf2ed89
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2909796
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
26578
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"389c96d539ed67bd670f0a32d9765469"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
10-couchdb.png
zdnet2.cbsistatic.com/hub/i/r/2019/02/07/88cc7758-c207-4528-b85d-73c57ee46860/thumbnail/170x128/d6fa0f86841287638719611cb5bc39c3/ 		26 KB
26 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/02/07/88cc7758-c207-4528-b85d-73c57ee46860/thumbnail/170x128/d6fa0f86841287638719611cb5bc39c3/10-couchdb.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
15ec195d9e2d786a5d1f400841ffbfe7d2140847c2242eee69e76381d011f3b0
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
569913
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
26710
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"3af65294001defdf7d60d4b9e3151fff"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
12-etcd.png
zdnet1.cbsistatic.com/hub/i/r/2019/02/08/2969d96d-417f-4db6-90ce-7439a560b650/thumbnail/170x128/54ab820d005ede428e79bbff2c1a650a/ 		30 KB
30 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/02/08/2969d96d-417f-4db6-90ce-7439a560b650/thumbnail/170x128/54ab820d005ede428e79bbff2c1a650a/12-etcd.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
8048c8f9ab50a8d4717fd75f1d55f75c070b659ef9bd126eb543e2e230a3630b
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
569913
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
30537
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"c754f5d09de891bf9429e3a39af69ab6"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
13-firebase.png
zdnet1.cbsistatic.com/hub/i/r/2019/02/08/3826b3e2-ba24-4789-a05c-2936a4114f41/thumbnail/170x128/085b337b24eedcf015c2c2c366ab8443/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/02/08/3826b3e2-ba24-4789-a05c-2936a4114f41/thumbnail/170x128/085b337b24eedcf015c2c2c366ab8443/13-firebase.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
e96bf7ebef41b3593260a56798bbbdc8c9956e8fb1538694cc55e35db99035bb
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
569913
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
25563
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"4490759a6b69ecb7c170d8e1476be569"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
14-jira.png
zdnet4.cbsistatic.com/hub/i/r/2019/02/08/c745590b-722d-4ba3-888d-c2ce7844efff/thumbnail/170x128/9d435349d15693cf95d05d6fce4fff76/ 		28 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/02/08/c745590b-722d-4ba3-888d-c2ce7844efff/thumbnail/170x128/9d435349d15693cf95d05d6fce4fff76/14-jira.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
831908d0b19350a69e26f3ee6a650916248526ae23e88bff638bead93b990fba
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2861237
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
29043
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"24f1f625bd45de40d754ee728086e4dc"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
disqus-loader-ba8cc73646-rev.js
zdnet3.cbsistatic.com/fly/js/components/ 		1 KB
888 B 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/disqus-loader-ba8cc73646-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
824e2ec0553bc582c02673a30139ac8fe4a6485943d64d32dfb7ae5a83efbe92
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
578071
status
200
strict-transport-security
max-age=31536000
content-length
640
x-xss-protection
1; mode=block
last-modified
Wed, 18 Mar 2020 18:50:37 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5e726d7d-57e"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 26 Mar 2020 18:58:18 GMT
popular-consumer-and-enterprise-routers-5d82051ed989d40001ff4366-1-sep-18-2019-14-22-55-poster.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/09/18/a8d12ab5-1a90-413e-a652-266e6e15553d/thumbnail/170x128/d7fdb0f0a08967441d767221aaf1b86d/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/09/18/a8d12ab5-1a90-413e-a652-266e6e15553d/thumbnail/170x128/d7fdb0f0a08967441d767221aaf1b86d/popular-consumer-and-enterprise-routers-5d82051ed989d40001ff4366-1-sep-18-2019-14-22-55-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
45ef8c8e9fe846c57c43c7eab4c65b4df0454573ad3e72f4d00183ebdbf76ef3
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
24169
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
3030
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"a2186aa7c086b46ad4e8bf81e2a3a19b"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
darkwebistock-935673948wildpixel1.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/05/07/bbe90545-046a-4ea9-89a6-6486472fbf77/thumbnail/170x128/c99f890c12fa37392715e37973491684/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/05/07/bbe90545-046a-4ea9-89a6-6486472fbf77/thumbnail/170x128/c99f890c12fa37392715e37973491684/darkwebistock-935673948wildpixel1.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f960850602bf08fdda44ff3f2793d25600520e8bf7824768006bd75639345b94
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
x-content-type-options
nosniff
age
48348
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
5669
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"8a7129b8f3edd95b7d969dfc2c8e9d9d"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
tupperware.jpg
zdnet3.cbsistatic.com/hub/i/r/2020/03/25/04089e2b-ae49-472b-8d10-c41252c93506/thumbnail/170x128/cb134ef5e19ac34c0dec636002ef5322/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2020/03/25/04089e2b-ae49-472b-8d10-c41252c93506/thumbnail/170x128/cb134ef5e19ac34c0dec636002ef5322/tupperware.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
e0f58ade4784ef72431fdaad900e3be9e5c50dbb598da828078162f760a49fe3
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
70357
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
2566
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"06fe1c234519f6812fc4c1baae25d6af"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
motherboard-cpu-processor-intel.jpg
zdnet1.cbsistatic.com/hub/i/r/2020/03/25/ca2b1a15-4fe8-4edc-a05d-0ce8953b6368/thumbnail/170x128/a0128c77f18b862c6770dfe253e9e5f8/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2020/03/25/ca2b1a15-4fe8-4edc-a05d-0ce8953b6368/thumbnail/170x128/a0128c77f18b862c6770dfe253e9e5f8/motherboard-cpu-processor-intel.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
5e7e11fba17ea011a72208eea45496ec5392beb8b74a99cce77f5ff03cfffc8e
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
x-content-type-options
nosniff
age
111142
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
8414
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"682e0e796084e163c5ca053dd8573b0c"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
/
www.zdnet.com/newsletter/xhr/widget-login/ 		2 KB
906 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.zdnet.com/newsletter/xhr/widget-login/?topic=security
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2028-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f7dc6a1bae51c0a2e920de1685603814e79126cde0cbffeeec54478b01008b9b
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Sec-Fetch-Dest
empty
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
x-frame-options
SAMEORIGIN
date
Thu, 26 Mar 2020 11:32:51 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
vary
Accept-Encoding, User-Agent
x-tx-id
a4350a41-2806-447d-b980-d6d04fb32979
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache
accept-ranges
bytes
front-door-carousel-d989216481-rev.js
zdnet1.cbsistatic.com/fly/js/components/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet1.cbsistatic.com/fly/js/components/front-door-carousel-d989216481-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
a0aa48808ddef7604ba969db62e4af3a2ba001b7a8751823cf0ab2d430308ea5
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
578069
status
200
strict-transport-security
max-age=31536000
content-length
1552
x-xss-protection
1; mode=block
last-modified
Wed, 18 Mar 2020 18:50:37 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5e726d7d-1251"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 26 Mar 2020 18:58:19 GMT
popular-consumer-and-enterprise-routers-5d82051ed989d40001ff4366-1-sep-18-2019-14-22-55-poster.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/09/18/a8d12ab5-1a90-413e-a652-266e6e15553d/thumbnail/170x128/d7fdb0f0a08967441d767221aaf1b86d/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/09/18/a8d12ab5-1a90-413e-a652-266e6e15553d/thumbnail/170x128/d7fdb0f0a08967441d767221aaf1b86d/popular-consumer-and-enterprise-routers-5d82051ed989d40001ff4366-1-sep-18-2019-14-22-55-poster.jpg
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2028-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
45ef8c8e9fe846c57c43c7eab4c65b4df0454573ad3e72f4d00183ebdbf76ef3
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
24169
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
3030
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"a2186aa7c086b46ad4e8bf81e2a3a19b"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
darkwebistock-935673948wildpixel1.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/05/07/bbe90545-046a-4ea9-89a6-6486472fbf77/thumbnail/170x128/c99f890c12fa37392715e37973491684/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/05/07/bbe90545-046a-4ea9-89a6-6486472fbf77/thumbnail/170x128/c99f890c12fa37392715e37973491684/darkwebistock-935673948wildpixel1.jpg
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2028-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
f960850602bf08fdda44ff3f2793d25600520e8bf7824768006bd75639345b94
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
x-content-type-options
nosniff
age
48348
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
5669
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"8a7129b8f3edd95b7d969dfc2c8e9d9d"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
motherboard-cpu-processor-intel.jpg
zdnet1.cbsistatic.com/hub/i/r/2020/03/25/ca2b1a15-4fe8-4edc-a05d-0ce8953b6368/thumbnail/170x128/a0128c77f18b862c6770dfe253e9e5f8/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2020/03/25/ca2b1a15-4fe8-4edc-a05d-0ce8953b6368/thumbnail/170x128/a0128c77f18b862c6770dfe253e9e5f8/motherboard-cpu-processor-intel.jpg
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2028-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
5e7e11fba17ea011a72208eea45496ec5392beb8b74a99cce77f5ff03cfffc8e
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
x-content-type-options
nosniff
age
111142
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
8414
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"682e0e796084e163c5ca053dd8573b0c"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
tupperware.jpg
zdnet3.cbsistatic.com/hub/i/r/2020/03/25/04089e2b-ae49-472b-8d10-c41252c93506/thumbnail/170x128/cb134ef5e19ac34c0dec636002ef5322/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2020/03/25/04089e2b-ae49-472b-8d10-c41252c93506/thumbnail/170x128/cb134ef5e19ac34c0dec636002ef5322/tupperware.jpg
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2028-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
e0f58ade4784ef72431fdaad900e3be9e5c50dbb598da828078162f760a49fe3
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
70357
status
200
content-transfer-encoding
binary
x-image-exists
1
strict-transport-security
max-age=31536000
content-length
2566
x-xss-protection
1; mode=block
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"06fe1c234519f6812fc4c1baae25d6af"
vary
Accept-Image-Webp,Accept-Image-Webv
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
show-hide-1.0-7bf562809f-rev.js
zdnet3.cbsistatic.com/fly/js/components/ 		2 KB
805 B 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/show-hide-1.0-7bf562809f-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
cd715c0fa7d69e85432e8b08d0a02b9613edf40212cca2040bde31670167638e
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
578071
status
200
strict-transport-security
max-age=31536000
content-length
673
x-xss-protection
1; mode=block
last-modified
Wed, 18 Mar 2020 18:50:37 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5e726d7d-71c"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 26 Mar 2020 18:58:19 GMT
results.txt
ev4i6baxg6qscxt4slra-pq60dh-ac41883d1-clientnsv4-s.akamaihd.net/eum/ Frame 45D9
Redirect Chain
  • https://trial-eum-clientnsv4-s.akamaihd.net/eum/getdns.txt?c=pq60dhq68
  • https://ev4i6baxg6qscxt4slra-pq60dh-ac41883d1-clientnsv4-s.akamaihd.net/eum/results.txt
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ev4i6baxg6qscxt4slra-pq60dh-ac41883d1-clientnsv4-s.akamaihd.net/eum/results.txt
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.55.161.33 , United States, ASN (),
Reverse DNS
a23-55-161-33.deploy.static.akamaitechnologies.com
Software
AkamaiGHost /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Location
https://ev4i6baxg6qscxt4slra-pq60dh-ac41883d1-clientnsv4-s.akamaihd.net/eum/results.txt
Date
Thu, 26 Mar 2020 11:32:50 GMT
Server
AkamaiGHost
Connection
keep-alive
Access-Control-Allow-Origin
*
Content-Length
0

Redirect headers

Location
https://ev4i6baxg6qscxt4slra-pq60dh-ac41883d1-clientnsv4-s.akamaihd.net/eum/results.txt
Date
Thu, 26 Mar 2020 11:32:50 GMT
Server
AkamaiGHost
Connection
keep-alive
Access-Control-Allow-Origin
*
Content-Length
0
results.txt
fiaqj6absjkbikqce3yboaaabvphzexc-pq60dh-03bb5d178-clienttons-s.akamaihd.net/eum/ Frame 45D9
Redirect Chain
  • https://trial-eum-clienttons-s.akamaihd.net/eum/getdns.txt?c=pq60dhq68
  • https://fiaqj6absjkbikqce3yboaaabvphzexc-pq60dh-03bb5d178-clienttons-s.akamaihd.net/eum/results.txt
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fiaqj6absjkbikqce3yboaaabvphzexc-pq60dh-03bb5d178-clienttons-s.akamaihd.net/eum/results.txt
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:1700:d::1737:6e9a , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
AkamaiGHost /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Location
https://fiaqj6absjkbikqce3yboaaabvphzexc-pq60dh-03bb5d178-clienttons-s.akamaihd.net/eum/results.txt
Date
Thu, 26 Mar 2020 11:32:50 GMT
Server
AkamaiGHost
Connection
keep-alive
Access-Control-Allow-Origin
*
Content-Length
0

Redirect headers

Location
https://fiaqj6absjkbikqce3yboaaabvphzexc-pq60dh-03bb5d178-clienttons-s.akamaihd.net/eum/results.txt
Date
Thu, 26 Mar 2020 11:32:50 GMT
Server
AkamaiGHost
Connection
keep-alive
Access-Control-Allow-Origin
*
Content-Length
0
/
6852bd0a.akstat.io/ 		0
354 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://6852bd0a.akstat.io/?h.pg=article&when=1585222370576&cdim.Site_View=desktop&t_other=custom4%7C2284&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=364a7ef2253dea32e24c87374b7a6cdc3c379a8a&h.t=1585222370162&http.initiator=api&rt.start=api&rt.si=ad3e1182-cf29-4f43-9265-646ee0cde36f&rt.ss=1585222372735&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:184::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin
https://www.zdnet.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 11:32:50 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Thu, 26 Mar 2020 11:32:50 GMT
results.txt
fiaqj6absjkbikqce3yboaaabvphzexc-pq60dh-03bb5d178-clienttons-s.akamaihd.net/eum/ Frame 45D9 		8 B
302 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fiaqj6absjkbikqce3yboaaabvphzexc-pq60dh-03bb5d178-clienttons-s.akamaihd.net/eum/results.txt
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:1700:d::1737:6e8c , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin
null
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Mar 2020 11:32:50 GMT
Last-Modified
Wed, 08 May 2013 07:51:12 GMT
Server
Apache
ETag
"402e7a087747cb56c718bde84651f96a:1367999472"
Content-Type
text/plain
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
8
results.txt
ev4i6baxg6qscxt4slra-pq60dh-ac41883d1-clientnsv4-s.akamaihd.net/eum/ Frame 45D9 		8 B
302 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ev4i6baxg6qscxt4slra-pq60dh-ac41883d1-clientnsv4-s.akamaihd.net/eum/results.txt
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.55.161.33 , United States, ASN (),
Reverse DNS
a23-55-161-33.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin
null
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Mar 2020 11:32:50 GMT
Last-Modified
Wed, 08 May 2013 07:51:12 GMT
Server
Apache
ETag
"402e7a087747cb56c718bde84651f96a:1367999472"
Content-Type
text/plain
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
8
view
securepubads.g.doubleclick.net/pcs/ Frame 8258 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsudgeudzWAiGR5-3WqitV2j9BXVmw9Q8TAIufyXVpwLewWulpP8zHirh_LSCFhi9P1o8JYpoKCcKr69Ov7vYm4lbI7llyZYrl9y4vUr5PYED7p2uQubICeGjtwU4ea2jujpo-7lrIwQ4cEwsYlJcT9w_Yf2RKHIeElA5X9d_BR28Q1ORh89OYkw66DFa_2WGr260qlHJkaDi0Nq8Q9y1fDpZiBrKx0x_LXM0qlh2AMBMUukPvWpGA_ZorPBDbncY9jSzB6cF8e7&sai=AMfl-YTm1EBVqxw84FgGy3uNdInV8tvTCnGb4HfKQq1JbGo6MaXqIUNPz5Xv3P4RnxK8o09q5QYAxpCdZi007mU8CSzywSEa0OJyz9XGPMaFwg&sig=Cg0ArKJSzE6w_VGZ4YKUEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers

timing-allow-origin
*
date
Thu, 26 Mar 2020 11:32:50 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:50 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 8258 		74 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1585165059237800"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28264
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:50 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 8258 		314 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-101-185-246.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
last-modified
Wed, 11 Mar 2020 16:53:28 GMT
server
AmazonS3
x-amz-request-id
08ECB22213F3292C
etag
"2615d14012bc2e6c09dcdff2dd6bcd8e"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=13861
accept-ranges
bytes
content-length
107119
x-amz-id-2
Wqj7768f+TEy2a0L1YbUaKgJ4dcR7nziMbjUktBgm1QcjfZnfNw0jSx+/rldjLoR5TghzHSYEy4=
osd.js
www.googletagservices.com/activeview/js/current/ 		74 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f2e60d0a77f1d63a9fd3b21fbb9d21345a61dc43d6c9b749e45753c5d993a6e8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1585165059237800"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28015
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:50 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame F246 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvHszglsQLuAYYxpG4tUBuPfwkVvVMO7Fqcpeaaq68z4dCzAesIVqGUREOcrrlWZ8y7gX4R8D21sPrd8dYZNDq4d9g2VTVfzyEV1K5cfN_rH5w2XUvVB3g9zsuFnJQYUIfyc0vY25q8JQJUqtrrVC0VxwgTi0culUqj9oYcJBC7T36bHpSmeeoqW2HcCcHDBn0OvJbcrEvZ6vY8xosg1EvAViG1gA5Q6Ye5uE5coe4ib8obOa3cfdJ4ryIex1UZs1dIZ0ustRgN&sai=AMfl-YTaIY2_DXzBQzJC6rCZLWPB8F96ZqHhv6oxr0ZOtQX6c_ZJwpbal79upDf-Y7Wi5clRcgLdmmLCLUtT_Iz36ahxpB24Qb8tWaWwEdBvwA&sig=Cg0ArKJSzDP2N5h1TwC6EAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers

timing-allow-origin
*
date
Thu, 26 Mar 2020 11:32:50 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:50 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame F246 		74 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1585165059237800"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28264
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:50 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame F246 		314 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-101-185-246.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
last-modified
Wed, 11 Mar 2020 16:53:28 GMT
server
AmazonS3
x-amz-request-id
08ECB22213F3292C
etag
"2615d14012bc2e6c09dcdff2dd6bcd8e"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=13861
accept-ranges
bytes
content-length
107119
x-amz-id-2
Wqj7768f+TEy2a0L1YbUaKgJ4dcR7nziMbjUktBgm1QcjfZnfNw0jSx+/rldjLoR5TghzHSYEy4=
amp4ads-v0.js
cdn.ampproject.org/rtv/012003101714470/ Frame AFC5 		200 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/
Origin
https://www.zdnet.com
Sec-Fetch-Dest
script
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
2345
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
55811
x-xss-protection
0
server
sffe
date
Thu, 26 Mar 2020 10:53:45 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"789295de90cb321e"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Mar 2021 10:53:45 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/012003101714470/ Frame AFC5 		200 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
506
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
55811
x-xss-protection
0
server
sffe
date
Thu, 26 Mar 2020 11:24:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"789295de90cb321e"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Mar 2021 11:24:24 GMT
amp-ad-exit-0.1.js
cdn.ampproject.org/rtv/012003101714470/v0/ Frame AFC5 		16 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012003101714470/v0/amp-ad-exit-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3d0c18b56d3b9bd3640250af1ce1e624bda890531f830d64c99d45e6c07bb349
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
8903
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
5728
x-xss-protection
0
server
sffe
date
Thu, 26 Mar 2020 09:04:27 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"36d96c2d19cb35a6"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Mar 2021 09:04:27 GMT
amp-analytics-0.1.js
cdn.ampproject.org/rtv/012003101714470/v0/ Frame AFC5 		92 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012003101714470/v0/amp-analytics-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e17e03dc3ff1767a8d185975a2bf392068a0b2f2848503c38ceaa3f10fb0ea84
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
6652
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28328
x-xss-protection
0
server
sffe
date
Thu, 26 Mar 2020 09:41:58 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"f4788313c10056ed"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Mar 2021 09:41:58 GMT
amp-fit-text-0.1.js
cdn.ampproject.org/rtv/012003101714470/v0/ Frame AFC5 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012003101714470/v0/amp-fit-text-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7b8ef4f3c2daa40e68de70096105302da24a586c1d75b620dff0ff579db73ba8
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
8904
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1414
x-xss-protection
0
server
sffe
date
Thu, 26 Mar 2020 09:04:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"ea7b1c90fec06498"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Mar 2021 09:04:26 GMT
amp-form-0.1.js
cdn.ampproject.org/rtv/012003101714470/v0/ Frame AFC5 		46 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012003101714470/v0/amp-form-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
eada136c924874367d33d22fb496800b3f6f4e97f457829d2c18b5d41f1019a5
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
8903
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
14863
x-xss-protection
0
server
sffe
date
Thu, 26 Mar 2020 09:04:27 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"db7c050f8b3f760d"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Mar 2021 09:04:27 GMT
css
fonts.googleapis.com/ Frame AFC5 		7 KB
824 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d0cbfb1ab0f94123834567e32df7ec74a1c210793f797368d41a4b4c2732d4a0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
x-xss-protection
0
last-modified
Thu, 26 Mar 2020 11:32:50 GMT
server
ESF
date
Thu, 26 Mar 2020 11:32:50 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 26 Mar 2020 11:32:50 GMT
2076313506083323656
tpc.googlesyndication.com/simgad/18234566260780510693/ Frame AFC5 		27 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/18234566260780510693/2076313506083323656
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
96ff870ee7a7a5ad1f5bd2413f0f0d938b6d04170c0b221e7215d00a61c58a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 07:24:34 GMT
x-content-type-options
nosniff
age
187696
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28033
x-xss-protection
0
last-modified
Mon, 03 Feb 2020 10:16:15 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 24 Mar 2021 07:24:34 GMT
truncated
/ Frame AFC5 		206 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
76ebd2a7078570fa9f6a50855b4ade57c6b558cca7c95801b2b247406b274975

Request headers

Referer
https://www.zdnet.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ Frame AFC5 		215 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8b8ae1bc228572a3df725a7f417c91b4439e0321ed354d8c25e4c24beee5627e

Request headers

Referer
https://www.zdnet.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
amp4ads-host-v0.js
cdn.ampproject.org/rtv/012003101714470/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012003101714470/amp4ads-host-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c2b0d171a4179bf00898c430c1c15464e528aff5762fc70a5d02184834c82eff
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
6651
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
7178
x-xss-protection
0
server
sffe
date
Thu, 26 Mar 2020 09:41:59 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"9d3d923337ef7e9b"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Mar 2021 09:41:59 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 1450 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstqgGtTf7L4Zbz-Q0FBgrCxbLbFfuJbdIa3mTn9bBTqLBzB7vvCY7c5QI9iIhOdPjLepb8u4hDeTui0A8-xwfAy7DNlvsl7eV3ik-iv25V7NpB8qshdpv2d5OgtzqP8tQ29WNchmZYAmqu-d4UoS9rL4736tOx2-mchcVgKbJv-wJ_B9XQsFVKlqYuk1iqFMpq-kcxBS8GI3j35R8kDwF1LVhHysVUNhWhyvCiVGk9WEmtp-S1uvKgxKYV6OZPBNc-CD2mfxywl&sai=AMfl-YSRJGrsAemdILJs7TVyhB4DC6AEYI7KYoMroX8FjSALQFGVSwBHWd_cqDyuvHCdQtPHPNwmN7HjYbEBgY_48yS_duEI8VOyjTqcPvCLLg&sig=Cg0ArKJSzD-F7Kg9f1ZOEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers

timing-allow-origin
*
date
Thu, 26 Mar 2020 11:32:50 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:50 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 1450 		74 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1585165059237800"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28264
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:50 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 1450 		314 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-101-185-246.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
last-modified
Wed, 11 Mar 2020 16:53:28 GMT
server
AmazonS3
x-amz-request-id
08ECB22213F3292C
etag
"2615d14012bc2e6c09dcdff2dd6bcd8e"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=13861
accept-ranges
bytes
content-length
107119
x-amz-id-2
Wqj7768f+TEy2a0L1YbUaKgJ4dcR7nziMbjUktBgm1QcjfZnfNw0jSx+/rldjLoR5TghzHSYEy4=
view
securepubads.g.doubleclick.net/pcs/ Frame C1E1 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsshQPUMgeNfOPLRYDw2K0Q4PoTn7aw-SFz5gTkKa0qYftl-rLNw2GzhEFKXI12G6lqT--LlSFylkCti5RueJehsAbvxhJZCSFUVfdpC-3wXYCRasX09iwwDn8_P8IFqeMCku16oQ5HlX5yvRw4FUAiTNzpWKW7oWI0JMaHDQdvMnnM_36fGNkBE5_u6M9djDPnVsEarRtzBba1uNHtcjkzTP-clAX7ovEZhIbkgZlQcsmfdJSPMpPhbW5b_HGEdZk4lpKTJC18y&sai=AMfl-YQI25QFD58h1U6AENFZHQuDFOkJ64VBz8EMk5WSPNq58Vy4wgu6zUNujtEeJOeEfVyOt3Mrt8oma71ePwBIH_mb9FbsZvxNnr9_6Mk5AQ&sig=Cg0ArKJSzOTJiKmPOlWdEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers

timing-allow-origin
*
date
Thu, 26 Mar 2020 11:32:50 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
adKit.min.js
rev.cbsi.com/common/js/ Frame C1E1 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rev.cbsi.com/common/js/adKit.min.js?1996769099
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.108.48.175 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-108-48-175.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Thu, 26 Mar 2020 11:32:51 GMT
Content-Encoding
gzip
Last-Modified
Mon, 13 May 2019 18:29:20 GMT
Server
AkamaiNetStorage
ETag
"e524dc608d5c7c30eef57b6ed95dc6a8:1557772160"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2149
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame C1E1 		74 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1585165059237800"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28264
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:50 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame C1E1 		314 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-101-185-246.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
last-modified
Wed, 11 Mar 2020 16:53:28 GMT
server
AmazonS3
x-amz-request-id
08ECB22213F3292C
etag
"2615d14012bc2e6c09dcdff2dd6bcd8e"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=13861
accept-ranges
bytes
content-length
107119
x-amz-id-2
Wqj7768f+TEy2a0L1YbUaKgJ4dcR7nziMbjUktBgm1QcjfZnfNw0jSx+/rldjLoR5TghzHSYEy4=
view
securepubads.g.doubleclick.net/pcs/ Frame 3971 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvLa6LmZdPWMk2uCj_VrdKsLA_KhE0DVx4C5wU0UlsmTr2hdYSsSdcGUCyzdoixsqU0E-WLw8w8LqrX1uNMskq_bCX20ONjF5XHNd9_VqTkzWqgvSVqkYGwO0utGO0vSY05P4b6KFpTgtopxRsJdk3pTIBsss_i3XcOjNet6m5rl1pb-wylwQFtSeGUEbtVw187IKbLth3GpdOj3hyyCl6nrX786vi3D0BscVSayKIKA380PN00-7uxYU_f67_RC2xk0K7WQO6W&sai=AMfl-YSxdQB91iJJC7LHQWSvj1XqkxNBb534rkbziMVouN62Hcilh4dC6VYbjTu6U5yxuxPYR27yO4vgEBiKsVCF9f1teGNzI4o0sPzb3LtS_w&sig=Cg0ArKJSzJp3wZ8kqGQiEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers

timing-allow-origin
*
date
Thu, 26 Mar 2020 11:32:50 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 3971 		74 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1585165059237800"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28264
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:50 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 3971 		314 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-101-185-246.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
last-modified
Wed, 11 Mar 2020 16:53:28 GMT
server
AmazonS3
x-amz-request-id
08ECB22213F3292C
etag
"2615d14012bc2e6c09dcdff2dd6bcd8e"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=13861
accept-ranges
bytes
content-length
107119
x-amz-id-2
Wqj7768f+TEy2a0L1YbUaKgJ4dcR7nziMbjUktBgm1QcjfZnfNw0jSx+/rldjLoR5TghzHSYEy4=
view
securepubads.g.doubleclick.net/pcs/ Frame F38B 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuqqbVpG8njjNPpOkioPlaGqdLgPe_JOOYSgZve1VPAOvhWxh39EZZhjvdO_MmVCnqL60TYH6DobPbZrQBGSi3tumknx-H5BnBaGI6Ze1BAiP76R1jef4Kc3xZQXIPfsEDEYJh_1ygTVwNK3DXO3rzH_3b0xVewv-3bczpFBThEtbevv8EJCmm-coBEroykOgFgV-DkLca_lCxjSXyNktxDAFqPxrr9HXJlKteKItXlTapSayz-wFOlwLtL4OnyesP4CZ_-D2Qv&sai=AMfl-YRXJPtSdqDBtM3qY-jiV3p5PMx0i6pBc8BwMm03dlsDqA3dgvQDbYMDsA3K0WkwIbLZ7bJMWSfJXQ7G2FPyM4gXRInc-24190kdzbD97g&sig=Cg0ArKJSzBBUhZuEI8hOEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers

timing-allow-origin
*
date
Thu, 26 Mar 2020 11:32:50 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame F38B 		74 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1585165059237800"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28264
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:50 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame F38B 		314 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-101-185-246.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
last-modified
Wed, 11 Mar 2020 16:53:28 GMT
server
AmazonS3
x-amz-request-id
08ECB22213F3292C
etag
"2615d14012bc2e6c09dcdff2dd6bcd8e"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=13861
accept-ranges
bytes
content-length
107119
x-amz-id-2
Wqj7768f+TEy2a0L1YbUaKgJ4dcR7nziMbjUktBgm1QcjfZnfNw0jSx+/rldjLoR5TghzHSYEy4=
view
securepubads.g.doubleclick.net/pcs/ Frame A375 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst1lG1oZfSi2ZDbYIWf1AG6eeHv5GFbqauqKM2efCRk317UaQAHa6eqp9sf_PfVngtHEZtf3-mfD_W8ctvdAdlimVqH7e9HmNtkTOSgytpnzoYF1tJgxn76RJUo03h9MVus5O2fAMHpwaA-KRKfh3Q7i27DgyjjaGQCXt-68jK-FIh2AxiKibeb3TIhsYAyMdLT94VJJb6iIkfQR5cLhGbm_LyACht8-3Cq__1b5WcyuMfDAYflc2yUQF4UYTNBa8eclpIwPM_E&sai=AMfl-YTs9QVKwphkQ8gWFzjFElSFYNrFtZejTzhrknZX7vQsB-l-qIki199kEMyw84DPz2EO7cawhln17XSx66iPCNtA_QDBcIitBCYyFvHqDQ&sig=Cg0ArKJSzJsnAd6dcg8AEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers

timing-allow-origin
*
date
Thu, 26 Mar 2020 11:32:50 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame A375 		74 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1585165059237800"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28264
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:50 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame A375 		314 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-101-185-246.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
last-modified
Wed, 11 Mar 2020 16:53:28 GMT
server
AmazonS3
x-amz-request-id
08ECB22213F3292C
etag
"2615d14012bc2e6c09dcdff2dd6bcd8e"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=13861
accept-ranges
bytes
content-length
107119
x-amz-id-2
Wqj7768f+TEy2a0L1YbUaKgJ4dcR7nziMbjUktBgm1QcjfZnfNw0jSx+/rldjLoR5TghzHSYEy4=
view
securepubads.g.doubleclick.net/pcs/ Frame FB2A 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvraNa5Us6BJM0_z5soCC_LLLLegGGtKF5c8k-LdmWEKGaQ2Hmr0Nlz2lfpyap-O25DiDLfu-ZXGKGbwRG8d8K8kBXMssc9-fwSS7Rviynq5VDYzbtkvO0nt-M8MFX3fsBoSHXpXMpgOexik-jICmhht0VjBD85ZYkESDFOi8IMouU-zaCsUNPzygZ3886FeZbfIuuOwCUpQnlmE8tUQHKXx8TTuTTSJwv_0u_g1QlcriYgpjct3ZXBdaX9AeLIoGwiV_CqywQ2&sai=AMfl-YS1fczoBjLz7w_btOUEHRoOPUDV-fzgw6JhJuymyXyNqZIbGbZ_RRKOh3QhmXVyyzzzahg5vr5lTIT2ljTM-lFT0tpOXze_FztWDcKY4A&sig=Cg0ArKJSzLj0C0e6ePopEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers

timing-allow-origin
*
date
Thu, 26 Mar 2020 11:32:50 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame FB2A 		74 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1585165059237800"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28264
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:50 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame FB2A 		314 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-101-185-246.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
last-modified
Wed, 11 Mar 2020 16:53:28 GMT
server
AmazonS3
x-amz-request-id
08ECB22213F3292C
etag
"2615d14012bc2e6c09dcdff2dd6bcd8e"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=13861
accept-ranges
bytes
content-length
107119
x-amz-id-2
Wqj7768f+TEy2a0L1YbUaKgJ4dcR7nziMbjUktBgm1QcjfZnfNw0jSx+/rldjLoR5TghzHSYEy4=
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame AFC5 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Wed, 25 Mar 2020 23:33:48 GMT
x-content-type-options
nosniff
content-type
image/png
server
cafe
age
43142
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
2502
x-xss-protection
0
expires
Thu, 26 Mar 2020 23:33:48 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame AFC5 		295 B
401 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Wed, 25 Mar 2020 21:53:20 GMT
x-content-type-options
nosniff
content-type
image/png
server
cafe
age
49170
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Thu, 26 Mar 2020 21:53:20 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame AFC5 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CBlkA4pJ8XpvkF5GG7_UPu-SQ-Az6pOqrXPnlzP6FC7_hHhABIMyRriJguei-gNQBoAGvz97NA8gBCakCWemeMv5Msj7gAgCoAwHIAwqqBLACT9AISHpT2iWeay-uzb8_l8b7_CnrRn53MwEp8rzxWhI71MkakXlxiBFPV5D8Qk-wBkXnOTDTMbn1an67prsMk32mWvoeTEEeq5LtCPFS8Z3QHFo5T9OzpARJdyrHhs2tdwSbcgqZv_4FheRk5T25s0njNLDlogM5BiFpctKrtKMVqXn22qqjk4ZSszBzImNCoZPc_5HvfthSijVK_5dhRc3jLo2CrgkiFPIZ5_ZXDU7Vr0POyAPa1BiDBjct6JA4LlOdG0uvEKi7Lu4t3pwX4-AtaujFmC19HAl-H0C3LMifxgZJxdprRcg_LMT-NBkK4BaD55bsIXxHgSpCjJhGobWeumjXsCJpksM3l7fsBJuQsTU5Fs9ktiDdQUMLFOgOFFoDuFcwuO4P1oQY88bFrsAE8NavvtMC4AQBoAYugAe5sKEyqAeOzhuoB9XJG6gHk9gbqAef2xuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RvYBwDyBwQQpbso0ggJCIDhgHAQARgdgAoDyAsB2BMD&sigh=zXN8hicHov4&template_id=484&tpd=AGWhJmtJR-rckkvjsP36bL1EUBeOLhBH6EbIzX6jZSOmM-oCFA
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers
sodar
pagead2.googlesyndication.com/getconfig/ 		7 KB
5 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020030501&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
97d5ec0ffacceba50df95e57e60c306acf87de4d46f223a3bc95646d9eeca2ea
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin
https://www.zdnet.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
5162
x-xss-protection
0
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ Frame AFC5 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700
Origin
https://www.zdnet.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 31 Jan 2020 00:50:19 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:58 GMT
server
sffe
age
4790551
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
11020
x-xss-protection
0
expires
Sat, 30 Jan 2021 00:50:19 GMT
KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ Frame AFC5 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700
Origin
https://www.zdnet.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 05 Mar 2020 03:21:18 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:52 GMT
server
sffe
age
1843892
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
11180
x-xss-protection
0
expires
Fri, 05 Mar 2021 03:21:18 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1582746470043195"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
5456
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:50 GMT
n.js
geo.moatads.com/ 		112 B
286 B 		Script
General
Check archive.org
Download Go to
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=9&cm=17&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1585222371070&de=258041079404&m=0&ar=6ba875f-clean&iw=b4c0ffe&q=2&cb=0&ym=0&cu=1585222371070&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745974454%3A138239360957&zMoatPS=nav&zMoatPT=article&zMoatW=7&zMoatH=7&zMoatVGUID=03a6b66b-3f00-436b-adec-b3b55d39971c&zMoatSN=d&zMoatCURL=zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%2F&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=7x7&zMoatSZPS=7x7%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A2371%3A2371%3A2814%3A2364&iq=na&tt=na&tu=&tp=&fs=178191&na=57206425&cs=0&callback=DOMlessLLDcallback_56909619
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.254.97 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-254-97.eu-west-1.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
d780d9a7f9bff5fb29247d95c9b7f73f8801faafe349d7b4a2420050e6771cbc

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:51 GMT
server
TornadoServer/4.5.3
etag
"3c6e14e3b14c0fdd4cf48e715958659807cc42e0"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
112
n.js
geo.moatads.com/ 		113 B
287 B 		Script
General
Check archive.org
Download Go to
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=9&cm=17&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1585222371070&de=258041079404&m=0&ar=6ba875f-clean&iw=b4c0ffe&q=3&cb=0&ym=0&cu=1585222371070&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745974454%3A138239360957&zMoatPS=nav&zMoatPT=article&zMoatW=7&zMoatH=7&zMoatVGUID=03a6b66b-3f00-436b-adec-b3b55d39971c&zMoatSN=d&zMoatCURL=zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%2F&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=7x7&zMoatSZPS=7x7%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A2371%3A2371%3A2814%3A2364&iq=na&tt=na&tu=&tp=&fs=178191&na=2111762680&cs=0&callback=MoatDataJsonpRequest_56909619
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.254.97 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-254-97.eu-west-1.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
4e77b3acb1c1e33df39a23e14229591376d75fb38389536f02e752853457edc8

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:51 GMT
server
TornadoServer/4.5.3
etag
"d2f840f07d4ce5bc54a1cb86889ea1d5da5f77b4"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
113
gpt.js
www.googletagservices.com/tag/js/ Frame C1E1 		43 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: rev.cbsi.com
URL: https://rev.cbsi.com/common/js/adKit.min.js?1996769099
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2ad6f11aca9703e03bfe4c7bfc653ed76c80da9ead9eb8fbd4c4f883e967caba
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"467 / 904 of 1000 / last-modified: 1585081309"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
14458
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:51 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame B306 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/209/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
5727
date
Thu, 26 Mar 2020 11:07:37 GMT
expires
Fri, 26 Mar 2021 11:07:37 GMT
last-modified
Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
1514
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame AFC5 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Wed, 25 Mar 2020 23:33:48 GMT
x-content-type-options
nosniff
content-type
image/png
server
cafe
age
43143
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
2502
x-xss-protection
0
expires
Thu, 26 Mar 2020 23:33:48 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame AFC5 		295 B
360 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Wed, 25 Mar 2020 21:53:20 GMT
x-content-type-options
nosniff
content-type
image/png
server
cafe
age
49171
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Thu, 26 Mar 2020 21:53:20 GMT
integrator.js
adservice.google.de/adsid/ Frame C1E1 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame C1E1 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
104
x-xss-protection
0
pubads_impl_2020030501.js
securepubads.g.doubleclick.net/gpt/ Frame C1E1 		165 KB
60 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
sffe /
Resource Hash
8ee04e0441c9e51785d17ac835a93cf4d30d90826f87350b42ba233496a26f55
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 05 Mar 2020 14:08:10 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
61481
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:51 GMT
/
6852bd0a.akstat.io/ 		0
201 B 		Other
General
Check archive.org
Download Go to
Full URL
https://6852bd0a.akstat.io/
Requested by
Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:184::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin
https://www.zdnet.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Thu, 26 Mar 2020 11:32:51 GMT
access-control-allow-origin
https://www.zdnet.com
content-type
image/gif
status
204
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
timing-allow-origin
*
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:51 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame C1E1 		31 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=225380995819114&correlator=878697833936420&output=ldjh&impl=fifs&adsid=NT&vrg=2020030501&npa=1&guci=1.2.0.0.2.1.0.0&sc=1&sfv=1-0-37&ecs=20200326&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=372x142%2C372x142&prev_scp=env%3Dprod%26session%3Dd%26subses%3D4%26ptype%3Darticle%26vguid%3D03a6b66b-3f00-436b-adec-b3b55d39971c%7Cenv%3Dprod%26session%3Dd%26subses%3D4%26ptype%3Darticle%26vguid%3D03a6b66b-3f00-436b-adec-b3b55d39971c&cookie=ID%3D9a54c3f60bd9783e%3AT%3D1585222370%3AS%3DALNI_MbzJ5QQE2uF6Izl-DYi12VgdyLOOQ&cdm=www.zdnet.com&bc=31&abxe=1&lmt=1585222371&dt=1585222371454&dlt=1585222370884&idt=565&frm=23&biw=1585&bih=1200&isw=371&ish=771&oid=3&adxs=-12245933%2C-12245933&adys=-12245933%2C-12245933&adks=3261246841%2C3261246840&ucis=l3mtj13u07fw%7Cbn7j0djto8fs&ifi=1&ifk=1272445485&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%2F&top=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%2F&dssz=15&icsg=10888&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0%7C0x0&msz=0x0%7C0x0&ga_vid=817022470.1585222371&ga_sid=1585222371&ga_hid=2059244634&fws=256%2C256&ohw=0%2C0
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
cafe /
Resource Hash
dd4970a39dab59119e08d8fe32582a411933b79d030596155a0040926b8bef52
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin
https://www.zdnet.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Mar 2020 11:32:51 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
7633
x-xss-protection
0
google-lineitem-id
4746066197,4746066197
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138239375540,138239468731
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2020030501.js
securepubads.g.doubleclick.net/gpt/ Frame C1E1 		69 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
sffe /
Resource Hash
ffdc18ac8f47bcd50dd9c33532c334e7073717a62b367d95b9cb1561048547dc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 05 Mar 2020 14:08:10 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
25689
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:51 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame C1E1 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers
gen_204
pagead2.googlesyndication.com/pagead/ 		0
224 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020030501&jk=3532951436749807&bg=!eHule2NYMqE4lq9jpLMCAAAAM1IAAAAJmQFZe3LiwjhxmX_0SD3WpPwur9-Y1o_Y2asYCDIcrhhGs7hmhyWd_LRpItx2HKZYDNnEsKe-_-u3YItcvG3td6wDPVrUUIc4OnjRitiyp7aYBa-9FdB6AWuysaRIX_8m3JaQSwWYmtvIV8ZfvohjhdiheCeuAUcHDoY4FzEURRJShXAm3xWDkYdCnZKVPKBAbz0kDAT31b3AnGlEC7duwO96kPXVictcRPVwsBbCZtDaJnOW512gXzmLEVg5UFRIq67CyjgWvQSgabs-kJC9eed8E2ZD_nffXIgO03BuBuQ-xVuqF55KimJwYxTlunNmv31yC9u4aPdZyaXECVPRbd6Lul5JO8Ooxh1sK4P4tKSawD2aDCDOQFhnNaxeOs-w6DvcSN6jhS8Z3Gp4LU6VLaXOCd6pHKYA_O0pCKCB6BJKe90jFrSxzppP7hhIoZO_XmUCvprhLZOJBLBB
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 26 Mar 2020 11:32:51 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
204
cache-control
no-cache, must-revalidate
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame A486 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssrP7Sm4UvEfZGWXTKfkbc1R7YUN0hElEle4Zog9BZVWtww1uARpaVIBeYnpiHA3P-n6v-RfXlsudvo4BQxP9CWVJ_2NTsjVZUdwkBYeJbcckHT0fR_CnKN_4UZ2BXDA8jpEQQSie2LycQp08zjtatK5Mg3onEydXef9e5A-KZ5XqOfju1e1j1LIL6f3cRvnGf1lQQCLrU8fzyX2HAbjgzdCIKYtE9Q1jUFI0UiWYN6zs-6HdQq2zVAUcJX1pJa5naa_hzog8ZC&sig=Cg0ArKJSzL_CCrUzTJLoEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers

timing-allow-origin
*
date
Thu, 26 Mar 2020 11:32:51 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame A486 		74 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1585165059237800"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28264
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:51 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame A486 		314 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-101-185-246.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:51 GMT
content-encoding
gzip
last-modified
Wed, 11 Mar 2020 16:53:28 GMT
server
AmazonS3
x-amz-request-id
08ECB22213F3292C
etag
"2615d14012bc2e6c09dcdff2dd6bcd8e"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=13860
accept-ranges
bytes
content-length
107119
x-amz-id-2
Wqj7768f+TEy2a0L1YbUaKgJ4dcR7nziMbjUktBgm1QcjfZnfNw0jSx+/rldjLoR5TghzHSYEy4=
osd.js
www.googletagservices.com/activeview/js/current/ Frame C1E1 		74 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f2e60d0a77f1d63a9fd3b21fbb9d21345a61dc43d6c9b749e45753c5d993a6e8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1585165059237800"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28015
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:51 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame B99B 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssRm0r3B7oD627NDmOMzitiIfEWpAJ6qIONwtVkNc-KkgWaIKD4WZZEJ88R8h2DX0S98ZU-KZ3xUeuitwGg8Aa-D9wBW16vXkuipS2Ov44H2_gvUXVD2bcXBDiNXgRBwazKhYucBHsNULw0vFUd_TQWNXSHp5WUTrPba0rGu2MMax8PwgGuFvQbNArtfXZfjJhiOOmXVfBWUP8lUgE9HmxA1H6OcXKjbzXBd3RKXb5c_gNJHDrK_kuctIfe6F3AOV2mwUbfLxTL&sig=Cg0ArKJSzE4M34GtMXsQEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers

timing-allow-origin
*
date
Thu, 26 Mar 2020 11:32:51 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame B99B 		74 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1585165059237800"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28264
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:51 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame B99B 		314 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-101-185-246.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:51 GMT
content-encoding
gzip
last-modified
Wed, 11 Mar 2020 16:53:28 GMT
server
AmazonS3
x-amz-request-id
08ECB22213F3292C
etag
"2615d14012bc2e6c09dcdff2dd6bcd8e"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=13860
accept-ranges
bytes
content-length
107119
x-amz-id-2
Wqj7768f+TEy2a0L1YbUaKgJ4dcR7nziMbjUktBgm1QcjfZnfNw0jSx+/rldjLoR5TghzHSYEy4=
sodar
pagead2.googlesyndication.com/getconfig/ Frame C1E1 		7 KB
5 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020030501&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d88cc3da10b6adf3a23f35e8fb5485dd4571da53b717170ac23e6b7c92106cdf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Origin
https://www.zdnet.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 26 Mar 2020 11:32:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
5230
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ Frame C1E1 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:32:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1582746470043195"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
5456
x-xss-protection
0
expires
Thu, 26 Mar 2020 11:32:51 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 10F5 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/209/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
5727
date
Thu, 26 Mar 2020 11:07:37 GMT
expires
Fri, 26 Mar 2021 11:07:37 GMT
last-modified
Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
1514
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
gen_204
pagead2.googlesyndication.com/pagead/ Frame C1E1 		0
58 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020030501&jk=225380995819114&bg=!ubqluqJYAZFqFuoclPECAAAAOlIAAAALmQFfZtuYsI2VwwIh-panJk-hGVv8qAeVx5U-8zuw4qHW0OFouDs8JbH6cL0rj63ovqaiLot2HRsrucn-ZvlR0a1Z78BrjOreuO8Nfqlx4eURb8ErEC1eCmhUZ42YZjxUeoQN1Po9d0hJ4N8dthYvIioQG14JBVo86bzt0Y8SkA_wJWpnKh83BGakNxiuogxPc9slkPvTeIOdvpwSso1QPrvhj9tvBX_2ZWZDNOrwyOBS7sI6OPENzemYbx6l6eoKXukdiDR8RTOx5TJwHwqbBoRQVPvLpPbdGEWJsvBfV5VSGMpTIjxriE9S2OmJ9tdCKWNMMlbz3s8D9f08Vz4tCqHv2gWUeslGJVPZC9n7qb7rUkve6mKhEeQWz8I1d_sonzaPkcxcl0cgm2I5BSFLFPLvk3k4qp29UBhOzIGCoRzobEoRIZcQjrpQ5jRJ56XMF9yAz8WFw1kd_biftoVNarTY
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 26 Mar 2020 11:32:51 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
204
cache-control
no-cache, must-revalidate
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame AFC5 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=Ct0en4pJ8XpvkF5GG7_UPu-SQ-Az6pOqrXPnlzP6FC7_hHhABIMyRriJguei-gNQBoAGvz97NA8gBCakCWemeMv5Msj7gAgCoAwGqBLACT9AISHpT2iWeay-uzb8_l8b7_CnrRn53MwEp8rzxWhI71MkakXlxiBFPV5D8Qk-wBkXnOTDTMbn1an67prsMk32mWvoeTEEeq5LtCPFS8Z3QHFo5T9OzpARJdyrHhs2tdwSbcgqZv_4FheRk5T25s0njNLDlogM5BiFpctKrtKMVqXn22qqjk4ZSszBzImNCoZPc_5HvfthSijVK_5dhRc3jLo2CrgkiFPIZ5_ZXDU7Vr0POyAPa1BiDBjct6JA4LlOdG0uvEKi7Lu4t3pwX4-AtaujFmC19HAl-H0C3LMifxgZJxdprRcg_LMT-NBkK4BaD55bsIXxHgSpCjJhGobWeumjXsCJpksM3l7fsBJuQsTU5Fs9ktiDdQUMLFOgOFFoDuFcwuO4P1oQY88bFrsAE8NavvtMC4AQBoAYugAe5sKEyqAeOzhuoB9XJG6gHk9gbqAef2xuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RvYBwDyBwQQpbso0ggJCIDhgHAQARgdgAoDyAsB2BMD&sigh=zNcQ_NVZllQ&vt=1&template_id=484
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers
activeview
pagead2.googlesyndication.com/pcs/ Frame AFC5 		42 B
112 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuTmCn2w545eRfa6iaBY4O_HLiLBzDmvu-oGBdZGSgOkoqRmuPwvRsTckq332bjpa-9jdTfBZdHLKMI2kvLTU9c_U-ZBzONTIdBMb7hdj8fX7CntxAILq6-tV_bVA&sai=AMfl-YQ350qIZACJcHs5SYbrsapM7lZYMBR7aFyzmNLoh4TjmYseojftQcJuX5beJCri0rPgj0P8bb0cqEnHMoH3FDXWTP1PITX7Y3EQieLBiQ&sig=Cg0ArKJSzPphWpnmb36bEAE&id=ampim&o=1043,375&d=300,600&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=191&tls=1191&g=100&h=100&tt=1191&r=v&adk=1925781520&avms=ampa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 26 Mar 2020 11:32:52 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, must-revalidate
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.zdnet.com/homepage/xhr/ 		244 KB
26 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.zdnet.com/homepage/xhr/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2028-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
b987fd50e8daac1d432c16250ea8e1e7608ccadd834597c914a45eac6f4be72a
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Sec-Fetch-Dest
empty
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-length
26185
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 26 Mar 2020 10:22:16 GMT
x-frame-options
SAMEORIGIN
date
Thu, 26 Mar 2020 11:33:00 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
vary
Accept-Encoding, User-Agent
x-tx-id
1b97ca1e-41b2-4119-bae0-44b1c1e5c997
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Thu, 26 Mar 2020 11:52:16 GMT
ring.gif
zdnet3.cbsistatic.com/fly/1585163795-asset/bundles/zdnetcss/images/logos/ 		16 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet3.cbsistatic.com/fly/1585163795-asset/bundles/zdnetcss/images/logos/ring.gif
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://zdnet4.cbsistatic.com/fly/2028-fly/css/core/main-2e8dcfd593-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 11:33:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
57761
status
200
strict-transport-security
max-age=31536000
content-length
9039
x-xss-protection
1; mode=block
last-modified
Wed, 25 Mar 2020 19:16:35 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5e7bae13-3f75"
vary
Accept-Encoding
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 01 Apr 2020 19:30:18 GMT
ZDLogoMicroRed-x2.png
zdnet4.cbsistatic.com/fly/1585163795-asset/bundles/zdnetcss/images/logos/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet4.cbsistatic.com/fly/1585163795-asset/bundles/zdnetcss/images/logos/ZDLogoMicroRed-x2.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://zdnet4.cbsistatic.com/fly/2028-fly/css/core/main-2e8dcfd593-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 11:33:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
57762
status
200
strict-transport-security
max-age=31536000
content-length
1513
x-xss-protection
1; mode=block
last-modified
Wed, 25 Mar 2020 19:16:35 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5e7bae13-6fa"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 01 Apr 2020 19:30:18 GMT
ZDLogoMicroWhite-x2.png
zdnet3.cbsistatic.com/fly/1585163795-asset/bundles/zdnetcss/images/logos/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet3.cbsistatic.com/fly/1585163795-asset/bundles/zdnetcss/images/logos/ZDLogoMicroWhite-x2.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2028-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://zdnet4.cbsistatic.com/fly/2028-fly/css/core/main-2e8dcfd593-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 11:33:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
57773
status
200
strict-transport-security
max-age=31536000
content-length
1398
x-xss-protection
1; mode=block
last-modified
Wed, 25 Mar 2020 19:16:35 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5e7bae13-691"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 01 Apr 2020 19:30:05 GMT
river-time-ago-438a4081b3-rev.js
zdnet4.cbsistatic.com/fly/js/components/ 		757 B
510 B 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet4.cbsistatic.com/fly/js/components/river-time-ago-438a4081b3-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
0530e4df6865d32a7dd6ec29bdc785dc797671fd02f682781dd7bd95d10a5af7
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:33:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
578068
status
200
strict-transport-security
max-age=31536000
content-length
424
x-xss-protection
1; mode=block
last-modified
Wed, 18 Mar 2020 18:50:37 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5e726d7d-2f5"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 26 Mar 2020 18:58:32 GMT
tr-premium-promo-e55876004f-rev.js
zdnet2.cbsistatic.com/fly/js/components/ 		467 B
418 B 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/tr-premium-promo-e55876004f-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
a4a8c3eadc246870adf5e1fec2b4078ecaa8b9685903f092b77be183f886f8c8
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:33:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
578068
status
200
strict-transport-security
max-age=31536000
content-length
287
x-xss-protection
1; mode=block
last-modified
Wed, 18 Mar 2020 18:50:37 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
"5e726d7d-1d3"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 26 Mar 2020 18:58:31 GMT
load-more-11b0ac1e21-rev.js
zdnet3.cbsistatic.com/fly/js/components/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/load-more-11b0ac1e21-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
79246ee772aad2142011e8870a3ddaea2f9b0e13ac49054de3e58494e8d4e9ef
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:33:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
578065
status
200
strict-transport-security
max-age=31536000
content-length
1679
x-xss-protection
1; mode=block
last-modified
Wed, 18 Mar 2020 18:50:37 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5e726d7d-10fb"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 26 Mar 2020 18:58:35 GMT
/
www.zdnet.com/newsletter/xhr/widget-login/ 		2 KB
916 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.zdnet.com/newsletter/xhr/widget-login/?topic=
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2028-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d3b6ef3eb986546b5430770906ea41c3232d22d75f239509e1ce6a78b29c0d5c
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Sec-Fetch-Dest
empty
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-length
762
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
x-frame-options
SAMEORIGIN
date
Thu, 26 Mar 2020 11:33:01 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
vary
Accept-Encoding, User-Agent
x-tx-id
7e32ee0d-22c6-4bd8-952c-e02dc8cf30b0
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache
accept-ranges
bytes
/
www.zdnet.com/components/tr-promo-asset/xhr/ 		2 KB
1005 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.zdnet.com/components/tr-promo-asset/xhr/?topic=0
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/2028-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
5dc9e7d2f16aeba5fbcb6b7155784f399056af88eb6e5fbb1ec79632bcc7e352
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
Sec-Fetch-Dest
empty
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-length
617
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 26 Mar 2020 11:32:59 GMT
x-frame-options
SAMEORIGIN
date
Thu, 26 Mar 2020 11:33:01 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
vary
Accept-Encoding, User-Agent
x-tx-id
f6326aea-09c1-4c5d-8ef9-fd2ecff3e06c
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
accept-ranges
bytes
expires
Thu, 26 Mar 2020 13:02:59 GMT
load-more-1.0.js
zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/load-more-1.0.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 11:33:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
498412
status
200
strict-transport-security
max-age=31536000
content-length
2472
x-xss-protection
1; mode=block
last-modified
Thu, 19 Mar 2020 20:19:55 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5e73d3eb-1f51"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 27 Mar 2020 17:06:08 GMT
trp-promo-thumb.jpg
zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/core/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet1.cbsistatic.com/fly/bundles/zdnetcss/images/core/trp-promo-thumb.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
ContentServer /
Resource Hash
7e1c11d087377faf9afe4b26ebbaf30bff9196c728e8224d4226dc4c60626adc
Security Headers
Name Value
Content-Security-Policy default-src https://*.zdnet.com:*
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 11:33:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
498342
status
200
strict-transport-security
max-age=31536000
content-length
3111
x-xss-protection
1; mode=block
last-modified
Thu, 19 Mar 2020 20:18:30 GMT
server
ContentServer
x-frame-options
SAMEORIGIN
etag
W/"5e73d396-c82"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
gcstest
false
content-security-policy
default-src https://*.zdnet.com:*
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 27 Mar 2020 17:07:12 GMT

Verdicts & Comments Add Verdict or Comment

106 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| cbsoptanon object| soastaTracking object| ZdnetPageVars object| ZdnetFunctions number| BOOMR_lstart object| _sf_async_config number| _sf_startpt object| _cbq object| knownServiceWorkers object| BidBarrel string| _cbsotstate function| UUIDv4 string| __tealium_data_guid object| utag_data object| __core-js_shared__ function| setImmediate function| clearImmediate object| pbjs object| _pbjsGlobals object| adFlow object| googletag function| requirejs function| require function| define object| OneTrustStub string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer object| BOOMR object| BOOMR_mq function| $ function| jQuery object| Modernizr number| BOOMR_configt object| _bmrEvents number| _sf_endpt function| blankAdCallback function| CbsMoatListener object| jQuery18305787215877198273 function| receiveOTMessage object| otStubData object| ggeac object| closure_memoize_cache_ object| googleToken object| googleIMState object| google_js_reporting_queue function| processGoogleToken object| CryptoJS object| mPulseApp function| jsonFeed object| Optanon object| OneTrust object| adsbygoogle number| google_srt undefined| google_measure_js_timing number| __google_ad_urls_id number| google_unique_id object| gaGlobal undefined| easyXDM object| AudEng object| URS function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter number| BOOMR_onload function| Waypoint object| debug string| adBlockCookieValue object| $tealium boolean| searchOpen object| $lastFocusedInput string| pageType string| waypointContextKey undefined| _ function| Hls undefined| uuid function| addResizeListener function| removeResizeListener object| cvui object| uvpjs function| Class object| mpulseUserTiming object| __google_ad_urls object| ampInaboxIframes object| ampInaboxPendingMessages boolean| google_osd_loaded boolean| google_onload_fired object| GoogleGcLKhOms function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| Moat#G26 boolean| Moat#EVA object| MoatSuperV26 object| DOMlessLLDcallback_56909619 object| MoatDataJsonpRequest_56909619 object| __AMP_LOG object| __AMP_ERRORS boolean| ampInaboxInitialized object| __AMP_MODE function| __AMP_REPORT_ERROR object| ampInaboxPositionObserver object| ampInaboxFrameOverlayManager object| AMP object| google_image_requests

12 Cookies

Domain/Path Name / Value
.zdnet.com/ Name: RT
Value: "z=1&dm=zdnet.com&si=ad3e1182-cf29-4f43-9265-646ee0cde36f&ss=k88ogv2d&sl=1&tt=266&bcn=%2F%2F6852bd0a.akstat.io%2F&ld=269"
.zdnet.com/ Name: zdnetSessionCount
Value: 1
www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify Name: pv
Value: 1
.zdnet.com/ Name: zdnetSessionStarted
Value: true
.zdnet.com/ Name: arrowImpCnt
Value: 1
.zdnet.com/ Name: arrowImp
Value: true
www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify Name: zdnet_ad
Value: %7B%22type%22%3A%22gpt%22%2C%22region%22%3A%22uk%22%2C%22subses%22%3A%224%22%2C%22session%22%3A%22d%22%7D
.zdnet.com/ Name: fly_preferred_edition
Value: eu
.zdnet.com/ Name: OptanonConsent
Value: isIABGlobal=false&datestamp=Thu+Mar+26+2020+12%3A32%3A50+GMT%2B0100+(Central+European+Standard+Time)&version=5.12.0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fproof-of-concept-code-published-for-citrix-bug-as-attacks-intensify%2F&groups=1%3A1%2C2%3A0%2C3%3A0%2C4%3A0%2C5%3A0&hosts=H123%3A1%2CH296%3A1%2Ckad%3A1%2Cykx%3A0%2CH74%3A0%2Cnhp%3A0%2CH314%3A0%2CH378%3A0%2Cycm%3A0%2CH551%3A0%2Cqgc%3A0%2CH33%3A0%2Cevp%3A0%2Cmsc%3A0%2CH38%3A0%2Csbj%3A0%2CH82%3A0%2CH93%3A0%2CH98%3A0%2Cshp%3A0%2Cocn%3A0%2Cxol%3A0%2Cldx%3A0%2CH134%3A0%2Cgbj%3A0%2Cxuc%3A0%2CH148%3A0%2Cket%3A0%2Cyhw%3A0%2Cowg%3A0%2Caau%3A0%2CH194%3A0%2Cxzz%3A0%2Cgos%3A0%2Ckij%3A0%2Cqqh%3A0%2CH215%3A0%2CH229%3A0%2Cbjv%3A0%2Cgny%3A0%2Cfgh%3A0%2Ckbc%3A0%2Cezx%3A0%2Clbl%3A0%2Cjyk%3A0%2CH250%3A0%2Cpmv%3A0%2CH270%3A0%2Clzu%3A0%2Cpve%3A0%2CH276%3A0%2Ctch%3A0%2Cxmd%3A0%2Ciax%3A0%2Cqnc%3A0%2CH315%3A0%2Cuxy%3A0%2Cumx%3A0%2CH333%3A0%2CH335%3A0%2CH338%3A0%2Ccnd%3A0%2Cobo%3A0%2CH355%3A0%2Ctas%3A0%2Cqtj%3A0%2Ceod%3A0%2Cxxp%3A0%2Czmt%3A0%2Cmym%3A0%2CH387%3A0%2Cmdi%3A0%2Ciex%3A0%2Chqo%3A0%2CH407%3A0%2CH411%3A0%2Crjz%3A0%2CH412%3A0%2CH420%3A0%2CH430%3A0%2Cwit%3A0%2Clvb%3A0%2CH456%3A0%2CH458%3A0%2CH463%3A0%2CH464%3A0%2Cdmn%3A0%2CH475%3A0%2CH477%3A0%2Cfst%3A0%2Cyxb%3A0%2Ceri%3A0%2CH518%3A0%2Cpcn%3A0%2Cjva%3A0%2Czmy%3A0%2CH545%3A0%2CH554%3A0%2CH566%3A0%2Czou%3A0%2Cdzf%3A0%2Cyon%3A0%2Cdmn%3A0%2Ckuw%3A0%2Cndb%3A0
.zdnet.com/ Name: fly_default_edition
Value: eu
.zdnet.com/ Name: fly_device
Value: desktop
.zdnet.com/ Name: fly_geo
Value: {"countryCode": "de"}

36 Console Messages

Source Level URL
Text
console-api info URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 283)
Message:
Registration of service worker /service-worker.js successful with scope:https://www.zdnet.com/
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 298)
Message:
Found registered service worker: [object ServiceWorkerRegistration]
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167)
Message:
%c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: _injectQueryStringGCP functional
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167)
Message:
%c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_chartbeat performance
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167)
Message:
%c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_tealium functional
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 30)
Message:
Loading iframes
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167)
Message:
%c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_urban_airship targeting
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167)
Message:
%c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167)
Message:
%c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_sharebar social
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167)
Message:
%c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167)
Message:
%c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_sharebar social
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167)
Message:
%c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_taboola targeting
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167)
Message:
%c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167)
Message:
%c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167)
Message:
%c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_async_load targeting
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167)
Message:
%c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167)
Message:
%c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api log (Line 71)
Message:
blank creative loaded: 138239360957 (7 x 7, pos=nav, slot=nav-ad)
console-api log (Line 71)
Message:
blank creative loaded: 138239447317 (728 x 90, pos=top, slot=leader-plus-top)
console-api log (Line 71)
Message:
blank creative loaded: 138239450920 (300 x 250, pos=middle, slot=mpu-middle)
console-api log (Line 71)
Message:
blank creative loaded: 138239368367 (641 x 321, pos=top, slot=inpage-video-top)
console-api log (Line 71)
Message:
blank creative loaded: 138239344181 (11 x 11, pos=top, slot=sharethrough-top)
console-api log (Line 71)
Message:
blank creative loaded: 138248164648 (300 x 250, pos=bottom, slot=mpu-bottom)
console-api log (Line 71)
Message:
blank creative loaded: 138239338269 (970 x 66, pos=bottom, slot=leader-plus-bottom)
console-api info URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js(Line 407)
Message:
Powered by AMP ⚡ HTML – Version 2003101714470 https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 164)
Message:
Dynamic Showcase Center container ::: creative id = 138247024569
console-api log (Line 71)
Message:
blank creative loaded: 138239375540 (372 x 142, pos=, slot=dynamic_showcase__0)
console-api log (Line 71)
Message:
blank creative loaded: 138239468731 (372 x 142, pos=, slot=dynamic_showcase__1)
console-api warning URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js(Line 20)
Message:
[amp-analytics/transport] Response unparseable or failed to send image request https://securepubads.g.doubleclick.net/pagead/adview?ai=Ct0en4pJ8XpvkF5GG7_UPu-SQ-Az6pOqrXPnlzP6FC7_hHhABIMyRriJguei-gNQBoAGvz97NA8gBCakCWemeMv5Msj7gAgCoAwGqBLACT9AISHpT2iWeay-uzb8_l8b7_CnrRn53MwEp8rzxWhI71MkakXlxiBFPV5D8Qk-wBkXnOTDTMbn1an67prsMk32mWvoeTEEeq5LtCPFS8Z3QHFo5T9OzpARJdyrHhs2tdwSbcgqZv_4FheRk5T25s0njNLDlogM5BiFpctKrtKMVqXn22qqjk4ZSszBzImNCoZPc_5HvfthSijVK_5dhRc3jLo2CrgkiFPIZ5_ZXDU7Vr0POyAPa1BiDBjct6JA4LlOdG0uvEKi7Lu4t3pwX4-AtaujFmC19HAl-H0C3LMifxgZJxdprRcg_LMT-NBkK4BaD55bsIXxHgSpCjJhGobWeumjXsCJpksM3l7fsBJuQsTU5Fs9ktiDdQUMLFOgOFFoDuFcwuO4P1oQY88bFrsAE8NavvtMC4AQBoAYugAe5sKEyqAeOzhuoB9XJG6gHk9gbqAef2xuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RvYBwDyBwQQpbso0ggJCIDhgHAQARgdgAoDyAsB2BMD&sigh=zNcQ_NVZllQ&vt=1&template_id=484
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167)
Message:
%c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167)
Message:
%c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_taboola targeting
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167)
Message:
%c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167)
Message:
%c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167)
Message:
%c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167)
Message:
%c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_async_load targeting
console-api log URL: https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/(Line 167)
Message:
%c One Trust color:#000;border-radius:3px;background-color:hsl(161, 100%, 94%); Added to Scripts Queue: script_medusa_recommendation targeting

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

6852bd0a.akstat.io
adservice.google.be
adservice.google.com
adservice.google.de
at.cbsi.com
c.go-mpulse.net
cdn.ampproject.org
cdn.cookielaw.org
ev4i6baxg6qscxt4slra-pq60dh-ac41883d1-clientnsv4-s.akamaihd.net
fiaqj6absjkbikqce3yboaaabvphzexc-pq60dh-03bb5d178-clienttons-s.akamaihd.net
fonts.googleapis.com
fonts.gstatic.com
geo.moatads.com
geolocation.onetrust.com
pagead2.googlesyndication.com
production-cmp.isgprivacy.cbsi.com
rev.cbsi.com
secure-web.cisco.com
securepubads.g.doubleclick.net
tpc.googlesyndication.com
trial-eum-clientnsv4-s.akamaihd.net
trial-eum-clienttons-s.akamaihd.net
urs.zdnet.com
vidtech.cbsinteractive.com
www.googletagservices.com
www.zdnet.com
z.moatads.com
zdnet1.cbsistatic.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
zdnet4.cbsistatic.com
104.108.48.175
151.101.193.188
152.195.132.202
172.217.22.98
23.55.161.33
2606:4700:10::6814:b944
2620:101:2002:11f0::1001
2a00:1450:4001:809::2002
2a00:1450:4001:80b::2002
2a00:1450:4001:80b::200a
2a00:1450:4001:819::2002
2a00:1450:4001:81b::2001
2a00:1450:4001:81c::2003
2a00:1450:4001:820::2002
2a02:26f0:1700:d::1737:6e8c
2a02:26f0:1700:d::1737:6e9a
2a02:26f0:6c00:184::11a6
2a02:26f0:6c00:192::11a6
2a04:4e42:1b::444
2a04:4e42:1b::645
35.190.38.167
52.215.254.97
95.101.185.246
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0530e4df6865d32a7dd6ec29bdc785dc797671fd02f682781dd7bd95d10a5af7
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
10746f1ca4f7d882f4d6a0d9313451442abb605e507df9eb998b7f8e47e253c9
15ec195d9e2d786a5d1f400841ffbfe7d2140847c2242eee69e76381d011f3b0
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c
1af59b833b9f92281f5d4a22b80ae9e2c5d80ea9b82c993e070f864e75ac9dd9
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9
1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b
21c9c7889404394d4e4c780022b56b5fa39e83b19c34eb0508561a115a1dcc6a
2ad6f11aca9703e03bfe4c7bfc653ed76c80da9ead9eb8fbd4c4f883e967caba
2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab
309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
378a26f0ba71ef16eb3e0d7ed8505b3eab2f0396ae557ad8f0db2b947f2aab03
37a6555c40beb95044f38f03904a914fd7bd4464f505bd9d8e45b803b66219e7
3d0c18b56d3b9bd3640250af1ce1e624bda890531f830d64c99d45e6c07bb349
4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10
458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172
45ef8c8e9fe846c57c43c7eab4c65b4df0454573ad3e72f4d00183ebdbf76ef3
462affeccc8485529f34f0328e9ce8a661b824def972da6dcaaa42d4a2892dde
4e77b3acb1c1e33df39a23e14229591376d75fb38389536f02e752853457edc8
56b494710bd864d1b29e10a8ef614440e2d1c5eeb94c232a831b737acd298045
59885bfb5e656608f92c016d612e07a2b13455762a9e8c672972cbf10602a04a
5dc9e7d2f16aeba5fbcb6b7155784f399056af88eb6e5fbb1ec79632bcc7e352
5e7e11fba17ea011a72208eea45496ec5392beb8b74a99cce77f5ff03cfffc8e
5ea818604aa385d1fea726beaf424f869064a5a50621599949033f3d10009f19
6109d5731632d64df9eb483fcde4fb912fbe0e95eab63b7db6739f7a3f6ee757
662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f
66bfbd7b6c6053d10206c0a02bd2ca6607bc56371132a74a06dad24ce3c6a716
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
6c5a182a02e8af890dce969225c98f7f36aaf46c0ed141c78152cba8f69dd890
70d1b63641ae86512ee80c400ae1c15c7b5d723d2c9517a75f7637b22707e13f
7249de2725322fdd70620c4466b78479f7b4e2e070700dafc43cd520cca2052b
744ae87db00be85a6a482a3e8036f81aafaa7754be29b05a2330d0fbc8fea803
76ebd2a7078570fa9f6a50855b4ade57c6b558cca7c95801b2b247406b274975
79246ee772aad2142011e8870a3ddaea2f9b0e13ac49054de3e58494e8d4e9ef
7b8ef4f3c2daa40e68de70096105302da24a586c1d75b620dff0ff579db73ba8
7e1c11d087377faf9afe4b26ebbaf30bff9196c728e8224d4226dc4c60626adc
7fa1c7b1686f9f116183456c39f7b3ed9cce063cfb428e575fe4a29ae05c4fa6
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8048c8f9ab50a8d4717fd75f1d55f75c070b659ef9bd126eb543e2e230a3630b
824e2ec0553bc582c02673a30139ac8fe4a6485943d64d32dfb7ae5a83efbe92
831908d0b19350a69e26f3ee6a650916248526ae23e88bff638bead93b990fba
8b8ae1bc228572a3df725a7f417c91b4439e0321ed354d8c25e4c24beee5627e
8e00ebebe053ff93e139bab1a80ced2517b33572ab374ae641e0e1cfed58d8e0
8ee04e0441c9e51785d17ac835a93cf4d30d90826f87350b42ba233496a26f55
92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc
95783bf43b78701a92daf5ec7268db97c7144599c774821126b8cc5396724bfa
95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54
96ff870ee7a7a5ad1f5bd2413f0f0d938b6d04170c0b221e7215d00a61c58a4a
97d5ec0ffacceba50df95e57e60c306acf87de4d46f223a3bc95646d9eeca2ea
a0aa48808ddef7604ba969db62e4af3a2ba001b7a8751823cf0ab2d430308ea5
a1e55792b6c1a1a6129177906fa02070a13d4033f1c176b49aba5ac4626940eb
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
a4a8c3eadc246870adf5e1fec2b4078ecaa8b9685903f092b77be183f886f8c8
a70d5b9ad136255942779acf94da5cc72316fde5c10c5e7707d6f1888f43dcb8
afd30810a1ce203bfbe57dfa6d18f1c9305e9dc90e72a0b5edeeace6fe0b7e4f
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b8fbbb37b4ea73998c224487d1bae84f2b75fa21ae63f0c2975cf9b50e31bea0
b987fd50e8daac1d432c16250ea8e1e7608ccadd834597c914a45eac6f4be72a
c2b0d171a4179bf00898c430c1c15464e528aff5762fc70a5d02184834c82eff
cd715c0fa7d69e85432e8b08d0a02b9613edf40212cca2040bde31670167638e
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108
d0827f83512d599378bd8e8c22241fa6ff6166c22df0cefbfab9e592870b498d
d0cbfb1ab0f94123834567e32df7ec74a1c210793f797368d41a4b4c2732d4a0
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41
d3b6ef3eb986546b5430770906ea41c3232d22d75f239509e1ce6a78b29c0d5c
d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c
d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e
d780d9a7f9bff5fb29247d95c9b7f73f8801faafe349d7b4a2420050e6771cbc
d88cc3da10b6adf3a23f35e8fb5485dd4571da53b717170ac23e6b7c92106cdf
da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016
dd4970a39dab59119e08d8fe32582a411933b79d030596155a0040926b8bef52
de538a62257057626ff3689528e255f7a67482f33987fea0e0085da48281d016
dfd272053c730cd470302af475eb401d9be41c81f0081c20d7910f6c12732c9d
e0f58ade4784ef72431fdaad900e3be9e5c50dbb598da828078162f760a49fe3
e17e03dc3ff1767a8d185975a2bf392068a0b2f2848503c38ceaa3f10fb0ea84
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e96bf7ebef41b3593260a56798bbbdc8c9956e8fb1538694cc55e35db99035bb
ea7373d7059ab32d4304249b48a91311f91d2dce5e1ebf10450f33f9a8c5f5ec
eada136c924874367d33d22fb496800b3f6f4e97f457829d2c18b5d41f1019a5
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2e60d0a77f1d63a9fd3b21fbb9d21345a61dc43d6c9b749e45753c5d993a6e8
f3e2e0f12c5badfe408d69bf6c0fa9ce6247f9a45c849851a53b8647637cfcd0
f7836b2f47db501a0ca469b5ffe30663261fa3f7c5c55eb06adb4b497e31a002
f7dc6a1bae51c0a2e920de1685603814e79126cde0cbffeeec54478b01008b9b
f82e8053fbcd78685d9e26caebeebc38ee73eb9afa4bb36765c50ce6614eebf3
f960850602bf08fdda44ff3f2793d25600520e8bf7824768006bd75639345b94
f9a4af01b9bd0289b2d524b9e65c320d313e2da69837d2582a82eec4b546a981
f9ed9c8e8c3c5f2feb08338f28fd61f12fbc6e700bb885bc0bc97b31f042d410
fa4db5fefacfb2ff7bc04ff189c9a87da19c40d909274b0dbce20ab3baf2ed89
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097
ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5
ffdc18ac8f47bcd50dd9c33532c334e7073717a62b367d95b9cb1561048547dc